@haus-tech/haus-workflow 5.3.0 → 5.4.0

package/dist/cli.js

@@ -1226,7 +1226,8 @@ function parseManifest(json) {
       version: root.version,
       manifestFormat: format.format,
       items,
-      ...root.globalPlugins !== void 0 ? { globalPlugins: root.globalPlugins } : {}
+      ...root.globalPlugins !== void 0 ? { globalPlugins: root.globalPlugins } : {},
+      ...root.profiles !== void 0 ? { profiles: root.profiles } : {}
     },
     warnings
   };
@@ -1623,6 +1624,7 @@ var init_ingest_catalog = __esm({
 // src/catalog/remote-catalog/sync.ts
 var sync_exports = {};
 __export(sync_exports, {
+  buildCacheManifest: () => buildCacheManifest,
   getCacheManifestAge: () => getCacheManifestAge,
   syncRemoteCatalog: () => syncRemoteCatalog
 });
@@ -1859,6 +1861,16 @@ async function syncOneItem(item, base) {
     return "failed";
   }
 }
+function buildCacheManifest(input2) {
+  return {
+    version: input2.version,
+    manifestFormat: input2.manifestFormat,
+    ...input2.catalogRef !== null ? { catalogRef: input2.catalogRef } : {},
+    items: input2.items,
+    ...input2.globalPlugins !== void 0 ? { globalPlugins: input2.globalPlugins } : {},
+    ...input2.profiles !== void 0 ? { profiles: input2.profiles } : {}
+  };
+}
 async function syncRemoteCatalog(projectRoot) {
   if (isOffline()) {
     warn("Offline \u2014 skipping catalog sync; using cached or bundled content.");
@@ -1888,7 +1900,7 @@ async function syncRemoteCatalog(projectRoot) {
       ...getPrivateCatalogDenial() ? { accessDenied: getPrivateCatalogDenial() } : {}
     };
   }
-  const { version, manifestFormat, items, globalPlugins } = fetched.manifest;
+  const { version, manifestFormat, items, globalPlugins, profiles } = fetched.manifest;
   const cacheDir = getCacheDir();
   const catalogRef = expectedCatalogRef(projectRoot);
   try {
@@ -1911,13 +1923,7 @@ async function syncRemoteCatalog(projectRoot) {
       // per-project pin (#239) means two projects can want two different refs: without
       // this field, whichever synced last silently serves its content to the other.
       `${JSON.stringify(
-        {
-          version,
-          manifestFormat,
-          ...catalogRef !== null ? { catalogRef } : {},
-          items,
-          ...globalPlugins !== void 0 ? { globalPlugins } : {}
-        },
+        buildCacheManifest({ version, manifestFormat, catalogRef, items, globalPlugins, profiles }),
         null,
         2
       )}
@@ -1998,7 +2004,7 @@ var init_sync = __esm({
 // src/cli.ts
 init_offline();
 import { readFileSync as readFileSync5 } from "node:fs";
-import path91 from "node:path";
+import path92 from "node:path";
 import { Command, Option } from "commander";
 
 // src/commands/apply.ts
@@ -2210,13 +2216,14 @@ import path9 from "node:path";
 import fs7 from "fs-extra";
 var WORKFLOW_TEMPLATE_REL = "templates/agentic-workflow-standard.md";
 async function readWorkflowTemplate(opts = {}) {
-  const dest = path9.join(getCacheDir(), WORKFLOW_TEMPLATE_REL);
+  const rel = opts.templateRel ?? WORKFLOW_TEMPLATE_REL;
+  const dest = path9.join(getCacheDir(), rel);
   if (isOffline()) {
     if (await fs7.pathExists(dest)) return fs7.readFile(dest, "utf8");
     return null;
   }
   const base = await remoteBase(opts.projectRoot);
-  const { url, headers } = await catalogContentRequest(base, WORKFLOW_TEMPLATE_REL);
+  const { url, headers } = await catalogContentRequest(base, rel);
   const text = await fetchText(url, headers);
   if (text === null) {
     if (await fs7.pathExists(dest)) return fs7.readFile(dest, "utf8");
@@ -2251,7 +2258,8 @@ async function loadCatalogContext(root) {
       source: "fixture",
       manifestFormat: assertSupportedManifestFormat(data2?.manifestFormat, "The fixture catalog"),
       version: manifestVersion(data2?.version),
-      globalPlugins: data2?.globalPlugins
+      globalPlugins: data2?.globalPlugins,
+      profiles: data2?.profiles
     };
   }
   const cacheDir = getCacheDir();
@@ -2273,7 +2281,8 @@ async function loadCatalogContext(root) {
           "The cached catalog"
         ),
         version: manifestVersion(cacheData.version),
-        globalPlugins: cacheData.globalPlugins
+        globalPlugins: cacheData.globalPlugins,
+        profiles: cacheData.profiles
       };
     }
   }
@@ -2289,7 +2298,8 @@ async function loadCatalogContext(root) {
         "The project-local catalog"
       ),
       version: manifestVersion(localData.version),
-      globalPlugins: localData.globalPlugins
+      globalPlugins: localData.globalPlugins,
+      profiles: localData.profiles
     };
   }
   const packageManifest = path11.join(packageRoot(), "library/catalog/manifest.json");
@@ -2300,7 +2310,8 @@ async function loadCatalogContext(root) {
     source: "bundled",
     manifestFormat: assertSupportedManifestFormat(data?.manifestFormat, "The bundled catalog"),
     version: manifestVersion(data?.version),
-    globalPlugins: data?.globalPlugins
+    globalPlugins: data?.globalPlugins,
+    profiles: data?.profiles
   };
 }
 async function catalogFormatRefusal(root) {
@@ -2509,7 +2520,7 @@ async function migrateRequestState(root, dryRun, notify) {
 
 // src/claude/write-claude-files.ts
 import path27 from "node:path";
-import fs25 from "fs-extra";
+import fs26 from "fs-extra";
 init_ingest_catalog();
 
 // src/catalog/skill-description.ts
@@ -2845,6 +2856,206 @@ function mergeRecommendationWarnings(context, isLinkedWorktree = false) {
   return [.../* @__PURE__ */ new Set([...statusLines, ...context.warnings, ...riskLines])];
 }
 
+// src/claude/project-profile.ts
+init_project_pin();
+init_logger();
+
+// src/claude/project-intent.ts
+init_project_pin();
+init_fs();
+init_logger();
+init_paths();
+import fs10 from "fs-extra";
+function normalizeIdList(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.filter((entry) => typeof entry === "string" && entry.length > 0)
+    )
+  ];
+}
+function normalizeSignalList(value) {
+  return [...new Set(normalizeIdList(value).map((entry) => entry.toLowerCase()))];
+}
+async function readProjectConfigObject(root) {
+  try {
+    const data = await readJson(hausPath(root, PROJECT_CONFIG_FILE));
+    if (data == null || typeof data !== "object" || Array.isArray(data)) return null;
+    return data;
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    warn(
+      `${PROJECT_CONFIG_REL} could not be read (${err instanceof Error ? err.message : String(err)}) \u2014 treating project intent as unset`
+    );
+    return null;
+  }
+}
+async function updateProjectConfig(root, mutate) {
+  const file = hausPath(root, PROJECT_CONFIG_FILE);
+  let existing = {};
+  if (await fs10.pathExists(file)) {
+    try {
+      const parsed = JSON.parse(await fs10.readFile(file, "utf8"));
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        existing = { ...parsed };
+      } else {
+        warn(`${PROJECT_CONFIG_REL} is not a JSON object \u2014 rewriting with haus-managed keys only`);
+      }
+    } catch (err) {
+      warn(
+        `${PROJECT_CONFIG_REL} could not be parsed (${err instanceof Error ? err.message : String(err)}) \u2014 rewriting with haus-managed keys only`
+      );
+    }
+  }
+  await writeJson(file, mutate(existing));
+}
+async function readProjectIncludedIds(root) {
+  const data = await readProjectConfigObject(root);
+  return data == null ? [] : normalizeIdList(data.includedIds);
+}
+async function addProjectIncludedIds(root, ids) {
+  const toAdd = normalizeIdList(ids);
+  if (toAdd.length === 0) return;
+  await updateProjectConfig(root, (existing) => ({
+    ...existing,
+    includedIds: [.../* @__PURE__ */ new Set([...normalizeIdList(existing.includedIds), ...toAdd])].sort()
+  }));
+}
+function withdrawIncludedIds(existing, ids) {
+  const drop = new Set(ids);
+  return normalizeIdList(existing.includedIds).filter((id) => !drop.has(id));
+}
+async function readDeclaredContext(root) {
+  const data = await readProjectConfigObject(root);
+  if (data == null) return { roles: [], stacks: [] };
+  return {
+    roles: normalizeSignalList(data.declaredRoles),
+    stacks: normalizeSignalList(data.declaredStacks)
+  };
+}
+
+// src/claude/project-profile.ts
+var PROFILE_IDS = ["production", "poc"];
+var DEFAULT_PROFILE = "production";
+var PROFILES = {
+  production: {
+    workflowTemplateRel: WORKFLOW_TEMPLATE_REL,
+    writesCiGate: true,
+    writesDecisionsSeed: true,
+    droppedHookCommands: [],
+    workflowConfig: "standard"
+  },
+  poc: {
+    // Catalog item `haus.agentic-workflow-poc` (catalog ADR-0066); fetched by path for WORKFLOW.md, exactly like the production standard, and kept out of item recommendations by id (Task 3).
+    workflowTemplateRel: "templates/agentic-workflow-poc.md",
+    writesCiGate: false,
+    writesDecisionsSeed: false,
+    droppedHookCommands: ["haus decisions guard --from-hook", "haus decisions suggest --from-hook"],
+    workflowConfig: "poc"
+  }
+};
+function isProfileId(value) {
+  return typeof value === "string" && PROFILE_IDS.includes(value);
+}
+function parseProfile(value) {
+  if (value === void 0 || value === null) return { profile: DEFAULT_PROFILE, malformed: false };
+  if (isProfileId(value)) return { profile: value, malformed: false };
+  return { profile: DEFAULT_PROFILE, malformed: true };
+}
+async function readProjectProfile(root) {
+  const data = await readProjectConfigObject(root);
+  const { profile, malformed } = parseProfile(data?.profile);
+  if (malformed) {
+    warn(
+      `${PROJECT_CONFIG_REL}: unknown profile ${JSON.stringify(data?.profile)} \u2014 expected one of ${PROFILE_IDS.join(", ")}; treating as ${DEFAULT_PROFILE}`
+    );
+  }
+  return profile;
+}
+async function writeProjectProfile(root, profile) {
+  await updateProjectConfig(root, (existing) => ({ ...existing, profile }));
+}
+function pocLockedMessage() {
+  return `This repo is a PoC (profile "poc" in ${PROJECT_CONFIG_REL}). Production starts from zero in a new repo, with docs/MANUS.md as input (\`/haus-workflow new\` in production mode). To re-run setup here, pass \`haus init --profile poc\`. To leave the PoC profile on purpose, remove the "profile" line from ${PROJECT_CONFIG_REL} by hand. Nothing was written.`;
+}
+
+// src/recommender/profile-gate.ts
+init_logger();
+var WORKFLOW_TEMPLATE_ITEM_IDS = /* @__PURE__ */ new Set([
+  "haus.agentic-workflow-poc"
+]);
+var KNOWN_CLAUSES = ["tags", "ids"];
+function stringList(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
+    warn(`${label} is not a string array \u2014 ignoring it`);
+    return [];
+  }
+  return value;
+}
+function parseProfileRules(raw, profile, knownIds) {
+  if (profile === "production") return { tags: /* @__PURE__ */ new Set(), ids: /* @__PURE__ */ new Set(), keepIds: /* @__PURE__ */ new Set() };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const block = raw[profile];
+  if (!block || typeof block !== "object" || Array.isArray(block)) return null;
+  const exclude = block.exclude;
+  const clauses = exclude && typeof exclude === "object" && !Array.isArray(exclude) ? exclude : {};
+  for (const key of Object.keys(clauses)) {
+    if (!KNOWN_CLAUSES.includes(key)) {
+      warn(
+        `profiles.${profile}.exclude.${key}: unknown clause (catalog schema evolved ahead of this CLI version) \u2014 ignoring it`
+      );
+    }
+  }
+  const keepIds = stringList(
+    block.keepIds,
+    `profiles.${profile}.keepIds`
+  ).filter((id) => {
+    if (knownIds !== void 0 && !knownIds.has(id)) {
+      warn(
+        `profiles.${profile}.keepIds names an id the catalog does not have (${id}) \u2014 ignoring it`
+      );
+      return false;
+    }
+    return true;
+  });
+  return {
+    tags: new Set(
+      stringList(clauses.tags, `profiles.${profile}.exclude.tags`).map((t) => t.toLowerCase())
+    ),
+    ids: new Set(stringList(clauses.ids, `profiles.${profile}.exclude.ids`)),
+    keepIds: new Set(keepIds)
+  };
+}
+function profileVerdict(item, rules) {
+  if (rules.ids.has(item.id)) return { kind: "excluded", clause: `id:${item.id}` };
+  const tag = item.tags.find((t) => rules.tags.has(t.toLowerCase()));
+  if (!tag) return null;
+  const clause = `tag:${tag.toLowerCase()}`;
+  return rules.keepIds.has(item.id) ? { kind: "kept", clause } : { kind: "excluded", clause };
+}
+function describeCatalogTier(ctx) {
+  return `${ctx.source}${ctx.version ? ` (v${ctx.version})` : ""}`;
+}
+function profileRefusalMessage(profile, catalogLabel) {
+  return `This project is set to profile "${profile}", but the ${catalogLabel} catalog defines no "${profile}" profile (needs haus-workflow-catalog >= 6.5.0). Run \`haus update\` to fetch a newer catalog, or set "profile" back to "production" in .haus-workflow/haus.config.json.`;
+}
+var ProfileUnsupportedError = class extends Error {
+  profile;
+  catalogLabel;
+  constructor(profile, catalogLabel) {
+    super(profileRefusalMessage(profile, catalogLabel));
+    this.name = "ProfileUnsupportedError";
+    this.profile = profile;
+    this.catalogLabel = catalogLabel;
+  }
+};
+async function profileRefusal(root, profileOverride) {
+  const profile = profileOverride ?? await readProjectProfile(root);
+  const ctx = await loadCatalogContext(root);
+  return parseProfileRules(ctx.profiles, profile) === null ? profileRefusalMessage(profile, describeCatalogTier(ctx)) : null;
+}
+
 // src/recommender/superseded-by-plugin.ts
 var SUPERSESSION_RULES = [
   {
@@ -2875,7 +3086,7 @@ function isSupersededByPlugin(lockId, activePinIds) {
 
 // src/scanner/detect-package-manager.ts
 import path14 from "node:path";
-import fs10 from "fs-extra";
+import fs11 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
   if (field.startsWith("yarn@")) {
@@ -2893,16 +3104,16 @@ function detectPackageManager(root, packageManagerField) {
     if (satisfiesVersion(version, ">=9")) return "npm";
     return "unknown";
   }
-  if (fs10.existsSync(path14.join(root, "yarn.lock"))) return "yarn";
-  if (fs10.existsSync(path14.join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs10.existsSync(path14.join(root, "package-lock.json"))) return "npm";
+  if (fs11.existsSync(path14.join(root, "yarn.lock"))) return "yarn";
+  if (fs11.existsSync(path14.join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs11.existsSync(path14.join(root, "package-lock.json"))) return "npm";
   return "unknown";
 }
 
 // src/update/hash-installed.ts
 import path16 from "node:path";
 import fg3 from "fast-glob";
-import fs12 from "fs-extra";
+import fs13 from "fs-extra";
 
 // src/claude/haus-managed-header.ts
 function parseHausManagedAttrs(line2) {
@@ -2942,7 +3153,7 @@ function parseHausManagedHeader(line2) {
 // src/claude/superpowers-install.ts
 import path15 from "node:path";
 import fg2 from "fast-glob";
-import fs11 from "fs-extra";
+import fs12 from "fs-extra";
 init_logger();
 var SKILL_DEP_ARTIFACTS = ["node_modules/**"];
 var SKILL_DEP_ARTIFACT_DIRS = /* @__PURE__ */ new Set(["node_modules"]);
@@ -2965,34 +3176,34 @@ async function previewInstalledSkill(srcFile, opts) {
   return next === text ? void 0 : Buffer.from(next, "utf8");
 }
 async function readRewritableText(file) {
-  const raw = await fs11.readFile(file);
+  const raw = await fs12.readFile(file);
   const text = raw.toString("utf8");
   return Buffer.from(text, "utf8").equals(raw) ? text : void 0;
 }
 async function composeInstalledDescription(destination, signal) {
   const skillFile = path15.join(destination, SKILL_ENTRY_FILE);
-  if (!await fs11.pathExists(skillFile)) return;
+  if (!await fs12.pathExists(skillFile)) return;
   const text = await readRewritableText(skillFile);
   if (text === void 0) return;
   const composed = rewriteSkillDescription(text, signal);
-  if (composed !== text) await fs11.writeFile(skillFile, composed, "utf8");
+  if (composed !== text) await fs12.writeFile(skillFile, composed, "utf8");
 }
 async function installCatalogSkill(sourcePath, destination, opts) {
   if (opts.dryRun) return;
-  await fs11.ensureDir(path15.dirname(destination));
-  if (await fs11.pathExists(destination)) {
+  await fs12.ensureDir(path15.dirname(destination));
+  if (await fs12.pathExists(destination)) {
     const extra = await extraDestFiles(sourcePath, destination);
     if (extra.length > 0) {
       warn(
         `${destination}: removing ${extra.length} untracked file(s) not present in the catalog source before reinstall: ${extra.join(", ")}`
       );
     }
-    for (const entry of await fs11.readdir(destination)) {
+    for (const entry of await fs12.readdir(destination)) {
       if (SKILL_DEP_ARTIFACT_DIRS.has(entry)) continue;
-      await fs11.remove(path15.join(destination, entry));
+      await fs12.remove(path15.join(destination, entry));
     }
   }
-  await fs11.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+  await fs12.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
   if (opts.description) await composeInstalledDescription(destination, opts.description);
 }
 
@@ -3016,11 +3227,11 @@ async function hashInstalledPaths(root, relPaths, opts = {}) {
   const fileDigests = [];
   for (const rel of normalized) {
     const abs = path16.join(root, rel);
-    if (!await fs12.pathExists(abs)) continue;
-    const stat = followSymlinks ? await fs12.stat(abs) : await fs12.lstat(abs);
+    if (!await fs13.pathExists(abs)) continue;
+    const stat = followSymlinks ? await fs13.stat(abs) : await fs13.lstat(abs);
     if (!followSymlinks && stat.isSymbolicLink()) continue;
     if (stat.isFile()) {
-      const body = await fs12.readFile(abs);
+      const body = await fs13.readFile(abs);
       fileDigests.push({ rel, digest: digestFileContent(body) });
       continue;
     }
@@ -3041,9 +3252,9 @@ async function hashInstalledPaths(root, relPaths, opts = {}) {
     });
     for (const sub of inner.sort()) {
       const absFile = path16.join(abs, sub);
-      if (!followSymlinks && (await fs12.lstat(absFile)).isSymbolicLink()) continue;
+      if (!followSymlinks && (await fs13.lstat(absFile)).isSymbolicLink()) continue;
       const relFile = path16.join(rel, sub).replace(/\\/g, "/");
-      const body = await fs12.readFile(absFile);
+      const body = await fs13.readFile(absFile);
       fileDigests.push({ rel: relFile, digest: digestFileContent(body) });
     }
   }
@@ -3082,15 +3293,15 @@ init_logger();
 init_paths();
 
 // src/claude/managed-write.ts
-import fs13 from "fs-extra";
+import fs14 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
 async function writeManagedText(root, filePath, nextText, dryRun, quiet = false) {
   const say = quiet ? () => {
   } : log;
-  const existed = await fs13.pathExists(filePath);
-  const prev = existed ? await fs13.readFile(filePath, "utf8") : "";
+  const existed = await fs14.pathExists(filePath);
+  const prev = existed ? await fs14.readFile(filePath, "utf8") : "";
   const printable = displayPath(root, filePath);
   if (dryRun) {
     if (!existed) {
@@ -3177,7 +3388,7 @@ function buildAllowRules() {
 // src/install/settings-merge.ts
 init_fs();
 import path18 from "node:path";
-import fs14 from "fs-extra";
+import fs15 from "fs-extra";
 
 // src/install/manifest.ts
 init_fs();
@@ -3487,7 +3698,7 @@ function stripHausAsk(settings) {
 async function loadHooksFragment(fragmentPath) {
   let raw;
   try {
-    raw = await fs14.readJson(fragmentPath);
+    raw = await fs15.readJson(fragmentPath);
   } catch {
     return [];
   }
@@ -3547,8 +3758,8 @@ function buildDenyRules() {
     if (RUNTIME_ONLY_DENY_COMMANDS.includes(command)) continue;
     rules.push(`Bash(${command}:*)`);
   }
-  for (const path92 of DENY_PATHS) {
-    const pattern = DENY_DIRS.has(path92) ? `${path92}/**` : path92;
+  for (const path93 of DENY_PATHS) {
+    const pattern = DENY_DIRS.has(path93) ? `${path93}/**` : path93;
     for (const tool of FILE_TOOLS) {
       rules.push(`${tool}(${pattern})`);
     }
@@ -3611,6 +3822,11 @@ var PROJECT_HOOK_FRAGMENTS = [
     command: "haus workspace worktree autohydrate --from-hook"
   }
 ];
+function projectHookFragmentsFor(profile) {
+  const dropped = new Set(PROFILES[profile].droppedHookCommands);
+  if (dropped.size === 0) return PROJECT_HOOK_FRAGMENTS;
+  return PROJECT_HOOK_FRAGMENTS.filter((fragment) => !dropped.has(fragment.command));
+}
 async function readProjectSettings(root) {
   const filePath = claudePath(root, "settings.json");
   const result = await readJsonDetailed(filePath);
@@ -3622,16 +3838,17 @@ async function readProjectSettings(root) {
 async function writeProjectSettings(root, settings) {
   await writeJson(claudePath(root, "settings.json"), settings);
 }
-async function mergeProjectSettings(root) {
+async function mergeProjectSettings(root, profile) {
+  const resolved = profile ?? await readProjectProfile(root);
   const base = await readProjectSettings(root);
-  const { settings: withHooks } = mergeHooks(base, PROJECT_HOOK_FRAGMENTS);
+  const { settings: withHooks } = mergeHooks(base, projectHookFragmentsFor(resolved));
   const { settings: withDeny } = mergeDenyRules(withHooks, buildDenyRules());
   const { settings: withAllow } = mergeAllowRules(withDeny, buildAllowRules());
   const { settings: merged } = mergeAskRules(withAllow, buildAskRules());
   return merged;
 }
-async function applyProjectSettingsMerge(root) {
-  const merged = await mergeProjectSettings(root);
+async function applyProjectSettingsMerge(root, profile) {
+  const merged = await mergeProjectSettings(root, profile);
   await writeProjectSettings(root, merged);
   return merged;
 }
@@ -3639,7 +3856,7 @@ async function applyProjectSettingsMerge(root) {
 // src/claude/remove-items.ts
 import crypto2 from "node:crypto";
 import path19 from "node:path";
-import fs15 from "fs-extra";
+import fs16 from "fs-extra";
 init_fs();
 init_paths();
 
@@ -3669,16 +3886,16 @@ function classifyBackupName(name) {
 async function unsafeTrackedPath(root, rel) {
   const abs = resolveContainedPath(root, rel);
   if (abs === null) return "escapes-root";
-  if (!await fs15.pathExists(abs)) {
+  if (!await fs16.pathExists(abs)) {
     try {
-      if ((await fs15.lstat(abs)).isSymbolicLink()) return "symlink";
+      if ((await fs16.lstat(abs)).isSymbolicLink()) return "symlink";
     } catch {
       return null;
     }
     return null;
   }
-  if ((await fs15.lstat(abs)).isSymbolicLink()) return "symlink";
-  const [realAbs, realRoot] = await Promise.all([fs15.realpath(abs), fs15.realpath(root)]);
+  if ((await fs16.lstat(abs)).isSymbolicLink()) return "symlink";
+  const [realAbs, realRoot] = await Promise.all([fs16.realpath(abs), fs16.realpath(root)]);
   const prefix = realRoot.endsWith(path19.sep) ? realRoot : realRoot + path19.sep;
   if (realAbs !== realRoot && !realAbs.startsWith(prefix)) return "symlink";
   return null;
@@ -3704,7 +3921,7 @@ async function resolveExistingTrackedPaths(root, itemId, relPaths, warnFn, unsaf
       continue;
     }
     const abs = path19.resolve(root, rel);
-    if (await fs15.pathExists(abs)) existing.push({ rel, abs });
+    if (await fs16.pathExists(abs)) existing.push({ rel, abs });
   }
   return existing;
 }
@@ -3722,11 +3939,11 @@ async function backupTrackedPaths(root, absPaths, say, prefix) {
   const stamp = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}-${crypto2.randomBytes(3).toString("hex")}`;
   const backupRoot = hausPath(root, "backups", dirBackupDirName(prefix, stamp));
   for (const abs of absPaths) {
-    if (!await fs15.pathExists(abs)) continue;
+    if (!await fs16.pathExists(abs)) continue;
     const rel = path19.relative(root, abs);
     const backupPath = path19.join(backupRoot, rel);
-    await fs15.ensureDir(path19.dirname(backupPath));
-    await fs15.copy(abs, backupPath);
+    await fs16.ensureDir(path19.dirname(backupPath));
+    await fs16.copy(abs, backupPath);
   }
   say(
     `Backed up ${absPaths.length} path(s) to ${path19.relative(root, backupRoot)} before deleting them.`
@@ -3735,7 +3952,7 @@ async function backupTrackedPaths(root, absPaths, say, prefix) {
 }
 async function deleteTrackedPaths(root, itemId, existing, { verb, reason }, say) {
   for (const { abs } of existing) {
-    await fs15.remove(abs);
+    await fs16.remove(abs);
     await pruneEmptyDir(path19.dirname(abs));
     say([verb, reason, displayPath(root, abs)].filter(Boolean).join(" ") + ` (${itemId})`);
   }
@@ -3744,7 +3961,7 @@ async function deleteTrackedPaths(root, itemId, existing, { verb, reason }, say)
 // src/claude/skill-dep-install.ts
 init_exec();
 import path20 from "node:path";
-import fs16 from "fs-extra";
+import fs17 from "fs-extra";
 function skillDepInstallCommand(manager) {
   switch (manager) {
     case "npm":
@@ -3781,7 +3998,7 @@ function skillDepInstallCommand(manager) {
 }
 async function hasDeclaredDependencies(dir) {
   try {
-    const raw = await fs16.readFile(path20.join(dir, "package.json"), "utf8");
+    const raw = await fs17.readFile(path20.join(dir, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null) return false;
     const deps = parsed.dependencies;
@@ -3793,7 +4010,7 @@ async function hasDeclaredDependencies(dir) {
 }
 async function realpathOrSelf(target) {
   try {
-    return await fs16.realpath(target);
+    return await fs17.realpath(target);
   } catch {
     return path20.resolve(target);
   }
@@ -3838,7 +4055,7 @@ async function installSkillDependencies(opts, deps = {}) {
     default:
       return assertNeverCommandProbe(probe);
   }
-  if (!await fs16.pathExists(contained.dir)) {
+  if (!await fs17.pathExists(contained.dir)) {
     return { status: "skipped", reason: `install directory disappeared (${contained.dir})` };
   }
   const run = deps.run ?? defaultRun;
@@ -3852,7 +4069,7 @@ async function installSkillDependencies(opts, deps = {}) {
 // src/claude/verify-hooks-contract.ts
 init_fs();
 init_paths();
-import fs17 from "fs-extra";
+import fs18 from "fs-extra";
 
 // src/claude/load-hooks.ts
 var CANONICAL_HOOKS = {
@@ -3897,8 +4114,14 @@ var CANONICAL_HOOKS = {
     ]
   }
 };
-async function loadClaudeHooksSettings() {
-  return { ...CANONICAL_HOOKS, permissions: { deny: buildDenyRules(), ask: buildAskRules() } };
+async function loadClaudeHooksSettings(profile = "production") {
+  const dropped = new Set(PROFILES[profile].droppedHookCommands);
+  const hooks = {};
+  for (const [event, blocks] of Object.entries(CANONICAL_HOOKS.hooks)) {
+    const kept = (blocks ?? []).filter((block) => !block.hooks.some((h) => dropped.has(h.command)));
+    if (kept.length > 0) hooks[event] = kept;
+  }
+  return { hooks, permissions: { deny: buildDenyRules(), ask: buildAskRules() } };
 }
 
 // src/claude/verify-hooks-contract.ts
@@ -3934,8 +4157,8 @@ function hausHookContractSatisfied(project, canonical) {
   if (!coversRules(project.permissions?.ask, canonical.permissions?.ask)) return false;
   return true;
 }
-async function assertPostApplySettingsHausContract(root) {
-  const canonical = await loadClaudeHooksSettings();
+async function assertPostApplySettingsHausContract(root, profile) {
+  const canonical = await loadClaudeHooksSettings(profile ?? await readProjectProfile(root));
   const written = await readJson(claudePath(root, "settings.json"));
   if (written == null || typeof written !== "object") {
     throw new Error(
@@ -3950,7 +4173,7 @@ async function assertPostApplySettingsHausContract(root) {
 }
 async function verifyProjectSettingsHooksContract(root) {
   const settingsPath = claudePath(root, "settings.json");
-  if (!await fs17.pathExists(settingsPath)) {
+  if (!await fs18.pathExists(settingsPath)) {
     return {
       ok: true,
       skipped: true,
@@ -3959,7 +4182,7 @@ async function verifyProjectSettingsHooksContract(root) {
   }
   let canonical;
   try {
-    canonical = await loadClaudeHooksSettings();
+    canonical = await loadClaudeHooksSettings(await readProjectProfile(root));
   } catch (err) {
     return { ok: false, message: `Cannot load canonical hooks: ${String(err)}` };
   }
@@ -3979,7 +4202,7 @@ async function verifyProjectSettingsHooksContract(root) {
 // src/claude/write-ci-gate-workflow.ts
 init_logger();
 import path21 from "node:path";
-import fs18 from "fs-extra";
+import fs19 from "fs-extra";
 import YAML from "yaml";
 var CI_GATE_WORKFLOW_REL = path21.join(".github", "workflows", "haus-gate.yml");
 var WORKFLOW = `# Written by \`haus init\`. Yours to edit \u2014 haus will not rewrite this file.
@@ -4020,16 +4243,20 @@ jobs:
       - name: haus ci-gate
         run: haus ci-gate
 `;
+var CI_GATE_MARKER_LINE = WORKFLOW.split("\n", 1)[0];
+function isHausWrittenCiGate(content2) {
+  return content2.startsWith(CI_GATE_MARKER_LINE);
+}
 async function writeCiGateWorkflow(root, dryRun, quiet = false) {
   const dest = path21.join(root, CI_GATE_WORKFLOW_REL);
-  if (await fs18.pathExists(dest)) return void 0;
+  if (await fs19.pathExists(dest)) return void 0;
   if (await projectRunsCiGate(root)) return void 0;
   if (dryRun) {
     if (!quiet) log(`Would write ${CI_GATE_WORKFLOW_REL} (CI gate: haus ci-gate on every PR)`);
     return dest;
   }
-  await fs18.ensureDir(path21.dirname(dest));
-  await fs18.writeFile(dest, WORKFLOW, "utf8");
+  await fs19.ensureDir(path21.dirname(dest));
+  await fs19.writeFile(dest, WORKFLOW, "utf8");
   if (!quiet) log(`Wrote ${CI_GATE_WORKFLOW_REL} \u2014 runs \`haus ci-gate\` on every pull request`);
   return dest;
 }
@@ -4051,14 +4278,14 @@ async function projectRunsCiGate(root) {
   const dir = path21.join(root, ".github", "workflows");
   let entries;
   try {
-    entries = await fs18.readdir(dir);
+    entries = await fs19.readdir(dir);
   } catch {
     return false;
   }
   for (const entry of entries) {
     if (!/\.ya?ml$/i.test(entry)) continue;
     try {
-      const text = await fs18.readFile(path21.join(dir, entry), "utf8");
+      const text = await fs19.readFile(path21.join(dir, entry), "utf8");
       if (runScripts(YAML.parse(text)).some((script) => CI_GATE_COMMAND.test(script))) return true;
     } catch {
     }
@@ -4068,7 +4295,7 @@ async function projectRunsCiGate(root) {
 
 // src/claude/write-decisions-seed.ts
 import path22 from "node:path";
-import fs19 from "fs-extra";
+import fs20 from "fs-extra";
 
 // library/catalog/decisions-triggers.json
 var decisions_triggers_default = {
@@ -4113,15 +4340,15 @@ Why we chose X \u2014 short, dated, write-once decision log for humans and agent
 async function writeDecisionsSeed(root, dryRun, quiet = false) {
   const decisionsDir = path22.join(root, DECISIONS_TRIGGERS.decisionsDir);
   const readmePath = path22.join(decisionsDir, "README.md");
-  if (await fs19.pathExists(readmePath)) return null;
-  if (!dryRun) await fs19.ensureDir(decisionsDir);
+  if (await fs20.pathExists(readmePath)) return null;
+  if (!dryRun) await fs20.ensureDir(decisionsDir);
   await writeManagedText(root, readmePath, SEED_README, dryRun, quiet);
   return readmePath;
 }
 
 // src/claude/write-prettierignore.ts
 import path23 from "node:path";
-import fs20 from "fs-extra";
+import fs21 from "fs-extra";
 var PRETTIERIGNORE_BEGIN = "# HAUS:BEGIN haus-managed v=1";
 var PRETTIERIGNORE_END = "# HAUS:END haus-managed";
 var IGNORED_PATHS = [".haus-workflow/", ".claude/"];
@@ -4190,7 +4417,7 @@ ${block}
 }
 async function writePrettierIgnore(root, dryRun, quiet = false) {
   const filePath = path23.join(root, ".prettierignore");
-  const prev = await fs20.pathExists(filePath) ? await fs20.readFile(filePath, "utf8") : "";
+  const prev = await fs21.pathExists(filePath) ? await fs21.readFile(filePath, "utf8") : "";
   const next = injectPrettierIgnoreBlock(prev, buildPrettierIgnoreBlock());
   await writeManagedText(root, filePath, next, dryRun, quiet);
   return filePath;
@@ -4198,19 +4425,21 @@ async function writePrettierIgnore(root, dryRun, quiet = false) {
 
 // src/claude/write-root-claude-md.ts
 import path24 from "node:path";
-import fs21 from "fs-extra";
+import fs22 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
 var WORKSPACE_BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-workspace-imports v=1 -->";
 var WORKSPACE_BLOCK_END = "<!-- HAUS:END haus-workspace-imports -->";
 var DEFAULT_SENTINELS = { begin: BLOCK_BEGIN, end: BLOCK_END };
-var IMPORT_CONTENT = `@.haus-workflow/WORKFLOW.md
-@.haus-workflow/workflow-config.md
-@docs/decisions/README.md`;
-function buildImportBlock() {
+function importContentFor(profile) {
+  const lines = ["@.haus-workflow/WORKFLOW.md", "@.haus-workflow/workflow-config.md"];
+  if (PROFILES[profile].writesDecisionsSeed) lines.push("@docs/decisions/README.md");
+  return lines.join("\n");
+}
+function buildImportBlock(profile) {
   return `${BLOCK_BEGIN}
 
-${IMPORT_CONTENT}
+${importContentFor(profile)}
 ${BLOCK_END}`;
 }
 function findLineMarker2(content2, marker, from = 0) {
@@ -4275,10 +4504,10 @@ ${block}
 ${block}
 `;
 }
-async function writeRootClaudeMd(root, dryRun, quiet = false) {
+async function writeRootClaudeMd(root, dryRun, profile, quiet = false) {
   const filePath = path24.join(root, "CLAUDE.md");
-  const block = buildImportBlock();
-  const prev = await fs21.pathExists(filePath) ? await fs21.readFile(filePath, "utf8") : "";
+  const block = buildImportBlock(profile);
+  const prev = await fs22.pathExists(filePath) ? await fs22.readFile(filePath, "utf8") : "";
   const next = injectHausBlock(prev, block);
   await writeManagedText(root, filePath, next, dryRun, quiet);
   return filePath;
@@ -4289,12 +4518,12 @@ init_fs();
 init_logger();
 init_paths();
 import path26 from "node:path";
-import fs23 from "fs-extra";
+import fs24 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
 init_fs();
 import path25 from "node:path";
-import fs22 from "fs-extra";
+import fs23 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
   if (pm === "yarn") return `yarn ${bin}${tail}`;
@@ -4313,22 +4542,25 @@ async function deriveWorkflowConfig(root, ctx) {
     return null;
   };
   const hasDep = (name) => deps.has(name);
-  const exists2 = (rel) => fs22.pathExistsSync(path25.join(root, rel));
+  const exists2 = (rel) => fs23.pathExistsSync(path25.join(root, rel));
   const hasPlaywright = hasDep("@playwright/test") || stacks.includes("playwright");
   const hasCypress = hasDep("cypress");
   const preCommitTool = exists2("lefthook.yml") || exists2("lefthook.yaml") ? "lefthook" : exists2(".husky") || hasDep("husky") || (scripts.prepare ?? "").includes("husky") ? "husky" : exists2(".pre-commit-config.yaml") ? "pre-commit (Python framework)" : null;
   return {
     test: script("test") ?? `${pm} test`,
     testE2E: firstScript("test:e2e", "e2e", "test:integration") ?? (hasPlaywright ? binCmd(pm, "playwright", "test") : null) ?? (hasCypress ? binCmd(pm, "cypress", "run") : null),
+    manus: script("manus") ?? binCmd(pm, "playwright", "test demo/manus.spec.ts"),
+    dev: script("dev"),
     preCommitTool,
     specPath: exists2("docs/SPEC.md") ? "docs/SPEC.md" : null,
     designPath: exists2("docs/DESIGN.md") ? "docs/DESIGN.md" : null,
-    uxPath: exists2("docs/UX.md") ? "docs/UX.md" : null
+    uxPath: exists2("docs/UX.md") ? "docs/UX.md" : null,
+    packageManager: pm
   };
 }
 
 // src/claude/write-workflow-config.ts
-function fields(v) {
+function productionFields(v) {
   return [
     { prefix: "- Spec: ", value: v.specPath, hint: "path, e.g. docs/SPEC.md" },
     { prefix: "- Design: ", value: v.designPath, hint: "path, e.g. docs/DESIGN.md" },
@@ -4343,6 +4575,20 @@ function fields(v) {
     { prefix: "- Tool: ", value: v.preCommitTool, hint: "e.g. lefthook, husky" }
   ];
 }
+function pocFields(v) {
+  return [
+    { prefix: "- Run the manus: ", value: v.manus, hint: "command", code: true },
+    {
+      prefix: "- Dev server: ",
+      value: v.dev,
+      hint: `command, e.g. ${v.packageManager} run dev`,
+      code: true
+    }
+  ];
+}
+function fieldsFor(profile, v) {
+  return PROFILES[profile].workflowConfig === "poc" ? pocFields(v) : productionFields(v);
+}
 function renderValue(f) {
   if (f.value === null) return `<!-- fill in ${f.hint} -->`;
   return f.code ? `\`${f.value}\`` : f.value;
@@ -4351,12 +4597,17 @@ function line(f) {
   return `${f.prefix}${renderValue(f)}`;
 }
 function buildWorkflowConfig(v) {
-  const f = fields(v);
+  const f = productionFields(v);
   const byPrefix = (p) => line(f.find((x) => x.prefix === p));
   return "# How this project works (workflow methodology bindings)\n\n> The few project-specific values the workflow standard (WORKFLOW.md) binds to:\n> where the source-of-truth docs live, the test commands the TDD/verification gate\n> runs, the highest-stakes logic, and the pre-commit tool. This file is yours to\n> edit and haus will not overwrite it.\n>\n> Everyday commands (dev, build, lint, typecheck, format) and project documentation\n> live in `CLAUDE.md` + `docs/` \u2014 run **`/docs`** to generate/refresh them.\n\n## Source-of-truth documents\n" + byPrefix("- Spec: ") + "\n" + byPrefix("- Design: ") + "\n" + byPrefix("- UX flows: ") + "\n\n## Test commands (TDD / verification gate)\n" + byPrefix("- Test (unit + integration): ") + "\n" + byPrefix("- Test (E2E): ") + "\n\n## Highest-stakes logic\n<!-- fill in domain areas requiring TDD-only treatment, e.g. payment flows, auth, medical data -->\n\n## Pre-commit tool\n" + byPrefix("- Tool: ") + "\n";
 }
-function refillContent(existing, v) {
-  const f = fields(v);
+function buildPocWorkflowConfig(v) {
+  const f = pocFields(v);
+  const byPrefix = (p) => line(f.find((x) => x.prefix === p));
+  return "# How this PoC works (workflow methodology bindings)\n\n> The few project-specific values the PoC standard (WORKFLOW.md) binds to: where the\n> manus lives and the two commands the verification gate runs. This file is yours to\n> edit and haus will not overwrite it. A PoC has no test suite, no CI gate and no\n> pre-commit hooks by design (haus-workflow ADR-0125).\n\n## Source-of-truth documents\n- Manus: docs/MANUS.md\n- Plans: docs/plans/<round>.md\n\n## Demo commands (the verification gate)\n" + byPrefix("- Run the manus: ") + "\n" + byPrefix("- Dev server: ") + "\n\n## Highest-stakes logic\nn/a. A PoC has none by definition; the manus is the only gate.\n\n## Pre-commit tool\nn/a. No hooks in a PoC.\n";
+}
+function refillContent(existing, v, profile) {
+  const f = fieldsFor(profile, v);
   return existing.split("\n").map((ln) => {
     const field = f.find((x) => ln.startsWith(x.prefix));
     if (!field || field.value === null) return ln;
@@ -4380,9 +4631,10 @@ var FALLBACK_CONTEXT = {
 async function writeWorkflowConfig(root, dryRun, opts = {}) {
   const say = opts.quiet ? () => {
   } : log;
+  const profile = opts.profile ?? "production";
   const destPath = hausPath(root, "workflow-config.md");
   const printable = displayPath(root, destPath);
-  const exists2 = await fs23.pathExists(destPath);
+  const exists2 = await fs24.pathExists(destPath);
   if (exists2 && !opts.refill) {
     if (dryRun) say(printable + ": exists (project-owned, skipping)");
     return null;
@@ -4394,8 +4646,8 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
   };
   const values = await deriveWorkflowConfig(root, ctx);
   if (exists2) {
-    const current = await fs23.readFile(destPath, "utf8");
-    const refilled = refillContent(current, values);
+    const current = await fs24.readFile(destPath, "utf8");
+    const refilled = refillContent(current, values, profile);
     if (refilled === current) {
       if (dryRun) say(printable + ": no blank fields to refill");
       return null;
@@ -4411,13 +4663,16 @@ async function writeWorkflowConfig(root, dryRun, opts = {}) {
     say(printable + ": would create");
     return destPath;
   }
-  await writeText(destPath, buildWorkflowConfig(values));
+  await writeText(
+    destPath,
+    PROFILES[profile].workflowConfig === "poc" ? buildPocWorkflowConfig(values) : buildWorkflowConfig(values)
+  );
   return destPath;
 }
 
 // src/claude/write-workflow.ts
 init_offline();
-import fs24 from "fs-extra";
+import fs25 from "fs-extra";
 init_fs();
 init_logger();
 init_paths();
@@ -4443,10 +4698,10 @@ function makeWorkflowHeader(pkgVersion, contentHash) {
   const hashAttr = contentHash === void 0 ? "" : ` hash=${contentHash}`;
   return `<!-- HAUS-MANAGED id=${STABLE_ID} v=${SCHEMA_VERSION} source=@haus-tech/haus-workflow@${pkgVersion}${hashAttr} -->`;
 }
-async function writeWorkflow(root, pkgVersion, dryRun, force = false, quiet = false) {
+async function writeWorkflow(root, pkgVersion, dryRun, force = false, quiet = false, templateRel = WORKFLOW_TEMPLATE_REL) {
   const say = quiet ? () => {
   } : log;
-  const templateContent = await readWorkflowTemplate({ dryRun, projectRoot: root });
+  const templateContent = await readWorkflowTemplate({ dryRun, projectRoot: root, templateRel });
   if (templateContent === null) {
     warn(
       isOffline() ? `Workflow template is not in the local catalog cache and this run is offline \u2014 run \`haus catalog bundle import <file>\` (or drop \`--offline\`), then re-run \`haus apply --write\`` : `Workflow template could not be fetched from the catalog \u2014 check your network, then re-run \`haus apply --write\` (or \`haus update\`)`
@@ -4459,8 +4714,8 @@ async function writeWorkflow(root, pkgVersion, dryRun, force = false, quiet = fa
 ${templateContent}`;
   const destPath = hausPath(root, "WORKFLOW.md");
   const printable = displayPath(root, destPath);
-  if (await fs24.pathExists(destPath)) {
-    const existing = await fs24.readFile(destPath, "utf8");
+  if (await fs25.pathExists(destPath)) {
+    const existing = await fs25.readFile(destPath, "utf8");
     const firstLine = existing.split("\n")[0] ?? "";
     const parsed = parseHausManagedHeader(firstLine);
     if (!parsed) {
@@ -4504,7 +4759,7 @@ ${existingContent}`;
     }
   }
   if (dryRun) {
-    const prev = await fs24.pathExists(destPath) ? await fs24.readFile(destPath, "utf8") : "";
+    const prev = await fs25.pathExists(destPath) ? await fs25.readFile(destPath, "utf8") : "";
     if (!prev) {
       say(createUnifiedDiff(printable, "", next));
     } else {
@@ -4559,14 +4814,14 @@ function decodeIfText(buf) {
   return Buffer.from(asText, "utf8").equals(buf) ? asText : null;
 }
 async function listFilesRecursive2(dir) {
-  if (!await fs25.pathExists(dir)) return [];
+  if (!await fs26.pathExists(dir)) return [];
   const files = [];
   const walk = async (current, relPrefix) => {
-    const names = await fs25.readdir(current);
+    const names = await fs26.readdir(current);
     for (const name of names) {
       const abs = path27.join(current, name);
       const rel = relPrefix ? `${relPrefix}/${name}` : name;
-      const stat = await fs25.lstat(abs);
+      const stat = await fs26.lstat(abs);
       if (stat.isSymbolicLink()) {
         warn(`Skipping symlink in dry-run diff preview: ${rel}`);
         continue;
@@ -4583,14 +4838,14 @@ async function listFilesRecursive2(dir) {
 }
 async function logFileDryRunDiff(root, srcFile, destFile, itemId, say, transformed) {
   const printable = displayPath(root, destFile);
-  const nextBuf = transformed ?? await fs25.readFile(srcFile);
-  if (!await fs25.pathExists(destFile)) {
+  const nextBuf = transformed ?? await fs26.readFile(srcFile);
+  if (!await fs26.pathExists(destFile)) {
     say(`${printable}: would create (${itemId})`);
     const nextText2 = decodeIfText(nextBuf);
     if (nextText2 !== null) say(createUnifiedDiff(printable, "", nextText2));
     return;
   }
-  const prevBuf = await fs25.readFile(destFile);
+  const prevBuf = await fs26.readFile(destFile);
   if (prevBuf.equals(nextBuf)) {
     say(`${printable}: unchanged (${itemId})`);
     return;
@@ -4619,15 +4874,15 @@ async function logSkillDryRunDiff(root, sourcePath, destination, itemId, say, in
 }
 async function removeLegacyManagedStub(root, relPathSegments, stub, dryRun, say) {
   const target = claudePath(root, ...relPathSegments);
-  if (!await fs25.pathExists(target)) return;
-  const content2 = await fs25.readFile(target, "utf8");
+  if (!await fs26.pathExists(target)) return;
+  const content2 = await fs26.readFile(target, "utf8");
   if (content2 !== stub && content2 !== `${stub}
 ` && content2 !== `${stub}\r
 `) return;
   if (dryRun) {
     say(`[dry-run] would remove stale ${displayPath(root, target)}`);
   } else {
-    await fs25.remove(target);
+    await fs26.remove(target);
   }
 }
 async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
@@ -4646,17 +4901,30 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   };
   const pkgRoot = packageRoot();
   const hausVersion2 = (await readJson(path27.join(pkgRoot, "package.json")))?.version ?? "0.0.0";
-  const { items: manifestItems, contentRoot } = await loadCatalogContext(root);
+  const { items: manifestItems, contentRoot, ...catalogMeta } = await loadCatalogContext(root);
+  const profile = opts.profile ?? await readProjectProfile(root);
+  const profileSpec = PROFILES[profile];
+  if (parseProfileRules(catalogMeta.profiles, profile) === null) {
+    throw new ProfileUnsupportedError(profile, describeCatalogTier(catalogMeta));
+  }
   const coreFiles = [claudePath(root, "settings.json"), claudePath(root, "rules", "haus.md")];
-  const rootClaudeMdPath = await writeRootClaudeMd(root, dryRun, opts.quiet);
-  const decisionsSeedPath = await writeDecisionsSeed(root, dryRun, opts.quiet);
-  const workflowPath = await writeWorkflow(root, hausVersion2, dryRun, opts.force, opts.quiet);
+  const rootClaudeMdPath = await writeRootClaudeMd(root, dryRun, profile, opts.quiet);
+  const decisionsSeedPath = profileSpec.writesDecisionsSeed ? await writeDecisionsSeed(root, dryRun, opts.quiet) : null;
+  const workflowPath = await writeWorkflow(
+    root,
+    hausVersion2,
+    dryRun,
+    opts.force,
+    opts.quiet,
+    profileSpec.workflowTemplateRel
+  );
   const workflowConfigPath = await writeWorkflowConfig(root, dryRun, {
     refill: opts.refillConfig,
-    quiet: opts.quiet
+    quiet: opts.quiet,
+    profile
   });
   const prettierIgnorePath = await writePrettierIgnore(root, dryRun, opts.quiet);
-  const ciGatePath = await writeCiGateWorkflow(root, dryRun, opts.quiet);
+  const ciGatePath = profileSpec.writesCiGate ? await writeCiGateWorkflow(root, dryRun, opts.quiet) : null;
   const p6Files = [
     rootClaudeMdPath,
     ...decisionsSeedPath ? [decisionsSeedPath] : [],
@@ -4667,7 +4935,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   ];
   const files = dryRun ? [...coreFiles, ...p6Files] : [...coreFiles, ...p6Files, hausPath(root, "haus.lock.json")];
   if (dryRun) {
-    const mergedSettings = await mergeProjectSettings(root);
+    const mergedSettings = await mergeProjectSettings(root, profile);
     await writeManagedJson(
       root,
       claudePath(root, "settings.json"),
@@ -4676,8 +4944,8 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       opts.quiet
     );
   } else {
-    await applyProjectSettingsMerge(root);
-    await assertPostApplySettingsHausContract(root);
+    await applyProjectSettingsMerge(root, profile);
+    await assertPostApplySettingsHausContract(root, profile);
   }
   await removeLegacyManagedStub(
     root,
@@ -4735,11 +5003,11 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   ];
   for (const rel of LEGACY_PRUNED_ARTIFACTS) {
     const legacyPath = hausPath(root, rel);
-    if (await fs25.pathExists(legacyPath)) {
+    if (await fs26.pathExists(legacyPath)) {
       if (dryRun) {
         say(`[dry-run] would remove stale ${displayPath(root, legacyPath)}`);
       } else {
-        await fs25.remove(legacyPath);
+        await fs26.remove(legacyPath);
       }
     }
   }
@@ -4857,7 +5125,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
     }
     const sourcePath = catalogItemContentPath(contentRoot, manifestItem);
     const destination = placement.destination;
-    if (await fs25.pathExists(sourcePath)) {
+    if (await fs26.pathExists(sourcePath)) {
       if (dryRun) {
         if (item.type === "skill") {
           await logSkillDryRunDiff(root, sourcePath, destination, item.id, say, {
@@ -4888,13 +5156,13 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
       )) {
         continue;
       } else if (item.type === "skill") {
-        const skillFiles = (await fs25.readdir(sourcePath, { recursive: true })).filter(
+        const skillFiles = (await fs26.readdir(sourcePath, { recursive: true })).filter(
           (f) => typeof f === "string" && f.endsWith(".md")
         );
         let skillValid = true;
         for (const relFile of skillFiles) {
           const mdPath = path27.join(sourcePath, relFile);
-          const mdContent = await fs25.readFile(mdPath, "utf8");
+          const mdContent = await fs26.readFile(mdPath, "utf8");
           const mdValidation = validateCatalogItem(
             {
               id: manifestItem.id,
@@ -4928,7 +5196,7 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
           say
         );
       } else {
-        const fileContent = await fs25.readFile(sourcePath, "utf8");
+        const fileContent = await fs26.readFile(sourcePath, "utf8");
         const validation = validateCatalogItem(
           {
             id: manifestItem.id,
@@ -4942,8 +5210,8 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
           warn(`Skipping ${item.id}: pre-copy validation failed \u2014 ${validation.reason}`);
           continue;
         }
-        await fs25.ensureDir(path27.dirname(destination));
-        await fs25.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
+        await fs26.ensureDir(path27.dirname(destination));
+        await fs26.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
       files.push(destination);
       const relPaths = [path27.relative(root, destination)];
@@ -5069,7 +5337,7 @@ async function hasProtectedUnsafePath(root, relPaths, unsafeByRel) {
   for (const rel of relPaths) {
     const unsafe = unsafeByRel.get(rel) ?? null;
     if (unsafe === "symlink") return true;
-    if (unsafe === "escapes-root" && await fs25.pathExists(path27.resolve(root, rel))) return true;
+    if (unsafe === "escapes-root" && await fs26.pathExists(path27.resolve(root, rel))) return true;
   }
   return false;
 }
@@ -5134,7 +5402,7 @@ async function cleanupMigratedCatalogItems(root, prevLock, migrations, dryRun, q
   void await backupTrackedPaths(root, allAbsPaths, say, "migrate");
   for (const { existing } of toRemove) {
     for (const { abs } of existing) {
-      await fs25.remove(abs);
+      await fs26.remove(abs);
       await pruneEmptyDir(path27.dirname(abs));
     }
   }
@@ -5215,7 +5483,7 @@ async function cleanupStaleCatalogItems(root, manifestById, dryRun, quiet, activ
         say(`[dry-run] would remove ${pruneReason} ${displayPath(root, abs)} (${entry.id})`);
         continue;
       }
-      await fs25.remove(abs);
+      await fs26.remove(abs);
       await pruneEmptyDir(path27.dirname(abs));
       say(`Removed ${pruneReason} ${displayPath(root, abs)} (${entry.id})`);
     }
@@ -5271,7 +5539,7 @@ async function pruneOrphanedCatalogItems(root, prevLock, notOrphanedIds, dryRun,
 // src/claude/write-gitignore.ts
 init_exec();
 import path28 from "node:path";
-import fs26 from "fs-extra";
+import fs27 from "fs-extra";
 var GITIGNORE_BEGIN = "# HAUS:BEGIN haus-managed v=1";
 var GITIGNORE_END = "# HAUS:END haus-managed";
 var GITIGNORED_ARTIFACT_PATHS = [
@@ -5400,14 +5668,14 @@ function injectLinkContextGitignoreBlock(existing) {
 }
 async function writeGitignore(root, dryRun, quiet = false) {
   const filePath = path28.join(root, ".gitignore");
-  const prev = await fs26.pathExists(filePath) ? await fs26.readFile(filePath, "utf8") : "";
+  const prev = await fs27.pathExists(filePath) ? await fs27.readFile(filePath, "utf8") : "";
   const next = injectGitignoreBlock(prev);
   await writeManagedText(root, filePath, next, dryRun, quiet);
   return filePath;
 }
 async function writeLinkContextGitignore(root, dryRun, quiet = false) {
   const filePath = path28.join(root, ".gitignore");
-  const prev = await fs26.pathExists(filePath) ? await fs26.readFile(filePath, "utf8") : "";
+  const prev = await fs27.pathExists(filePath) ? await fs27.readFile(filePath, "utf8") : "";
   const next = injectLinkContextGitignoreBlock(prev);
   await writeManagedText(root, filePath, next, dryRun, quiet);
   return filePath;
@@ -5976,25 +6244,25 @@ async function cleanupStaleGlobalPlugins(desired, deps = {}) {
 
 // src/refs/fetch-refs.ts
 import path31 from "node:path";
-import fs28 from "fs-extra";
+import fs29 from "fs-extra";
 
 // src/refs/cache-meta.ts
 import path30 from "node:path";
-import fs27 from "fs-extra";
+import fs28 from "fs-extra";
 var META_FILENAME = "cache-meta.json";
 async function readCacheMeta(cacheDir) {
   const metaPath = path30.join(cacheDir, META_FILENAME);
   try {
-    const raw = await fs27.readFile(metaPath, "utf8");
+    const raw = await fs28.readFile(metaPath, "utf8");
     return JSON.parse(raw);
   } catch {
     return {};
   }
 }
 async function writeCacheMeta(cacheDir, meta) {
-  await fs27.ensureDir(cacheDir);
+  await fs28.ensureDir(cacheDir);
   const metaPath = path30.join(cacheDir, META_FILENAME);
-  await fs27.writeFile(metaPath, JSON.stringify(meta, null, 2) + "\n", "utf8");
+  await fs28.writeFile(metaPath, JSON.stringify(meta, null, 2) + "\n", "utf8");
 }
 
 // src/refs/fetch-refs.ts
@@ -6015,7 +6283,7 @@ async function fetchSingleRef(url, cacheDir, meta) {
   const existing = meta[url];
   const headers = {};
   const safeFile = existing?.file && existing.file === path31.basename(existing.file);
-  const cachedFileExists = safeFile && await fs28.pathExists(path31.join(cacheDir, existing.file));
+  const cachedFileExists = safeFile && await fs29.pathExists(path31.join(cacheDir, existing.file));
   if (cachedFileExists) {
     if (existing?.etag) headers["If-None-Match"] = existing.etag;
     if (existing?.lastModified) headers["If-Modified-Since"] = existing.lastModified;
@@ -6026,8 +6294,8 @@ async function fetchSingleRef(url, cacheDir, meta) {
     if (!res.ok) return { result: "failed" };
     const text = await res.text();
     const file = `${urlToSlug(url)}.md`;
-    await fs28.ensureDir(cacheDir);
-    await fs28.writeFile(path31.join(cacheDir, file), text, "utf8");
+    await fs29.ensureDir(cacheDir);
+    await fs29.writeFile(path31.join(cacheDir, file), text, "utf8");
     meta[url] = {
       url,
       etag: res.headers.get("etag") ?? void 0,
@@ -6051,7 +6319,7 @@ async function pruneOrphanedRefs(cacheDir, keepUrls) {
     delete meta[url];
     removed++;
     const safeFile = typeof entry.file === "string" && entry.file === path31.basename(entry.file);
-    if (safeFile) await fs28.remove(path31.join(cacheDir, entry.file)).catch(() => {
+    if (safeFile) await fs29.remove(path31.join(cacheDir, entry.file)).catch(() => {
     });
   }
   if (removed > 0) await writeCacheMeta(cacheDir, meta);
@@ -6199,6 +6467,12 @@ async function runApply(options) {
     process.exitCode = 1;
     return;
   }
+  const profileRefused = await profileRefusal(root);
+  if (profileRefused) {
+    error(`${profileRefused} Nothing was written.`);
+    process.exitCode = 1;
+    return;
+  }
   const rec = await readJson(hausPath(root, "recommendation.json"));
   const installableRecommended = installableRecommendedItems(rec?.recommended ?? []);
   const wantedIds = selectedIds ?? installableRecommended.map((item) => item.id);
@@ -6326,7 +6600,7 @@ async function runApply(options) {
 
 // src/commands/backups.ts
 import path32 from "node:path";
-import fs29 from "fs-extra";
+import fs30 from "fs-extra";
 init_logger();
 init_paths();
 
@@ -6393,14 +6667,14 @@ Enter a number (1-${choices.length})`, io);
 // src/commands/backups.ts
 async function listBackups(root) {
   const dir = hausPath(root, "backups");
-  if (!await fs29.pathExists(dir)) return [];
-  const names = await fs29.readdir(dir);
+  if (!await fs30.pathExists(dir)) return [];
+  const names = await fs30.readdir(dir);
   const entries = [];
   for (const name of names) {
     const kind = classifyBackupName(name);
     if (!kind) continue;
     const absPath = path32.join(dir, name);
-    const stat = await fs29.lstat(absPath);
+    const stat = await fs30.lstat(absPath);
     if (stat.isSymbolicLink()) continue;
     const expectDirectory = kind !== "lock";
     if (stat.isDirectory() !== expectDirectory) continue;
@@ -6445,7 +6719,7 @@ async function isUnsafeWriteTarget(root, target) {
     current = path32.join(current, segments[i]);
     const isLastSegment = i === segments.length - 1;
     try {
-      const stat = await fs29.lstat(current);
+      const stat = await fs30.lstat(current);
       if (isLastSegment) {
         if (!stat.isFile()) return true;
       } else if (!stat.isDirectory()) {
@@ -6460,7 +6734,7 @@ async function isUnsafeWriteTarget(root, target) {
 }
 async function lstatIfRegularFile(abs) {
   try {
-    const stat = await fs29.lstat(abs);
+    const stat = await fs30.lstat(abs);
     return stat.isFile() ? stat : null;
   } catch (err) {
     if (err.code === "ENOENT") return null;
@@ -6475,8 +6749,8 @@ async function restoreLockBackup(root, entry, yes, json, dryRun) {
     );
     return { ok: false, restored: 0 };
   }
-  if (await fs29.pathExists(target)) {
-    const targetStat = await fs29.stat(target);
+  if (await fs30.pathExists(target)) {
+    const targetStat = await fs30.stat(target);
     if (targetStat.mtimeMs > entry.mtimeMs) {
       warn(
         `Current haus.lock.json (${new Date(targetStat.mtimeMs).toISOString()}) is newer than backup ${entry.id} (${new Date(entry.mtimeMs).toISOString()}) \u2014 it will be overwritten.`
@@ -6510,7 +6784,7 @@ async function restoreLockBackup(root, entry, yes, json, dryRun) {
     error(`Refusing to restore: ${entry.id} or ${target} changed since being checked.`);
     return { ok: false, restored: 0 };
   }
-  await fs29.copy(entry.absPath, target, { overwrite: true });
+  await fs30.copy(entry.absPath, target, { overwrite: true });
   if (!json) log(`Restored .haus-workflow/haus.lock.json from ${entry.id}.`);
   return { ok: true, restored: 1 };
 }
@@ -6518,10 +6792,10 @@ async function collectFilesRecursive(dir) {
   const files = [];
   const skippedLinks = [];
   const skippedOther = [];
-  const names = await fs29.readdir(dir);
+  const names = await fs30.readdir(dir);
   for (const name of names) {
     const abs = path32.join(dir, name);
-    const stat = await fs29.lstat(abs);
+    const stat = await fs30.lstat(abs);
     if (stat.isSymbolicLink()) {
       skippedLinks.push(abs);
       continue;
@@ -6584,8 +6858,8 @@ async function restoreDirBackup(root, entry, yes, json, dryRun) {
     }
     toRestore.push(abs);
     const target = path32.join(root, rel);
-    if (await fs29.pathExists(target)) {
-      const targetStat = await fs29.stat(target);
+    if (await fs30.pathExists(target)) {
+      const targetStat = await fs30.stat(target);
       if (targetStat.mtimeMs > backupFileStat.mtimeMs) {
         stale.push({
           rel,
@@ -6645,8 +6919,8 @@ async function restoreDirBackup(root, entry, yes, json, dryRun) {
       skippedAtWrite.push(rel);
       continue;
     }
-    await fs29.ensureDir(path32.dirname(target));
-    await fs29.copy(abs, target, { overwrite: true });
+    await fs30.ensureDir(path32.dirname(target));
+    await fs30.copy(abs, target, { overwrite: true });
     restoredCount++;
   }
   if (skippedAtWrite.length > 0) {
@@ -6727,7 +7001,7 @@ Keeping ${keepCount}.`
   const failed = [];
   for (const entry of removeList) {
     try {
-      await fs29.remove(entry.absPath);
+      await fs30.remove(entry.absPath);
       removed.push(entry.id);
     } catch (err) {
       failed.push({ id: entry.id, message: err instanceof Error ? err.message : String(err) });
@@ -6841,7 +7115,7 @@ init_manifest_format();
 init_path_safety();
 import os2 from "node:os";
 import path33 from "node:path";
-import fs30 from "fs-extra";
+import fs31 from "fs-extra";
 import * as tar from "tar";
 init_fs();
 init_logger();
@@ -6879,21 +7153,21 @@ async function runBundleExport(options) {
 }
 async function writeBundleAsTar(cacheDir, meta, dest) {
   const bundleMetaPath = path33.join(cacheDir, BUNDLE_META_FILE);
-  const previousBundleMeta = await fs30.pathExists(bundleMetaPath) ? await fs30.readFile(bundleMetaPath, "utf8") : null;
+  const previousBundleMeta = await fs31.pathExists(bundleMetaPath) ? await fs31.readFile(bundleMetaPath, "utf8") : null;
   await writeJson(bundleMetaPath, meta);
   try {
-    await fs30.ensureDir(path33.dirname(dest));
+    await fs31.ensureDir(path33.dirname(dest));
     await tar.create({ gzip: true, cwd: cacheDir, file: dest }, ["."]);
   } finally {
-    if (previousBundleMeta === null) await fs30.remove(bundleMetaPath);
-    else await fs30.writeFile(bundleMetaPath, previousBundleMeta, "utf8");
+    if (previousBundleMeta === null) await fs31.remove(bundleMetaPath);
+    else await fs31.writeFile(bundleMetaPath, previousBundleMeta, "utf8");
   }
 }
 function isMarkdownFile(relOrAbsPath) {
   return relOrAbsPath.toLowerCase().endsWith(".md");
 }
 async function listAllFilesUnfiltered(root, current = root) {
-  const entries = await fs30.readdir(current, { withFileTypes: true });
+  const entries = await fs31.readdir(current, { withFileTypes: true });
   const out = [];
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
@@ -6907,16 +7181,16 @@ async function listAllFilesUnfiltered(root, current = root) {
   return out;
 }
 async function validateStagedItem(item, absPath) {
-  const stat = await fs30.stat(absPath).catch(() => null);
+  const stat = await fs31.stat(absPath).catch(() => null);
   if (!stat) return { ok: true };
   if (stat.isFile()) {
-    const content2 = await fs30.readFile(absPath, "utf8");
+    const content2 = await fs31.readFile(absPath, "utf8");
     return validateCatalogItem(item, content2);
   }
   const files = await listAllFilesUnfiltered(absPath);
   for (const rel of files) {
     if (!isMarkdownFile(rel)) continue;
-    const content2 = await fs30.readFile(path33.join(absPath, rel), "utf8");
+    const content2 = await fs31.readFile(path33.join(absPath, rel), "utf8");
     const verdict = validateCatalogItem(item, content2);
     if (!verdict.ok) return verdict;
   }
@@ -6938,7 +7212,7 @@ async function validateStagedItems(staging, items) {
       continue;
     }
     coveredPaths.push(item.path);
-    if (!await fs30.pathExists(contentPath)) {
+    if (!await fs31.pathExists(contentPath)) {
       if (!isSynthetic) {
         accepted.push(item.id);
         contentlessIds.add(item.id);
@@ -6948,7 +7222,7 @@ async function validateStagedItems(staging, items) {
     const verdict = await validateStagedItem(item, contentPath);
     if (!verdict.ok) {
       warn(`Rejected ${item.id}: ${verdict.reason}`);
-      await fs30.remove(contentPath);
+      await fs31.remove(contentPath);
       if (!isSynthetic) rejected += 1;
       continue;
     }
@@ -6960,30 +7234,30 @@ async function validateStagedItems(staging, items) {
     const covered = coveredPaths.some((p) => rel === p || rel.startsWith(`${p}/`));
     if (!covered) {
       warn(`Refusing staged file outside any catalog item's path: ${rel}`);
-      await fs30.remove(path33.join(staging, rel));
+      await fs31.remove(path33.join(staging, rel));
     }
   }
   await pruneEmptyDirs(staging);
   return { accepted, rejected, contentlessIds };
 }
 async function pruneEmptyDirs(root, dir = root) {
-  const entries = await fs30.readdir(dir, { withFileTypes: true });
+  const entries = await fs31.readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
       await pruneEmptyDirs(root, path33.join(dir, entry.name));
     }
   }
-  if (dir !== root && (await fs30.readdir(dir)).length === 0) {
-    await fs30.remove(dir);
+  if (dir !== root && (await fs31.readdir(dir)).length === 0) {
+    await fs31.remove(dir);
   }
 }
 async function stripSymlinks(dir) {
   const removed = [];
-  const entries = await fs30.readdir(dir, { withFileTypes: true });
+  const entries = await fs31.readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
     const abs = path33.join(dir, entry.name);
     if (entry.isSymbolicLink()) {
-      await fs30.remove(abs);
+      await fs31.remove(abs);
       removed.push(abs);
       continue;
     }
@@ -6996,12 +7270,12 @@ async function stripSymlinks(dir) {
 async function runBundleImport(file, options = {}) {
   const dryRun = Boolean(options.dryRun);
   const archive = path33.resolve(file);
-  if (!await fs30.pathExists(archive)) {
+  if (!await fs31.pathExists(archive)) {
     error(`No such bundle: ${file}`);
     process.exitCode = 1;
     return;
   }
-  const staging = await fs30.mkdtemp(path33.join(os2.tmpdir(), "haus-catalog-bundle-import-"));
+  const staging = await fs31.mkdtemp(path33.join(os2.tmpdir(), "haus-catalog-bundle-import-"));
   try {
     await tar.extract({
       file: archive,
@@ -7057,9 +7331,9 @@ async function runBundleImport(file, options = {}) {
       }
       return;
     }
-    await fs30.ensureDir(getCacheDir());
-    for (const entry of await fs30.readdir(staging)) {
-      await fs30.copy(path33.join(staging, entry), path33.join(getCacheDir(), entry), {
+    await fs31.ensureDir(getCacheDir());
+    for (const entry of await fs31.readdir(staging)) {
+      await fs31.copy(path33.join(staging, entry), path33.join(getCacheDir(), entry), {
         overwrite: true,
         errorOnExist: false
       });
@@ -7076,7 +7350,7 @@ async function runBundleImport(file, options = {}) {
     }
     throw err;
   } finally {
-    await fs30.remove(staging);
+    await fs31.remove(staging);
   }
 }
 
@@ -7086,7 +7360,7 @@ import fs41 from "fs-extra";
 init_manifest_format();
 
 // src/claude/former-install-orphans.ts
-import fs31 from "fs-extra";
+import fs32 from "fs-extra";
 init_path_safety();
 init_paths();
 var toPosix = (value) => value.replace(/\\/g, "/");
@@ -7110,7 +7384,7 @@ async function findOrphanedFormerInstalls(root, items, lockRows) {
     const projectRel = `.claude/${relPath}`;
     if (trackedPaths.has(projectRel) || reported.has(projectRel)) continue;
     const abs = safeJoin(claudePath(root), relPath);
-    if (abs === null || !await fs31.pathExists(abs)) continue;
+    if (abs === null || !await fs32.pathExists(abs)) continue;
     reported.add(projectRel);
     orphans.push({ formerId: entry.formerId, currentId: entry.currentId, relPath: projectRel });
   }
@@ -7118,13 +7392,13 @@ async function findOrphanedFormerInstalls(root, items, lockRows) {
 }
 
 // src/claude/plugin-duplicate-skills.ts
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 import path34 from "node:path";
 init_paths();
 function subdirectoryNames(dir) {
   let entries;
   try {
-    entries = fs32.readdirSync(dir, { withFileTypes: true });
+    entries = fs33.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -7133,7 +7407,7 @@ function subdirectoryNames(dir) {
 function isDirectorySymlink(dir, entry) {
   if (!entry.isSymbolicLink()) return false;
   try {
-    return fs32.statSync(path34.join(dir, entry.name)).isDirectory();
+    return fs33.statSync(path34.join(dir, entry.name)).isDirectory();
   } catch {
     return false;
   }
@@ -7172,82 +7446,6 @@ init_project_pin();
 init_fs();
 init_logger();
 init_paths();
-
-// src/claude/project-intent.ts
-init_project_pin();
-init_fs();
-init_logger();
-init_paths();
-import fs33 from "fs-extra";
-function normalizeIdList(value) {
-  if (!Array.isArray(value)) return [];
-  return [
-    ...new Set(
-      value.filter((entry) => typeof entry === "string" && entry.length > 0)
-    )
-  ];
-}
-function normalizeSignalList(value) {
-  return [...new Set(normalizeIdList(value).map((entry) => entry.toLowerCase()))];
-}
-async function readProjectConfigObject(root) {
-  try {
-    const data = await readJson(hausPath(root, PROJECT_CONFIG_FILE));
-    if (data == null || typeof data !== "object" || Array.isArray(data)) return null;
-    return data;
-  } catch (err) {
-    if (err.code === "ENOENT") return null;
-    warn(
-      `${PROJECT_CONFIG_REL} could not be read (${err instanceof Error ? err.message : String(err)}) \u2014 treating project intent as unset`
-    );
-    return null;
-  }
-}
-async function updateProjectConfig(root, mutate) {
-  const file = hausPath(root, PROJECT_CONFIG_FILE);
-  let existing = {};
-  if (await fs33.pathExists(file)) {
-    try {
-      const parsed = JSON.parse(await fs33.readFile(file, "utf8"));
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-        existing = { ...parsed };
-      } else {
-        warn(`${PROJECT_CONFIG_REL} is not a JSON object \u2014 rewriting with haus-managed keys only`);
-      }
-    } catch (err) {
-      warn(
-        `${PROJECT_CONFIG_REL} could not be parsed (${err instanceof Error ? err.message : String(err)}) \u2014 rewriting with haus-managed keys only`
-      );
-    }
-  }
-  await writeJson(file, mutate(existing));
-}
-async function readProjectIncludedIds(root) {
-  const data = await readProjectConfigObject(root);
-  return data == null ? [] : normalizeIdList(data.includedIds);
-}
-async function addProjectIncludedIds(root, ids) {
-  const toAdd = normalizeIdList(ids);
-  if (toAdd.length === 0) return;
-  await updateProjectConfig(root, (existing) => ({
-    ...existing,
-    includedIds: [.../* @__PURE__ */ new Set([...normalizeIdList(existing.includedIds), ...toAdd])].sort()
-  }));
-}
-function withdrawIncludedIds(existing, ids) {
-  const drop = new Set(ids);
-  return normalizeIdList(existing.includedIds).filter((id) => !drop.has(id));
-}
-async function readDeclaredContext(root) {
-  const data = await readProjectConfigObject(root);
-  if (data == null) return { roles: [], stacks: [] };
-  return {
-    roles: normalizeSignalList(data.declaredRoles),
-    stacks: normalizeSignalList(data.declaredStacks)
-  };
-}
-
-// src/claude/project-exclusions.ts
 function normalizeExcludedIds(value) {
   if (!Array.isArray(value)) return [];
   return [
@@ -7568,12 +7766,12 @@ init_fs();
 import path36 from "node:path";
 var NUL = String.fromCharCode(0);
 function parseNumstat(output) {
-  const fields2 = output.split(NUL);
+  const fields = output.split(NUL);
   const linesByFile = {};
   let linesAdded = 0;
   let linesRemoved = 0;
-  for (let i = 0; i < fields2.length; i++) {
-    const field = fields2[i];
+  for (let i = 0; i < fields.length; i++) {
+    const field = fields[i];
     if (!field) continue;
     const parts = field.split("	");
     if (parts.length < 3) continue;
@@ -7582,7 +7780,7 @@ function parseNumstat(output) {
     if (Number.isNaN(added) || Number.isNaN(removed)) continue;
     let file = parts[2];
     if (file === "") {
-      file = fields2[i + 2];
+      file = fields[i + 2];
       i += 2;
     }
     if (!file) continue;
@@ -9161,6 +9359,8 @@ async function runDoctor(options) {
     ok(`- WARN: ${describeUnknownDetection(context.unsupportedSignals ?? [], isLinkedWorktree)}`);
   }
   ok(`Package manager: ${context.packageManager}`);
+  const profile = await readProjectProfile(root);
+  ok(`Profile: ${profile}`);
   if (recommendation) {
     ok(`Recommended items: ${recommendation.recommended?.length ?? 0}`);
   } else {
@@ -9219,7 +9419,9 @@ async function runDoctor(options) {
       const block = rootClaudeMdContent.slice(beginIdx, endIdx + BLOCK_END.length);
       const importLinePattern = /^@(\S+)\s*$/gm;
       const actualTargets = [...block.matchAll(importLinePattern)].map((m) => m[1]);
-      const expectedTargets = [...IMPORT_CONTENT.matchAll(importLinePattern)].map((m) => m[1]);
+      const expectedTargets = [...importContentFor(profile).matchAll(importLinePattern)].map(
+        (m) => m[1]
+      );
       const missingTargets = expectedTargets.filter((t) => !actualTargets.includes(t));
       const foreignTargets = actualTargets.filter((t) => !expectedTargets.includes(t));
       if (missingTargets.length > 0 || foreignTargets.length > 0) {
@@ -9271,13 +9473,13 @@ async function runDoctor(options) {
       ok("- .haus-workflow/WORKFLOW.md: OK (user-owned)");
     } else {
       const bodyContent = workflowContent.slice(firstLine.length + 1);
-      const cachePath = path49.join(getCacheDir(), "templates/agentic-workflow-standard.md");
+      const cachePath = path49.join(getCacheDir(), PROFILES[profile].workflowTemplateRel);
       const bundledPath = path49.join(
         packageRoot(),
         "library",
         "global",
         "templates",
-        "agentic-workflow-standard.md"
+        path49.basename(PROFILES[profile].workflowTemplateRel)
       );
       const templatePath = await fs41.pathExists(cachePath) ? cachePath : bundledPath;
       const templateContent = await readText(templatePath);
@@ -9364,6 +9566,16 @@ async function runDoctor(options) {
   } else {
     ok("- CI GATE: OK (a workflow runs `haus ci-gate`)");
   }
+  if (!PROFILES[profile].writesCiGate) {
+    const ciGateContent = await readText(path49.join(root, CI_GATE_WORKFLOW_REL));
+    if (ciGateContent !== void 0 && isHausWrittenCiGate(ciGateContent)) {
+      suggest(
+        `- CI GATE: ${CI_GATE_WORKFLOW_REL} is still present under the ${profile} profile, which does not write one`,
+        `This repo is on the ${profile} profile (no CI gate by design), but ${CI_GATE_WORKFLOW_REL} is still here from an earlier setup`,
+        `delete ${CI_GATE_WORKFLOW_REL} by hand (haus will not remove it for you)`
+      );
+    }
+  }
   const trackedArtifacts = await listTrackedArtifactPaths(root);
   if (trackedArtifacts.length > 0) {
     flag(
@@ -9404,6 +9616,18 @@ async function runDoctor(options) {
       err.kind === "too-new" ? "npm install -g @haus-tech/haus-workflow@latest" : "fix `manifestFormat` in the catalog manifest \u2014 it must be a positive integer (upgrading haus will not help)"
     );
   }
+  const profileRules = catalogCtx ? parseProfileRules(
+    catalogCtx.profiles,
+    profile,
+    new Set(catalogCtx.items.map((item) => item.id))
+  ) : null;
+  if (catalogCtx && profileRules === null) {
+    flag(
+      `- PROFILE: the ${describeCatalogTier(catalogCtx)} catalog defines no "${profile}" profile \u2014 \`haus apply\` refuses until it does`,
+      `This project is set to the ${profile} profile, but the catalog it uses defines no such profile (needs haus-workflow-catalog >= 6.5.0)`,
+      'haus update (or set "profile" back to "production" in .haus-workflow/haus.config.json)'
+    );
+  }
   const pluginPins = catalogItems === null ? [] : await loadCatalogPluginPins(root);
   const pluginState = await probePluginEnv();
   const activePins = pluginPins.filter((pin) => isPluginActive(pluginState, pin));
@@ -9571,8 +9795,21 @@ async function runDoctor(options) {
     const excludedIds = new Set(await readProjectExcludedIds(root));
     const activePinIds = activePins.map((pin) => pin.id);
     const lockedIds = (await readJson(hausPath(root, "haus.lock.json")) ?? []).map((entry) => entry.id).filter((id) => typeof id === "string");
+    const catalogById = new Map(catalogItems.map((item) => [item.id, item]));
+    const excludedByProfile = profileRules === null ? [] : lockedIds.filter((id) => {
+      const item = catalogById.get(id);
+      return item !== void 0 && profileVerdict(item, profileRules)?.kind === "excluded";
+    });
+    if (excludedByProfile.length > 0) {
+      suggest(
+        `- PROFILE: ${excludedByProfile.length} installed item(s) are excluded by the ${profile} profile (${excludedByProfile.join(", ")})`,
+        `${excludedByProfile.length} installed item(s) are kept out by the ${profile} profile and will not be recommended again`,
+        "haus apply --write --prune"
+      );
+    }
+    const profileExcludedSet = new Set(excludedByProfile);
     const drifted = lockedIds.filter(
-      (id) => catalogIds.has(id) && !recommendedIds.has(id) && !excludedIds.has(id) && !isSupersededByPlugin(id, activePinIds)
+      (id) => catalogIds.has(id) && !recommendedIds.has(id) && !excludedIds.has(id) && !profileExcludedSet.has(id) && !isSupersededByPlugin(id, activePinIds)
     );
     if (drifted.length > 0) {
       suggest(
@@ -9881,14 +10118,14 @@ function stampFrontmatter(content2, h) {
     }
   }
   if (close === -1) return content2;
-  const fields2 = [];
+  const fields = [];
   for (let i = 1; i < close; i++) {
     if (/^haus_managed:/.test(lines[i])) continue;
-    fields2.push(lines[i]);
+    fields.push(lines[i]);
   }
   const rebuilt = [
     FM_FENCE,
-    ...fields2,
+    ...fields,
     `${FM_KEY}: "${buildMarkerValue(h)}"`,
     ...lines.slice(close)
     // closing fence + body
@@ -11304,6 +11541,10 @@ function normalizeRecommendation(input2) {
     estimatedTokenReductionPct: input2.estimatedTokenReductionPct ?? tokenReductionPct(recommended.length, skipped.length)
   };
 }
+var NEVER_NEAR_MISS_GATES = /* @__PURE__ */ new Set([
+  "profile-excluded",
+  "workflow-template-item"
+]);
 function buildNearMiss(skipped) {
   const nearMiss = [];
   for (const item of skipped) {
@@ -11311,6 +11552,7 @@ function buildNearMiss(skipped) {
     if (!gates) continue;
     const failing = gates.filter((g) => !g.passed);
     if (failing.length !== 1) continue;
+    if (NEVER_NEAR_MISS_GATES.has(failing[0].name)) continue;
     nearMiss.push({
       id: item.id,
       missingGate: failing[0].name,
@@ -11721,6 +11963,7 @@ async function runGuard(kind, _options) {
 }
 
 // src/claude/setup-core.ts
+import path59 from "node:path";
 init_github_rate_limit();
 
 // src/recommender/recommend.ts
@@ -11770,7 +12013,17 @@ async function readChangedFiles(root) {
 // src/recommender/recommend.ts
 async function recommend(root, context, opts = {}) {
   const activePluginIds = opts.activePluginIds ?? [];
-  const items = await loadCatalog(root);
+  const catalogCtx = await loadCatalogContext(root);
+  const items = catalogCtx.items;
+  const profile = opts.profile ?? await readProjectProfile(root);
+  const profileRules = parseProfileRules(
+    catalogCtx.profiles,
+    profile,
+    new Set(items.map((item) => item.id))
+  );
+  if (profileRules === null) {
+    throw new ProfileUnsupportedError(profile, describeCatalogTier(catalogCtx));
+  }
   const excludedIds = await readProjectExcludedIds(root);
   const sources = buildSourcesReport(items);
   const deep = await readJson(hausPath(root, "deep-context.json")) ?? {};
@@ -11855,6 +12108,33 @@ async function recommend(root, context, opts = {}) {
       "Catalog item is deprecated",
       "reviewStatus:deprecated"
     );
+    const verdict = profileVerdict(item, profileRules);
+    if (verdict?.kind === "excluded") {
+      add(
+        "profile-excluded",
+        false,
+        "profile-excluded",
+        `Excluded by profile ${profile} (${verdict.clause})`,
+        verdict.clause
+      );
+    } else if (verdict?.kind === "kept") {
+      add(
+        "profile-excluded",
+        true,
+        "profile-kept",
+        `Kept by profile ${profile} keepIds despite ${verdict.clause}`,
+        `keep:${item.id}`
+      );
+    }
+    if (WORKFLOW_TEMPLATE_ITEM_IDS.has(item.id)) {
+      add(
+        "workflow-template-item",
+        false,
+        "workflow-template-item",
+        "Written as WORKFLOW.md by the profile, never installed as an item",
+        `id:${item.id}`
+      );
+    }
     if (isItemSupersededByPlugin(item, activePluginIds)) {
       add(
         "superseded-by-global-plugin",
@@ -12157,7 +12437,11 @@ var HARD_SKIP_CODES = /* @__PURE__ */ new Set([
   "curated-risk-blocked",
   "sensitive-policy",
   "source-trust",
-  "source-approval"
+  "source-approval",
+  // A `--include` must not force a second copy of the profile's workflow standard into
+  // `.claude/templates/` — it is written as WORKFLOW.md by the profile itself (Task 3
+  // controller ruling, ADR-0125).
+  "workflow-template-item"
 ]);
 function applyManualIncludes(include, items, recommended, skipped) {
   const warnings = [];
@@ -12182,6 +12466,9 @@ function applyManualIncludes(include, items, recommended, skipped) {
     if (skipCode === "requires-any-unsatisfied") {
       warnings.push(`--include: "${id}" added manually though its requiresAny gate is unsatisfied`);
     }
+    if (skipCode === "profile-excluded") {
+      warnings.push(`--include: "${id}" added manually though the project profile excludes it`);
+    }
     const previouslySkipped = skipIdx >= 0 ? skipped[skipIdx] : void 0;
     if (skipIdx >= 0) skipped.splice(skipIdx, 1);
     const isConfig = item.type === "config";
@@ -12402,6 +12689,32 @@ async function runSetupCore(root, opts) {
   const { json, apply, dryRun, quiet, confirm: confirm2, force } = opts;
   const say = quiet || json ? () => {
   } : log;
+  const storedProfile = await readProjectProfile(root);
+  if (storedProfile === "poc" && opts.profile !== "poc") {
+    const lockedMessage = pocLockedMessage();
+    error(lockedMessage);
+    process.exitCode = 1;
+    emitJsonEnvelope(json, quiet, {
+      scan: null,
+      recommendation: null,
+      hooks: null,
+      repoName: path59.basename(root),
+      warnings: [lockedMessage]
+    });
+    return {
+      root,
+      repoName: path59.basename(root),
+      roles: [],
+      recommendedCount: 0,
+      warnings: [lockedMessage],
+      hooksOk: false,
+      written: [],
+      catalogInstallOk: true,
+      setupOk: false,
+      failureReason: "profile-locked"
+    };
+  }
+  const profile = opts.profile ?? storedProfile;
   const scanResult = await scanProject(root);
   say("Haus scan complete");
   say(`Roles: ${scanResult.repoRoles.join(", ") || "unknown"}`);
@@ -12410,10 +12723,37 @@ async function runSetupCore(root, opts) {
   const context = await readContextOrScan(root);
   const priorManualIncludes = await readPriorManualIncludes(root);
   const activePluginIds = await activeGlobalPluginIds(root);
-  const recommendation = await recommend(root, context, {
-    include: priorManualIncludes,
-    activePluginIds
-  });
+  let recommendation;
+  try {
+    recommendation = await recommend(root, context, {
+      include: priorManualIncludes,
+      activePluginIds,
+      profile
+    });
+  } catch (err) {
+    if (!(err instanceof ProfileUnsupportedError)) throw err;
+    error(err.message);
+    process.exitCode = 1;
+    emitJsonEnvelope(json, quiet, {
+      scan: scanResult,
+      recommendation: null,
+      hooks: null,
+      repoName: context.repoName,
+      warnings: [err.message]
+    });
+    return {
+      root,
+      repoName: context.repoName,
+      roles: scanResult.repoRoles,
+      recommendedCount: 0,
+      warnings: [err.message],
+      hooksOk: false,
+      written: [],
+      catalogInstallOk: true,
+      setupOk: false,
+      failureReason: "profile-unsupported"
+    };
+  }
   if (recommendation.recommended.length === 0 && !force) {
     const warningLines2 = [
       .../* @__PURE__ */ new Set([...context.warnings, ...recommendation.warnings ?? [], ...siblingWarning])
@@ -12565,9 +12905,13 @@ async function runSetupCore(root, opts) {
       );
     }
   }
+  if (opts.profile !== void 0 && opts.profile !== storedProfile && !isPreview) {
+    await writeProjectProfile(root, opts.profile);
+  }
   const files = await writeClaudeFiles(root, dryRun ?? false, void 0, {
     quiet: opts.quiet,
-    activePluginIds
+    activePluginIds,
+    profile
   });
   say("Applied files:");
   files.forEach((f) => say(`- ${displayPath(root, f)}`));
@@ -12622,12 +12966,18 @@ async function runInit(options) {
     process.exitCode = 1;
     return;
   }
+  if (options.profile !== void 0 && !isProfileId(options.profile)) {
+    error(`--profile must be one of ${PROFILE_IDS.join(", ")} (got "${options.profile}").`);
+    process.exitCode = 1;
+    return;
+  }
   await runSetupCore(root, {
     json: options.json,
     apply: !dryRun,
     dryRun: false,
     force: options.force,
     allowEmptyCache: options.allowEmptyCache,
+    profile: options.profile,
     confirm: () => confirm("Approve and write Claude files now?")
   });
 }
@@ -12773,10 +13123,10 @@ async function runInstall(options, deps = {}) {
 }
 
 // src/commands/new.ts
-import path60 from "node:path";
+import path61 from "node:path";
 
 // src/new-project/create-project.ts
-import path59 from "node:path";
+import path60 from "node:path";
 import fs47 from "fs-extra";
 init_exec();
 init_logger();
@@ -12962,7 +13312,7 @@ var defaultDeps = {
 };
 var NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 async function recordPackageManager(projectPath, pm, deps) {
-  const pkgPath = path59.join(projectPath, "package.json");
+  const pkgPath = path60.join(projectPath, "package.json");
   let pkg;
   try {
     pkg = await fs47.readJson(pkgPath);
@@ -12993,9 +13343,9 @@ var CONFIG_TOOLING = {
   }
 };
 async function ensureConfigTooling(projectPath, scaffolded) {
-  const needed = scaffolded.map((file) => CONFIG_TOOLING[path59.basename(file)]).filter((entry) => entry !== void 0);
+  const needed = scaffolded.map((file) => CONFIG_TOOLING[path60.basename(file)]).filter((entry) => entry !== void 0);
   if (needed.length === 0) return [];
-  const pkgPath = path59.join(projectPath, "package.json");
+  const pkgPath = path60.join(projectPath, "package.json");
   let pkg;
   try {
     pkg = await fs47.readJson(pkgPath);
@@ -13027,7 +13377,7 @@ async function ensureConfigTooling(projectPath, scaffolded) {
 }
 async function createProject(opts, deps = defaultDeps) {
   const steps = [];
-  const projectPath = path59.resolve(opts.parentDir, opts.name);
+  const projectPath = path60.resolve(opts.parentDir, opts.name);
   const installHint = `cd ${opts.name} && ${opts.pm}${opts.pm === "yarn" ? "" : " install"}`;
   const fail = (step, detail) => {
     steps.push({ step, status: "failed", detail });
@@ -13035,14 +13385,14 @@ async function createProject(opts, deps = defaultDeps) {
   };
   const stack = getStack(opts.stackId);
   if (!stack) return fail("preflight", `Unknown stack "${opts.stackId}". Run \`haus new --list\`.`);
-  const parentStat = await fs47.stat(path59.dirname(projectPath)).catch(() => null);
+  const parentStat = await fs47.stat(path60.dirname(projectPath)).catch(() => null);
   if (!parentStat?.isDirectory()) {
     return fail(
       "preflight",
       `Parent directory ${opts.parentDir} is not an existing directory \u2014 pass an existing one to --dir.`
     );
   }
-  if (!NAME_RE.test(opts.name) || opts.name.includes("/") || opts.name.includes("\\") || path59.dirname(projectPath) !== path59.resolve(opts.parentDir)) {
+  if (!NAME_RE.test(opts.name) || opts.name.includes("/") || opts.name.includes("\\") || path60.dirname(projectPath) !== path60.resolve(opts.parentDir)) {
     return fail(
       "preflight",
       `Invalid project name "${opts.name}" (lowercase letters, digits, . _ - only).`
@@ -13064,7 +13414,11 @@ async function createProject(opts, deps = defaultDeps) {
       status: opts.github ? "planned" : "skipped",
       detail: opts.github ? `gh repo create ${opts.org ? `${opts.org}/` : ""}${opts.name} --${opts.visibility} --source . --push` : "--no-github"
     });
-    steps.push({ step: "init", status: "planned", detail: "haus init pipeline in the new project" });
+    steps.push({
+      step: "init",
+      status: "planned",
+      detail: `haus init pipeline in the new project${opts.profile ? ` (profile ${opts.profile})` : ""}`
+    });
     steps.push({ step: "overlay", status: "planned", detail: stack.overlayConfigIds.join(", ") });
     steps.push({
       step: "role-check",
@@ -13126,7 +13480,7 @@ async function createProject(opts, deps = defaultDeps) {
     steps.push({ step: "scaffold", status: "done" });
     phase = "git";
     if (!opts.json) log("\u25B6 git: init/branch/commit");
-    if (!await fs47.pathExists(path59.join(projectPath, ".git"))) {
+    if (!await fs47.pathExists(path60.join(projectPath, ".git"))) {
       const init = await deps.git(["init"], { cwd: projectPath });
       if (init.exitCode !== 0) return fail("git", `git init failed: ${init.stderr}`);
     }
@@ -13167,6 +13521,7 @@ async function createProject(opts, deps = defaultDeps) {
     phase = "init";
     if (!opts.json) log("\u25B6 init: haus setup pipeline");
     const exitCodeBeforeSetup = process.exitCode;
+    const profileFlag = opts.profile ? ` --profile ${opts.profile}` : "";
     let setupResult;
     try {
       setupResult = await deps.setup(projectPath, {
@@ -13175,13 +13530,14 @@ async function createProject(opts, deps = defaultDeps) {
         dryRun: false,
         quiet: opts.json,
         confirm: opts.yes ? async () => true : () => confirm("Approve and write Claude files now?"),
-        allowEmptyCache: opts.allowEmptyCache
+        allowEmptyCache: opts.allowEmptyCache,
+        profile: opts.profile
       });
     } catch (err) {
       steps.push({
         step: "init",
         status: "failed",
-        detail: `haus init threw (${err instanceof Error ? err.message : String(err)}). Project and repo are intact \u2014 cd ${opts.name} && haus init to retry.`
+        detail: `haus init threw (${err instanceof Error ? err.message : String(err)}). Project and repo are intact \u2014 cd ${opts.name} && haus init${profileFlag} to retry.`
       });
       return { ok: false, projectPath, repoUrl, installHint, steps };
     }
@@ -13191,13 +13547,15 @@ async function createProject(opts, deps = defaultDeps) {
       const reason = setupResult?.failureReason ?? (catalogInstallRefused ? "catalog-install" : void 0);
       switch (reason) {
         case "catalog-install":
-          return `${enter} && haus init --allow-empty-cache`;
+          return `${enter} && haus init --allow-empty-cache${profileFlag}`;
         case "zero-signal":
-          return `${enter} && haus init --force`;
+          return `${enter} && haus init --force${profileFlag}`;
         case "manifest-format":
-          return `npm i -g @haus-tech/haus-workflow@latest, then ${enter} && haus init`;
+          return `npm i -g @haus-tech/haus-workflow@latest, then ${enter} && haus init${profileFlag}`;
+        case "profile-unsupported":
+          return `${enter} && haus update, then haus init${profileFlag}`;
         default:
-          return `${enter} && haus init`;
+          return `${enter} && haus init${profileFlag}`;
       }
     })();
     if (Array.isArray(setupResult?.written) && setupResult.written.length === 0 && setupResult.setupOk !== false) {
@@ -13208,7 +13566,7 @@ async function createProject(opts, deps = defaultDeps) {
       });
       return { ok: false, projectPath, repoUrl, installHint, steps };
     }
-    if (process.exitCode === 1 && exitCodeBeforeSetup !== 1) {
+    if (process.exitCode === 1 && exitCodeBeforeSetup !== 1 || setupResult?.setupOk === false) {
       if (opts.allowEmptyCache && catalogInstallRefused) {
         steps.push({
           step: "init",
@@ -13352,11 +13710,14 @@ function resolveNewOptions(stackArg, nameArg, flags, cwd) {
   if (flags.dir !== void 0 && flags.dir.trim() === "") {
     return { ok: false, error: "--dir needs a path (omit it to scaffold into the cwd)." };
   }
-  const parentDir = flags.dir === void 0 ? cwd : path60.resolve(cwd, flags.dir);
+  const parentDir = flags.dir === void 0 ? cwd : path61.resolve(cwd, flags.dir);
   const pm = flags.pm ?? "yarn";
   if (!PMS.includes(pm)) {
     return { ok: false, error: `Unsupported --pm "${pm}" \u2014 use yarn, npm, or pnpm.` };
   }
+  if (flags.profile !== void 0 && !isProfileId(flags.profile)) {
+    return { ok: false, error: `Unsupported --profile "${flags.profile}" \u2014 use production or poc.` };
+  }
   if (stackArg === void 0 || nameArg === void 0) {
     return { ok: false, error: "missing-args" };
   }
@@ -13373,7 +13734,8 @@ function resolveNewOptions(stackArg, nameArg, flags, cwd) {
       yes: flags.yes === true,
       dryRun,
       json: flags.json === true,
-      allowEmptyCache: flags.allowEmptyCache === true
+      allowEmptyCache: flags.allowEmptyCache === true,
+      profile: flags.profile
     }
   };
 }
@@ -13431,7 +13793,15 @@ async function runRecommend(options) {
   const include = parseIdList(options.include);
   if (include.length > 0) await addProjectIncludedIds(root, include);
   const activePluginIds = await activeGlobalPluginIds(root);
-  const result = await recommend(root, context, { include, activePluginIds });
+  let result;
+  try {
+    result = await recommend(root, context, { include, activePluginIds });
+  } catch (err) {
+    if (!(err instanceof ProfileUnsupportedError)) throw err;
+    error(err.message);
+    process.exitCode = 1;
+    return;
+  }
   await writeJson(hausPath(root, "recommendation.json"), result);
   if (options.json) {
     log(JSON.stringify(result, null, 2));
@@ -13450,7 +13820,7 @@ async function runRecommend(options) {
 }
 
 // src/commands/remove.ts
-import path61 from "node:path";
+import path62 from "node:path";
 init_fs();
 init_logger();
 init_paths();
@@ -13557,7 +13927,7 @@ async function runRemove(ids, options = {}) {
   }
   const allAbs = cleared.flatMap(({ existing }) => existing.map(({ abs }) => abs));
   const backupRoot = await backupTrackedPaths(root, allAbs, say, "remove");
-  report.backupDir = backupRoot === null ? null : path61.basename(backupRoot);
+  report.backupDir = backupRoot === null ? null : path62.basename(backupRoot);
   for (const { id, existing } of cleared) {
     await deleteTrackedPaths(root, id, existing, { verb: "Removed", reason: "" }, say);
   }
@@ -13606,7 +13976,15 @@ async function runRescan(options = {}) {
     }
   }
   const { ids: activePluginIds, probed: pluginProbeConsultedCli } = await probeActiveGlobalPluginIds(root);
-  const recommendation = await recommend(root, context, { activePluginIds });
+  let recommendation;
+  try {
+    recommendation = await recommend(root, context, { activePluginIds });
+  } catch (err) {
+    if (!(err instanceof ProfileUnsupportedError)) throw err;
+    error(err.message);
+    process.exitCode = 1;
+    return;
+  }
   if (!dryRun) {
     await writeJson(hausPath(root, "recommendation.json"), recommendation);
   }
@@ -13647,7 +14025,7 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path62 from "node:path";
+import path63 from "node:path";
 import fs48 from "fs-extra";
 
 // src/claude/managed-paths.ts
@@ -13681,7 +14059,7 @@ async function collectLockTrackedPaths(root) {
     const unsafeByRel = await unsafeReasonsFor(root, relPaths);
     const existing = await resolveExistingTrackedPaths(root, id, relPaths, log, unsafeByRel);
     for (const [rel, reason] of unsafeByRel) {
-      if (reason !== null) preserved.push(path62.resolve(root, rel));
+      if (reason !== null) preserved.push(path63.resolve(root, rel));
     }
     if (existing.length === 0) continue;
     const gate = await hashGateEntry(root, { hash: row.hash }, existing);
@@ -13702,7 +14080,7 @@ async function settingsHasHausContent(root) {
   return settings._haus != null;
 }
 async function claudeMdHasHausBlock(root) {
-  const filePath = path62.join(root, "CLAUDE.md");
+  const filePath = path63.join(root, "CLAUDE.md");
   if (!await fs48.pathExists(filePath)) return false;
   const text = await fs48.readFile(filePath, "utf8");
   return text.includes(BLOCK_BEGIN);
@@ -13715,15 +14093,15 @@ async function stripProjectSettings(root) {
   const hasContent = Object.keys(settings).length > 0;
   if (hasContent) {
     await writeProjectSettings(root, settings);
-    log(`Stripped haus rules from ${path62.relative(root, settingsPath)} (user settings preserved).`);
+    log(`Stripped haus rules from ${path63.relative(root, settingsPath)} (user settings preserved).`);
     return true;
   }
   await fs48.remove(settingsPath);
-  log(`Removed ${path62.relative(root, settingsPath)} (no user-owned settings remained).`);
+  log(`Removed ${path63.relative(root, settingsPath)} (no user-owned settings remained).`);
   return true;
 }
 async function stripRootClaudeMd(root) {
-  const filePath = path62.join(root, "CLAUDE.md");
+  const filePath = path63.join(root, "CLAUDE.md");
   if (!await fs48.pathExists(filePath)) return false;
   const prev = await fs48.readFile(filePath, "utf8");
   if (!prev.includes(BLOCK_BEGIN)) return false;
@@ -13751,12 +14129,12 @@ async function backupManagedFilesBeforeUndo(root, managedAbsPaths) {
   const backupRoot = hausPath(root, "backups", dirBackupDirName("undo", stamp));
   for (const abs of managedAbsPaths) {
     if (!await fs48.pathExists(abs)) continue;
-    const rel = path62.relative(root, abs);
-    const backupPath = path62.join(backupRoot, rel);
-    await fs48.ensureDir(path62.dirname(backupPath));
+    const rel = path63.relative(root, abs);
+    const backupPath = path63.join(backupRoot, rel);
+    await fs48.ensureDir(path63.dirname(backupPath));
     await fs48.copy(abs, backupPath);
   }
-  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path62.relative(root, backupRoot)}.`);
+  log(`Backed up ${managedAbsPaths.length} managed file(s) to ${path63.relative(root, backupRoot)}.`);
 }
 async function runUndo(options) {
   const root = options.root ?? process.cwd();
@@ -13770,7 +14148,7 @@ async function runUndo(options) {
     log("Nothing to remove: no haus-managed files found in this directory.");
     return;
   }
-  const relTargets = managed.map((p) => path62.relative(root, p));
+  const relTargets = managed.map((p) => path63.relative(root, p));
   const summaryParts = [...relTargets];
   if (stripSettings) summaryParts.push(".claude/settings.json (haus rules only)");
   if (stripClaudeMd) summaryParts.push("CLAUDE.md (haus import block only)");
@@ -13798,7 +14176,7 @@ User-owned .claude/ files will be preserved.`
   for (const abs of coreManaged) {
     if (!await fs48.pathExists(abs)) continue;
     await fs48.remove(abs);
-    log(`Removed ${path62.relative(root, abs)}`);
+    log(`Removed ${path63.relative(root, abs)}`);
   }
   for (const { id, existing } of lockRemovable) {
     await deleteTrackedPaths(root, id, existing, { verb: "Removed" }, log);
@@ -13815,7 +14193,7 @@ init_fs();
 init_logger();
 init_paths();
 import crypto4 from "node:crypto";
-import path63 from "node:path";
+import path64 from "node:path";
 import fs49 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false, removePlugins = removeGlobalPlugins } = options;
@@ -13872,14 +14250,14 @@ async function runUninstall(options = {}) {
       continue;
     }
     await fs49.remove(entry.destPath);
-    await pruneEmptyDir(path63.dirname(entry.destPath));
+    await pruneEmptyDir(path64.dirname(entry.destPath));
     result.deleted.push(entry.destPath);
   }
   const settings = await readSettings();
   const stripped = stripHausHooks(stripHausAsk(stripHausAllow(stripHausDeny(settings))));
   await writeSettings(stripped);
   result.hooksStripped = true;
-  const hausDir = path63.join(globalClaudeDir(), "haus");
+  const hausDir = path64.join(globalClaudeDir(), "haus");
   const manifestPath2 = hausManifestPath();
   if (fs49.pathExistsSync(manifestPath2)) {
     await fs49.remove(manifestPath2);
@@ -13957,7 +14335,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/validate-catalog.ts
-import path65 from "node:path";
+import path66 from "node:path";
 
 // src/catalog/validate-core.ts
 init_forbidden_content();
@@ -13965,7 +14343,7 @@ init_manifest_item_fields();
 init_path_safety();
 init_validation_rules2();
 import fs50 from "node:fs";
-import path64 from "node:path";
+import path65 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var ITEM_ID_PATTERN = /^haus\./;
 function auditForbiddenStacks(items) {
@@ -14132,7 +14510,7 @@ function readForAudit(absPath, label, failures) {
   }
 }
 function auditTemplateContent(manifestDir, absPath, itemId) {
-  const rel = path64.relative(manifestDir, absPath);
+  const rel = path65.relative(manifestDir, absPath);
   const failures = [];
   const text = readForAudit(absPath, `${itemId}: ${rel}`, failures);
   if (text === null) return failures;
@@ -14154,25 +14532,25 @@ function auditShippedFiles(manifestDir, items) {
   const failures = [];
   for (const item of items) {
     if (!item.path || !isSafeCatalogPath(item.path)) continue;
-    const absPath = path64.join(manifestDir, item.path);
+    const absPath = path65.join(manifestDir, item.path);
     if (item.type === "skill") {
-      const skillMd = path64.join(absPath, "SKILL.md");
+      const skillMd = path65.join(absPath, "SKILL.md");
       if (!fs50.existsSync(skillMd)) {
-        failures.push(`${item.id}: missing ${path64.relative(manifestDir, skillMd)}`);
+        failures.push(`${item.id}: missing ${path65.relative(manifestDir, skillMd)}`);
         continue;
       }
       const text = readForAudit(skillMd, `${item.id}: SKILL.md`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: SKILL.md`));
       failures.push(
-        ...auditForbiddenTagsInText(text, `${item.id}: ${path64.relative(manifestDir, skillMd)}`)
+        ...auditForbiddenTagsInText(text, `${item.id}: ${path65.relative(manifestDir, skillMd)}`)
       );
     } else if (item.type === "agent") {
       if (!fs50.existsSync(absPath)) {
         failures.push(`${item.id}: missing agent file ${item.path}`);
         continue;
       }
-      const rel = path64.relative(manifestDir, absPath);
+      const rel = path65.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -14188,7 +14566,7 @@ function auditShippedFiles(manifestDir, items) {
         failures.push(`${item.id}: missing command file ${item.path}`);
         continue;
       }
-      const rel = path64.relative(manifestDir, absPath);
+      const rel = path65.relative(manifestDir, absPath);
       const text = readForAudit(absPath, `${item.id}: ${rel}`, failures);
       if (text === null) continue;
       failures.push(...checkRequiredFrontmatter(text, `${item.id}: ${rel}`));
@@ -14246,7 +14624,7 @@ function walkAllFiles(dir, fn, failures) {
   }
   for (const entry of entries) {
     if (entry.name === ".DS_Store") continue;
-    const full = path64.join(dir, entry.name);
+    const full = path65.join(dir, entry.name);
     if (entry.isDirectory()) walkAllFiles(full, fn, failures);
     else fn(full);
   }
@@ -14270,12 +14648,12 @@ function auditDiskOrphans(manifestDir, items) {
   const failures = [];
   const claimedPaths = items.filter((item) => item.path && isSafeCatalogPath(item.path)).map((item) => item.path.replace(/\\/g, "/"));
   for (const dir of CONTENT_ROOTS) {
-    const abs = path64.join(manifestDir, dir);
+    const abs = path65.join(manifestDir, dir);
     if (!fs50.existsSync(abs)) continue;
     walkAllFiles(
       abs,
       (file) => {
-        const relPath = path64.relative(manifestDir, file).replace(/\\/g, "/");
+        const relPath = path65.relative(manifestDir, file).replace(/\\/g, "/");
         if (!isPathClaimed(relPath, claimedPaths)) {
           failures.push(`orphaned on disk, claimed by no manifest item: ${relPath}`);
         }
@@ -14296,7 +14674,7 @@ function walkMd(dir, fn, failures) {
     return;
   }
   for (const entry of entries) {
-    const full = path64.join(dir, entry.name);
+    const full = path65.join(dir, entry.name);
     if (entry.isDirectory()) walkMd(full, fn, failures);
     else if (entry.name.endsWith(".md")) fn(full);
   }
@@ -14306,13 +14684,13 @@ function auditMarkdownContent(manifestDir, items) {
   const pathSourceMap = buildItemPathSourceMap(items);
   const pathTypeMap = buildItemPathTypeMap(items);
   for (const dir of ["skills", "agents", "templates", "commands", "sources"]) {
-    const abs = path64.join(manifestDir, dir);
+    const abs = path65.join(manifestDir, dir);
     if (!fs50.existsSync(abs)) continue;
     const dirType = DIR_ITEM_TYPE[dir] ?? "";
     walkMd(
       abs,
       (file) => {
-        const rel = path64.relative(manifestDir, file);
+        const rel = path65.relative(manifestDir, file);
         const text = readForAudit(file, rel, failures);
         if (text === null) return;
         const norm = rel.replace(/\\/g, "/");
@@ -14360,8 +14738,8 @@ async function runValidateCatalog(manifestPath2) {
     process.exitCode = 1;
     return;
   }
-  const abs = path65.resolve(process.cwd(), manifestPath2);
-  const manifestDir = path65.dirname(abs);
+  const abs = path66.resolve(process.cwd(), manifestPath2);
+  const manifestDir = path66.dirname(abs);
   const data = await readJson(abs);
   if (!data?.items) {
     error(`Could not read catalog manifest at ${abs}`);
@@ -14382,7 +14760,7 @@ init_logger();
 
 // src/workspace/worktree/add.ts
 init_fs();
-import path72 from "node:path";
+import path73 from "node:path";
 import fs54 from "fs-extra";
 
 // src/workspace/worktree/git-worktree.ts
@@ -14503,12 +14881,12 @@ async function hasUnpushedWork(cwd) {
 }
 
 // src/workspace/worktree/hydrate.ts
-import path68 from "node:path";
+import path69 from "node:path";
 import fs52 from "fs-extra";
 
 // src/workspace/worktree/cow-copy.ts
 init_exec();
-import path66 from "node:path";
+import path67 from "node:path";
 import fs51 from "fs-extra";
 async function getMacFilesystemType(dir) {
   const df = await runCommand("df", ["-P", dir]);
@@ -14543,11 +14921,11 @@ async function cowCopyDir(src, dest) {
   const srcExists = await fs51.pathExists(src);
   if (!srcExists)
     return { strategy: "unsupported", attempted: false, ok: false, error: "source missing" };
-  const strategy = await detectCowStrategy(path66.dirname(dest));
+  const strategy = await detectCowStrategy(path67.dirname(dest));
   if (strategy === "unsupported" || strategy === "unknown-platform") {
     return { strategy, attempted: false, ok: false };
   }
-  await fs51.ensureDir(path66.dirname(dest));
+  await fs51.ensureDir(path67.dirname(dest));
   const args = strategy === "darwin-clonefile" ? ["-c", "-R", src, dest] : ["-a", "--reflink=always", src, dest];
   const result = await runCommand("cp", args);
   return {
@@ -14561,7 +14939,7 @@ async function cowCopyDir(src, dest) {
 // src/workspace/worktree/install.ts
 init_exec();
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import path67 from "node:path";
+import path68 from "node:path";
 import fg7 from "fast-glob";
 function detectInstallPlan(signals) {
   if (signals.hasYarnLock) {
@@ -14582,10 +14960,10 @@ function detectInstallPlan(signals) {
   return { manager: "none" };
 }
 async function computeLockfileSignals(dir) {
-  const hasYarnLock = existsSync3(path67.join(dir, "yarn.lock"));
-  const hasPnpmLock = existsSync3(path67.join(dir, "pnpm-lock.yaml"));
-  const hasPackageLock = existsSync3(path67.join(dir, "package-lock.json"));
-  const hasComposerLock = existsSync3(path67.join(dir, "composer.lock"));
+  const hasYarnLock = existsSync3(path68.join(dir, "yarn.lock"));
+  const hasPnpmLock = existsSync3(path68.join(dir, "pnpm-lock.yaml"));
+  const hasPackageLock = existsSync3(path68.join(dir, "package-lock.json"));
+  const hasComposerLock = existsSync3(path68.join(dir, "composer.lock"));
   const dotnetFiles = await fg7(["**/*.csproj", "**/*.sln"], {
     cwd: dir,
     onlyFiles: true,
@@ -14599,7 +14977,7 @@ async function computeLockfileSignals(dir) {
   });
   const hasDotnetProject = dotnetFiles.length > 0;
   let hasPackageManagerField = false;
-  const pkgPath = path67.join(dir, "package.json");
+  const pkgPath = path68.join(dir, "package.json");
   if (existsSync3(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
@@ -14642,7 +15020,7 @@ function missingYarnrcEnvVars(content2, env) {
   return findRequiredYarnrcEnvVars(content2).filter((name) => env[name] === void 0);
 }
 function missingYarnrcEnvVarsInDir(dir, env) {
-  const yarnrcPath = path67.join(dir, ".yarnrc.yml");
+  const yarnrcPath = path68.join(dir, ".yarnrc.yml");
   if (!existsSync3(yarnrcPath)) return [];
   try {
     return missingYarnrcEnvVars(readFileSync3(yarnrcPath, "utf8"), env);
@@ -14738,8 +15116,8 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
   const start = Date.now();
   const targets = [];
   for (const target of HYDRATION_TARGETS) {
-    const src = path68.join(mainMemberPath, target);
-    const dest = path68.join(worktreeMemberPath, target);
+    const src = path69.join(mainMemberPath, target);
+    const dest = path69.join(worktreeMemberPath, target);
     if (!await fs52.pathExists(src)) continue;
     const destExists = await fs52.pathExists(dest);
     if (!opts.force && destExists) continue;
@@ -14757,11 +15135,11 @@ async function hydrateMember(mainMemberPath, worktreeMemberPath, opts = {}) {
 
 // src/workspace/worktree/local-files.ts
 init_exec();
-import path69 from "node:path";
+import path70 from "node:path";
 import fs53 from "fs-extra";
 var MACHINE_LOCAL_FILES = [
   "docker-compose.local.yml",
-  path69.join(".claude", "settings.local.json")
+  path70.join(".claude", "settings.local.json")
 ];
 async function isTracked(repoRoot, relFile) {
   const gitPath = relFile.replace(/\\/g, "/");
@@ -14771,11 +15149,11 @@ async function isTracked(repoRoot, relFile) {
 async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
   const copied = [];
   for (const rel of MACHINE_LOCAL_FILES) {
-    const src = path69.join(mainMemberPath, rel);
+    const src = path70.join(mainMemberPath, rel);
     if (!await fs53.pathExists(src)) continue;
     if (await isTracked(mainMemberPath, rel)) continue;
-    const dest = path69.join(worktreeMemberPath, rel);
-    await fs53.ensureDir(path69.dirname(dest));
+    const dest = path70.join(worktreeMemberPath, rel);
+    await fs53.ensureDir(path70.dirname(dest));
     await fs53.copy(src, dest, { overwrite: true });
     copied.push(rel);
   }
@@ -14784,15 +15162,15 @@ async function copyMachineLocalFiles(mainMemberPath, worktreeMemberPath) {
 
 // src/workspace/worktree/root.ts
 import { existsSync as existsSync4 } from "node:fs";
-import path70 from "node:path";
+import path71 from "node:path";
 async function resolveWorkspaceForWorktree(start) {
   const rootInfo = await resolveRoots(start);
   if (!rootInfo.isGitRepo) {
     return { ok: false, reason: "Not inside a git repository." };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const hasYaml = existsSync4(path70.join(workspaceRoot, WORKSPACE_FILE));
-  const hasManifest = existsSync4(path70.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const hasYaml = existsSync4(path71.join(workspaceRoot, WORKSPACE_FILE));
+  const hasManifest = existsSync4(path71.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!hasYaml && !hasManifest) {
     return {
       ok: false,
@@ -14818,10 +15196,10 @@ function selectMembers(members, only) {
 
 // src/workspace/worktree/state.ts
 init_fs();
-import path71 from "node:path";
+import path72 from "node:path";
 var WORKTREE_STATE_FILE = ".haus-worktree.json";
 function worktreesDir(mainRoot) {
-  return path71.join(mainRoot, ".claude", "worktrees");
+  return path72.join(mainRoot, ".claude", "worktrees");
 }
 function isValidWorktreeSlug(slug) {
   if (slug === "" || slug === "." || slug === "..") return false;
@@ -14834,22 +15212,22 @@ function worktreePath(mainRoot, slug) {
       `Invalid worktree slug ${JSON.stringify(slug)} \u2014 slugs may only contain letters, digits, ".", "_", "-" (no path separators, and not "." or "..").`
     );
   }
-  return path71.join(worktreesDir(mainRoot), slug);
+  return path72.join(worktreesDir(mainRoot), slug);
 }
 function slugFromWorktreePath(mainRoot, somePath) {
   const dir = worktreesDir(mainRoot);
-  const prefix = `${dir}${path71.sep}`;
+  const prefix = `${dir}${path72.sep}`;
   if (!somePath.startsWith(prefix)) return void 0;
-  const segment = somePath.slice(prefix.length).split(path71.sep)[0];
+  const segment = somePath.slice(prefix.length).split(path72.sep)[0];
   return segment !== void 0 && segment !== "" ? segment : void 0;
 }
 async function readWorktreeState(worktreeRoot) {
-  const state = await readJson(path71.join(worktreeRoot, WORKTREE_STATE_FILE));
+  const state = await readJson(path72.join(worktreeRoot, WORKTREE_STATE_FILE));
   if (state == null || typeof state !== "object" || !Array.isArray(state.members)) return void 0;
   return state;
 }
 async function writeWorktreeState(worktreeRoot, state) {
-  await writeJson(path71.join(worktreeRoot, WORKTREE_STATE_FILE), state);
+  await writeJson(path72.join(worktreeRoot, WORKTREE_STATE_FILE), state);
 }
 
 // src/workspace/worktree/add.ts
@@ -14883,7 +15261,7 @@ async function runAdd(opts) {
   const memberResults = [];
   for (const member of selected) {
     const start = Date.now();
-    const memberWorktreePath = path72.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path73.join(wsWorktreePath, member.folder);
     const outcome = await addWorktree(member.absPath, memberWorktreePath, branch, {
       preferDefaultBranchFrom: true
     });
@@ -14913,7 +15291,7 @@ async function runAdd(opts) {
   await mapWithConcurrency(okResults, async (result) => {
     const member = selected.find((m) => m.id === result.member);
     if (!member) return;
-    const memberWorktreePath = path72.join(wsWorktreePath, member.folder);
+    const memberWorktreePath = path73.join(wsWorktreePath, member.folder);
     const hydrationStart = Date.now();
     if (opts.hydrate !== false) {
       result.hydration = await hydrateMember(member.absPath, memberWorktreePath);
@@ -14981,16 +15359,16 @@ async function runDryRun(args) {
 // src/workspace/worktree/autohydrate.ts
 import { spawn } from "node:child_process";
 import fsSync from "node:fs";
-import path77 from "node:path";
+import path78 from "node:path";
 import fs56 from "fs-extra";
 
 // src/workspace/worktree/doctor.ts
 import { existsSync as existsSync6 } from "node:fs";
-import path75 from "node:path";
+import path76 from "node:path";
 
 // src/workspace/worktree/hydrate-lock.ts
 init_paths();
-import path73 from "node:path";
+import path74 from "node:path";
 import fs55 from "fs-extra";
 var STALE_LOCK_MS = 30 * 60 * 1e3;
 function locksDir(mainRoot) {
@@ -15008,13 +15386,13 @@ function assertSlug(slug) {
   return slug;
 }
 function hydrateLockPath(mainRoot, slug) {
-  return path73.join(locksDir(mainRoot), `hydrate-${assertSlug(slug)}.lock`);
+  return path74.join(locksDir(mainRoot), `hydrate-${assertSlug(slug)}.lock`);
 }
 function hydrateLogPath(mainRoot, slug) {
-  return path73.join(logsDir(mainRoot), `hydrate-${assertSlug(slug)}.log`);
+  return path74.join(logsDir(mainRoot), `hydrate-${assertSlug(slug)}.log`);
 }
 function hydrateLastRunPath(mainRoot, slug) {
-  return path73.join(logsDir(mainRoot), `hydrate-${assertSlug(slug)}.last.json`);
+  return path74.join(logsDir(mainRoot), `hydrate-${assertSlug(slug)}.last.json`);
 }
 function defaultIsAlive(pid) {
   try {
@@ -15026,7 +15404,7 @@ function defaultIsAlive(pid) {
 }
 async function readOwnerPid(lockPath) {
   try {
-    const raw = (await fs55.readFile(path73.join(lockPath, "pid"), "utf8")).trim();
+    const raw = (await fs55.readFile(path74.join(lockPath, "pid"), "utf8")).trim();
     if (raw === "") return void 0;
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : void 0;
@@ -15035,13 +15413,13 @@ async function readOwnerPid(lockPath) {
   }
 }
 async function claim(lockPath, pid) {
-  await fs55.ensureDir(path73.dirname(lockPath));
+  await fs55.ensureDir(path74.dirname(lockPath));
   try {
     await fs55.mkdir(lockPath);
   } catch {
     return false;
   }
-  await fs55.writeFile(path73.join(lockPath, "pid"), String(pid), "utf8");
+  await fs55.writeFile(path74.join(lockPath, "pid"), String(pid), "utf8");
   return true;
 }
 async function acquireHydrateLock(mainRoot, slug, deps = {}) {
@@ -15072,7 +15450,7 @@ async function acquireHydrateLock(mainRoot, slug, deps = {}) {
   return await claim(lockPath, pid) ? { acquired: true, lockPath } : { acquired: false, reason: "live", ownerPid, lockPath };
 }
 async function recordHydrateLockOwner(mainRoot, slug, pid) {
-  await fs55.writeFile(path73.join(hydrateLockPath(mainRoot, slug), "pid"), String(pid), "utf8");
+  await fs55.writeFile(path74.join(hydrateLockPath(mainRoot, slug), "pid"), String(pid), "utf8");
 }
 async function releaseHydrateLock(mainRoot, slug) {
   await fs55.remove(hydrateLockPath(mainRoot, slug));
@@ -15092,21 +15470,21 @@ async function readHydrateLock(mainRoot, slug) {
 
 // src/workspace/worktree/orphans.ts
 import { existsSync as existsSync5 } from "node:fs";
-import path74 from "node:path";
+import path75 from "node:path";
 var WORKSPACE_REPO_ID = "(workspace)";
 async function findOrphanedRegistrations(repos, wsWorktreesDir) {
   const orphans = [];
   for (const repo of repos) {
     const entries = await listWorktrees(repo.absPath);
     for (const entry of entries) {
-      const entryPath = path74.normalize(entry.path);
-      const marker = `${path74.sep}.claude${path74.sep}worktrees${path74.sep}`;
+      const entryPath = path75.normalize(entry.path);
+      const marker = `${path75.sep}.claude${path75.sep}worktrees${path75.sep}`;
       const idx = entryPath.indexOf(marker);
       if (idx === -1) continue;
       const rest = entryPath.slice(idx + marker.length);
-      const slug = rest.split(path74.sep)[0];
+      const slug = rest.split(path75.sep)[0];
       if (!slug) continue;
-      if (existsSync5(path74.join(wsWorktreesDir, slug))) continue;
+      if (existsSync5(path75.join(wsWorktreesDir, slug))) continue;
       orphans.push({
         repoId: repo.id,
         ownerRepo: repo.absPath,
@@ -15121,7 +15499,7 @@ async function findOrphanedRegistrations(repos, wsWorktreesDir) {
 // src/workspace/worktree/doctor.ts
 var HYDRATION_MARKERS = ["node_modules", "vendor", "obj", "bin"];
 function looksHydrated(memberPath) {
-  return HYDRATION_MARKERS.some((marker) => existsSync6(path75.join(memberPath, marker)));
+  return HYDRATION_MARKERS.some((marker) => existsSync6(path76.join(memberPath, marker)));
 }
 async function runDoctor2() {
   const rootInfo = await resolveRoots();
@@ -15138,7 +15516,7 @@ async function runDoctor2() {
     };
   }
   const workspaceRoot = rootInfo.mainRoot;
-  const isWorkspace = existsSync6(path75.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path75.join(workspaceRoot, REPOS_MANIFEST_FILE));
+  const isWorkspace = existsSync6(path76.join(workspaceRoot, WORKSPACE_FILE)) || existsSync6(path76.join(workspaceRoot, REPOS_MANIFEST_FILE));
   if (!isWorkspace) {
     return {
       isWorkspace: false,
@@ -15154,7 +15532,7 @@ async function runDoctor2() {
     };
   }
   const wsWorktreesDir = worktreesDir(workspaceRoot);
-  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path75.sep}`);
+  const underWorktreesDir = rootInfo.repoRoot.startsWith(`${wsWorktreesDir}${path76.sep}`);
   const inWorkspaceWorktree = rootInfo.isLinkedWorktree && underWorktreesDir;
   const workspaceConfig = await readWorkspaceConfig(workspaceRoot);
   const autoHydrate = workspaceConfig?.worktree?.autoHydrate === true;
@@ -15167,10 +15545,10 @@ async function runDoctor2() {
   let hydrationOwnerPid;
   if (inWorkspaceWorktree) {
     const wtPath = rootInfo.repoRoot;
-    slug = rootInfo.worktreeName ?? path75.basename(wtPath);
+    slug = rootInfo.worktreeName ?? path76.basename(wtPath);
     const state = await readWorktreeState(wtPath);
     for (const member of members) {
-      const memberPath = path75.join(wtPath, member.folder);
+      const memberPath = path76.join(wtPath, member.folder);
       const materialized = existsSync6(memberPath);
       const expectedBranch = state?.members.find((m) => m.folder === member.folder)?.branch ?? state?.branch;
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
@@ -15215,7 +15593,7 @@ async function runDoctor2() {
     wsWorktreesDir
   );
   const orphans = orphanScan.map(
-    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path75.join(wsWorktreesDir, o.slug)} no longer exists.`
+    (o) => `${o.repoId}: worktree registered at ${o.registeredPath} but ${path76.join(wsWorktreesDir, o.slug)} no longer exists.`
   );
   if (orphans.length > 0) {
     problems.push(...orphans);
@@ -15238,7 +15616,7 @@ async function runDoctor2() {
 // src/workspace/worktree/hydrate-command.ts
 init_fs();
 import { existsSync as existsSync7 } from "node:fs";
-import path76 from "node:path";
+import path77 from "node:path";
 async function runHydrateWorktree(opts) {
   const rootInfo = await resolveRoots();
   if (!rootInfo.isGitRepo || !rootInfo.isLinkedWorktree) {
@@ -15249,7 +15627,7 @@ async function runHydrateWorktree(opts) {
   }
   const workspaceRoot = rootInfo.mainRoot;
   const wtPath = rootInfo.repoRoot;
-  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path76.sep}`)) {
+  if (!wtPath.startsWith(`${worktreesDir(workspaceRoot)}${path77.sep}`)) {
     return {
       ok: false,
       error: "Current worktree is not one of this workspace's .claude/worktrees/<slug> checkouts."
@@ -15261,13 +15639,13 @@ async function runHydrateWorktree(opts) {
     return { ok: false, error: `Unknown --only repo(s): ${unknown.join(", ")}` };
   }
   const state = await readWorktreeState(wtPath);
-  const slug = state?.slug ?? path76.basename(wtPath);
+  const slug = state?.slug ?? path77.basename(wtPath);
   const detectedBranch = await currentBranch(wtPath);
   const targetBranch = state?.branch ?? (detectedBranch !== "HEAD" ? detectedBranch : void 0) ?? slug;
   if (opts.dryRun) {
     const results2 = await Promise.all(
       selected.map(async (member) => {
-        const memberPath = path76.join(wtPath, member.folder);
+        const memberPath = path77.join(wtPath, member.folder);
         if (existsSync7(memberPath)) {
           return { member: member.id, folder: member.folder, status: "planned" };
         }
@@ -15288,7 +15666,7 @@ async function runHydrateWorktree(opts) {
   const results = await mapWithConcurrency(
     selected,
     async (member) => {
-      const memberPath = path76.join(wtPath, member.folder);
+      const memberPath = path77.join(wtPath, member.folder);
       let branchAction;
       if (!existsSync7(memberPath)) {
         if (!opts.materialize) {
@@ -15409,7 +15787,7 @@ function defaultSpawnDetached(spec) {
 }
 function appendLog(logPath, line2) {
   try {
-    fsSync.mkdirSync(path77.dirname(logPath), { recursive: true });
+    fsSync.mkdirSync(path78.dirname(logPath), { recursive: true });
     const size = fsSync.statSync(logPath, { throwIfNoEntry: false })?.size ?? 0;
     if (size > LOG_SIZE_CAP_BYTES) {
       fsSync.writeFileSync(logPath, `--- log rotated (exceeded ${LOG_SIZE_CAP_BYTES} bytes) ---
@@ -15573,16 +15951,16 @@ async function writeLastRun(mainRoot, slug, ok, failures) {
     return;
   }
   const record = { slug, finishedAt: (/* @__PURE__ */ new Date()).toISOString(), ok, failures };
-  await fs56.ensureDir(path77.dirname(file));
+  await fs56.ensureDir(path78.dirname(file));
   await fs56.writeJson(file, record, { spaces: 2 }).catch(() => void 0);
 }
 
 // src/workspace/worktree/dematerialize.ts
-import path79 from "node:path";
+import path80 from "node:path";
 import fs58 from "fs-extra";
 
 // src/workspace/worktree/member-targets.ts
-import path78 from "node:path";
+import path79 from "node:path";
 import fs57 from "fs-extra";
 function normalizeStateMembers(state, allMembers) {
   return state?.members.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath })) ?? allMembers.map((m) => ({ id: m.id, folder: m.folder, absPath: m.absPath }));
@@ -15600,7 +15978,7 @@ function resolveMemberTargets(wsWorktreePath, stateMembers, allMembers) {
     targets.push({
       repo: configMember?.id ?? stateMember.id,
       ownerRepo,
-      path: path78.join(wsWorktreePath, stateMember.folder)
+      path: path79.join(wsWorktreePath, stateMember.folder)
     });
   }
   return { targets, unresolvedDroppedMembers };
@@ -15686,7 +16064,7 @@ async function runDematerialize(opts) {
   const removed = [];
   const failed = [];
   for (const folder of unresolvedDroppedMembers) {
-    const droppedPath = path79.join(wsWorktreePath, folder);
+    const droppedPath = path80.join(wsWorktreePath, folder);
     if (await fs58.pathExists(droppedPath)) {
       await fs58.remove(droppedPath);
       failed.push({ repo: folder, error: unresolvedDroppedFailureReason() });
@@ -15702,7 +16080,7 @@ async function runDematerialize(opts) {
 }
 
 // src/workspace/worktree/list.ts
-import path80 from "node:path";
+import path81 from "node:path";
 import fs59 from "fs-extra";
 async function runList2() {
   const resolved = await resolveWorkspaceForWorktree();
@@ -15715,12 +16093,12 @@ async function runList2() {
   const configuredMembers = await readMembers(rootInfo);
   const worktrees = [];
   for (const slug of slugs) {
-    const wtPath = path80.join(dir, slug);
+    const wtPath = path81.join(dir, slug);
     const state = await readWorktreeState(wtPath);
     const members = [];
     const source = state?.members ?? configuredMembers.map((m) => ({ id: m.id, folder: m.folder }));
     for (const m of source) {
-      const memberPath = path80.join(wtPath, m.folder);
+      const memberPath = path81.join(wtPath, m.folder);
       const materialized = await fs59.pathExists(memberPath);
       const actualBranch = materialized ? await currentBranch(memberPath) : void 0;
       members.push({
@@ -15743,17 +16121,17 @@ async function runList2() {
 
 // src/workspace/worktree/reclaim.ts
 import { existsSync as existsSync8 } from "node:fs";
-import path81 from "node:path";
+import path82 from "node:path";
 import fs60 from "fs-extra";
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 async function lastTouchedMs(worktreeRoot) {
-  const candidates = [worktreeRoot, path81.join(worktreeRoot, ".haus-worktree.json")];
+  const candidates = [worktreeRoot, path82.join(worktreeRoot, ".haus-worktree.json")];
   try {
-    const dotGit = await fs60.readFile(path81.join(worktreeRoot, ".git"), "utf8");
+    const dotGit = await fs60.readFile(path82.join(worktreeRoot, ".git"), "utf8");
     const match = /^gitdir:\s*(.+)$/m.exec(dotGit);
     if (match?.[1]) {
       const gitdir = match[1].trim();
-      candidates.push(path81.join(gitdir, "HEAD"), path81.join(gitdir, "index"));
+      candidates.push(path82.join(gitdir, "HEAD"), path82.join(gitdir, "index"));
     }
   } catch {
   }
@@ -15796,17 +16174,17 @@ async function runReclaim(opts = {}) {
   for (const name of unaddressable) {
     candidates.push({
       slug: name,
-      ageDays: (Date.now() - await lastTouchedMs(path81.join(dir, name))) / MS_PER_DAY,
+      ageDays: (Date.now() - await lastTouchedMs(path82.join(dir, name))) / MS_PER_DAY,
       materializedMembers: 0,
       action: "skip",
       reason: "directory name is not a valid worktree slug \u2014 no haus worktree command can address it; remove it by hand if it is debris"
     });
   }
   for (const slug of entries) {
-    const wtPath = path81.join(dir, slug);
+    const wtPath = path82.join(dir, slug);
     const state = await readWorktreeState(wtPath);
     const stateMembers = normalizeStateMembers(state, members);
-    const materialized = stateMembers.filter((m) => existsSync8(path81.join(wtPath, m.folder)));
+    const materialized = stateMembers.filter((m) => existsSync8(path82.join(wtPath, m.folder)));
     const ageDays = (Date.now() - await lastTouchedMs(wtPath)) / MS_PER_DAY;
     const base = { slug, ageDays, materializedMembers: materialized.length };
     if (slug === currentSlug) {
@@ -16403,7 +16781,7 @@ async function runWorktree(action, opts = {}) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync12, statSync as statSync3 } from "node:fs";
-import path90 from "node:path";
+import path91 from "node:path";
 init_fs();
 init_logger();
 
@@ -16462,7 +16840,7 @@ ${summaries.map(
 
 // src/commands/workspace/doctor.ts
 import { existsSync as existsSync9 } from "node:fs";
-import path83 from "node:path";
+import path84 from "node:path";
 init_logger();
 init_paths();
 
@@ -16470,14 +16848,14 @@ init_paths();
 init_fs();
 init_paths();
 import { readFileSync as readFileSync4 } from "node:fs";
-import path82 from "node:path";
+import path83 from "node:path";
 var MANIFEST_FILE2 = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE2);
 }
 function hausVersion() {
   try {
-    const pkg = JSON.parse(readFileSync4(path82.join(packageRoot(), "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync4(path83.join(packageRoot(), "package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
@@ -16569,7 +16947,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
   const manifestByName = new Map(manifest.repos.map((r) => [r.name, r]));
   const catalogRefByRepo = [];
   for (const repo of config.repos) {
-    const repoRoot = path83.resolve(workspaceRoot, repo.path);
+    const repoRoot = path84.resolve(workspaceRoot, repo.path);
     const entry = manifestByName.get(repo.name);
     if (!entry) {
       flag({
@@ -16642,7 +17020,7 @@ async function runWorkspaceDoctor(workspaceRoot, opts = {}) {
         });
         continue;
       }
-      if (!existsSync9(path83.join(workspaceRoot, entry.path))) {
+      if (!existsSync9(path84.join(workspaceRoot, entry.path))) {
         flag({
           repo: entry.repo,
           kind: "missing-linked-context-copy",
@@ -16688,17 +17066,17 @@ function emit(args) {
 init_logger();
 
 // src/workspace/link-context/link.ts
-import path86 from "node:path";
+import path87 from "node:path";
 import fs64 from "fs-extra";
 init_fs();
 init_logger();
 
 // src/workspace/link-context/plan.ts
-import path85 from "node:path";
+import path86 from "node:path";
 import fs63 from "fs-extra";
 
 // src/workspace/link-context/scan-source.ts
-import path84 from "node:path";
+import path85 from "node:path";
 import fs62 from "fs-extra";
 var ASSET_SUBDIR = {
   skill: "skills",
@@ -16707,36 +17085,36 @@ var ASSET_SUBDIR = {
 };
 async function hasLinkableContext(member) {
   for (const subdir of Object.values(ASSET_SUBDIR)) {
-    if (await fs62.pathExists(path84.join(member.absPath, ".claude", subdir))) return true;
+    if (await fs62.pathExists(path85.join(member.absPath, ".claude", subdir))) return true;
   }
   return false;
 }
 async function collectSkills(member) {
-  const dir = path84.join(member.absPath, ".claude", "skills");
+  const dir = path85.join(member.absPath, ".claude", "skills");
   if (!await fs62.pathExists(dir)) return [];
   const names = await fs62.readdir(dir);
   const out = [];
   for (const name of [...names].sort()) {
-    const abs = path84.join(dir, name);
+    const abs = path85.join(dir, name);
     const stat = await fs62.lstat(abs);
     if (!stat.isDirectory()) continue;
-    if (!await fs62.pathExists(path84.join(abs, "SKILL.md"))) continue;
-    out.push({ type: "skill", name, sourceRelPath: path84.posix.join(".claude", "skills", name) });
+    if (!await fs62.pathExists(path85.join(abs, "SKILL.md"))) continue;
+    out.push({ type: "skill", name, sourceRelPath: path85.posix.join(".claude", "skills", name) });
   }
   return out;
 }
 async function collectFlatMarkdown(member, type) {
   const subdir = ASSET_SUBDIR[type];
-  const dir = path84.join(member.absPath, ".claude", subdir);
+  const dir = path85.join(member.absPath, ".claude", subdir);
   if (!await fs62.pathExists(dir)) return [];
   const names = await fs62.readdir(dir);
   const out = [];
   for (const fileName of [...names].sort()) {
     if (!fileName.endsWith(".md")) continue;
-    const abs = path84.join(dir, fileName);
+    const abs = path85.join(dir, fileName);
     if (!(await fs62.lstat(abs)).isFile()) continue;
     const name = fileName.slice(0, -".md".length);
-    out.push({ type, name, sourceRelPath: path84.posix.join(".claude", subdir, fileName) });
+    out.push({ type, name, sourceRelPath: path85.posix.join(".claude", subdir, fileName) });
   }
   return out;
 }
@@ -16751,9 +17129,9 @@ async function collectSourceAssets(member) {
 
 // src/workspace/link-context/plan.ts
 function repoFolderPrefix(member) {
-  const base = path85.posix.basename(member.folder);
+  const base = path86.posix.basename(member.folder);
   if (base && base !== "." && base !== "/") return base;
-  const fromAbs = path85.basename(member.absPath);
+  const fromAbs = path86.basename(member.absPath);
   return fromAbs || member.id;
 }
 function assetKey(type, destKey) {
@@ -16810,7 +17188,7 @@ async function buildLinkPlan(members) {
       name: asset.name,
       destKey,
       sourceRelPath: asset.sourceRelPath,
-      sourceAbsPath: path85.join(member.absPath, asset.sourceRelPath),
+      sourceAbsPath: path86.join(member.absPath, asset.sourceRelPath),
       sourceHash
     });
   }
@@ -16821,7 +17199,7 @@ async function buildLinkPlan(members) {
 function destRelPathFor(type, destKey) {
   const subdir = `${type}s`;
   const leaf = type === "skill" ? destKey : `${destKey}.md`;
-  return path86.posix.join(".claude", subdir, leaf);
+  return path87.posix.join(".claude", subdir, leaf);
 }
 async function runLinkContext(workspaceRoot, opts = {}) {
   const write = resolveWriteMode(opts, "preview-by-default").kind === "write";
@@ -16847,9 +17225,9 @@ async function runLinkContext(workspaceRoot, opts = {}) {
   const linkedAt = (/* @__PURE__ */ new Date()).toISOString();
   for (const entry of plan.entries) {
     const destRel = destRelPathFor(entry.type, entry.destKey);
-    const destAbs = path86.join(workspaceRoot, destRel);
+    const destAbs = path87.join(workspaceRoot, destRel);
     if (write) {
-      await fs64.ensureDir(path86.dirname(destAbs));
+      await fs64.ensureDir(path87.dirname(destAbs));
       if (await fs64.pathExists(destAbs)) await fs64.remove(destAbs);
       await fs64.copy(entry.sourceAbsPath, destAbs, {
         overwrite: true,
@@ -16938,10 +17316,10 @@ async function runWorkspaceLinkContext(workspaceRoot, opts = {}) {
 
 // src/commands/workspace/setup.ts
 import { existsSync as existsSync10, statSync } from "node:fs";
-import path88 from "node:path";
+import path89 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path87 from "node:path";
+import path88 from "node:path";
 import fs65 from "fs-extra";
 init_fs();
 init_logger();
@@ -16967,7 +17345,7 @@ ${WORKSPACE_BLOCK_END}`;
 async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
   const block = buildWorkspaceImportBlock(opts.client, opts.members);
   const dryRun = opts.dryRun ?? false;
-  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path87.join(workspaceRoot, "CLAUDE.md");
+  const filePath = opts.collision ? hausPath(workspaceRoot, "WORKSPACE.md") : path88.join(workspaceRoot, "CLAUDE.md");
   const say = opts.quiet ? () => {
   } : log;
   const existed = await fs65.pathExists(filePath);
@@ -17000,20 +17378,20 @@ async function writeWorkspaceClaudeMd(workspaceRoot, opts) {
 init_fs();
 init_logger();
 function resolveWorkspaceRoot(start = process.cwd()) {
-  let dir = path88.resolve(start);
+  let dir = path89.resolve(start);
   for (; ; ) {
-    if (existsSync10(path88.join(dir, WORKSPACE_FILE))) return dir;
-    const parent = path88.dirname(dir);
-    if (parent === dir) return path88.resolve(start);
+    if (existsSync10(path89.join(dir, WORKSPACE_FILE))) return dir;
+    const parent = path89.dirname(dir);
+    if (parent === dir) return path89.resolve(start);
     dir = parent;
   }
 }
 function isRootRepo(workspaceRoot, repoPath) {
-  return path88.resolve(workspaceRoot, repoPath) === path88.resolve(workspaceRoot);
+  return path89.resolve(workspaceRoot, repoPath) === path89.resolve(workspaceRoot);
 }
 async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const apply = options.write ?? false;
-  const configText = await readText(path88.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path89.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -17040,7 +17418,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
   const statuses = [];
   const aggregateInputs = [];
   for (const repo of repos) {
-    const repoRoot = path88.resolve(workspaceRoot, repo.path);
+    const repoRoot = path89.resolve(workspaceRoot, repo.path);
     say(`
 \u2192 ${repo.name} (${repo.path})`);
     let res;
@@ -17054,7 +17432,12 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
         // Under --json, mute the inner pipeline entirely; we serialize the
         // aggregated result below. Otherwise let it print its normal human output.
         quiet: options.json,
-        allowEmptyCache: options.allowEmptyCache
+        allowEmptyCache: options.allowEmptyCache,
+        // A workspace run sets a member up under whatever profile the member already
+        // declares (ADR-0125). Passing it explicitly is what keeps the PoC rail in
+        // runSetupCore from firing here: the rail exists for a deliberate `haus init`,
+        // not for a bulk pass that never meant to switch anyone's profile.
+        profile: await readProjectProfile(repoRoot)
       });
     } catch (err) {
       const message2 = err instanceof Error ? err.message : String(err);
@@ -17156,7 +17539,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
       const status = statusByName.get(repo.name);
       const role = repo.role ?? status?.roles?.[0] ?? "auto";
       if (status?.status === "ok") {
-        const lock = await checkLock(path88.resolve(workspaceRoot, repo.path));
+        const lock = await checkLock(path89.resolve(workspaceRoot, repo.path));
         manifestRepos.push({
           name: repo.name,
           path: repo.path,
@@ -17212,7 +17595,7 @@ async function runWorkspaceSetup(workspaceRoot, options = {}) {
     try {
       const linkResult = await runLinkContext(workspaceRoot, { write: true, json: options.json });
       if (linkResult.ok) {
-        written.push(...linkResult.added.map((rel) => path88.join(workspaceRoot, rel)));
+        written.push(...linkResult.added.map((rel) => path89.join(workspaceRoot, rel)));
         if (!options.json) {
           say(
             `Linked ${linkResult.linked.length} cross-repo skill/agent/command copy(ies) into .claude/ (${linkResult.added.length} new, ${linkResult.removed.length} removed)${linkResult.skipped.length > 0 ? ` \u2014 ${linkResult.skipped.length} member(s) skipped, see above` : ""}.`
@@ -17245,7 +17628,7 @@ Workspace setup complete: ${ok} ok, ${failed} failed. Wrote ${written.length} fi
 
 // src/commands/workspace/undo.ts
 import { existsSync as existsSync11, statSync as statSync2 } from "node:fs";
-import path89 from "node:path";
+import path90 from "node:path";
 import fs66 from "fs-extra";
 init_fs();
 init_logger();
@@ -17276,7 +17659,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   if (options.dryRun) {
     for (const repo of config.repos) {
-      const repoRoot = path89.resolve(workspaceRoot, repo.path);
+      const repoRoot = path90.resolve(workspaceRoot, repo.path);
       log(`
 \u2192 ${repo.name} (${repo.path})`);
       try {
@@ -17308,11 +17691,11 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     ];
     for (const abs of workspaceArtifacts) {
       if (await fs66.pathExists(abs)) {
-        log(`[dry-run] Would remove ${path89.relative(workspaceRoot, abs)}`);
+        log(`[dry-run] Would remove ${path90.relative(workspaceRoot, abs)}`);
       }
     }
     if (!await fs66.pathExists(hausPath(workspaceRoot, "WORKSPACE.md"))) {
-      const claudeMd = await readText(path89.join(workspaceRoot, "CLAUDE.md"));
+      const claudeMd = await readText(path90.join(workspaceRoot, "CLAUDE.md"));
       if (claudeMd?.includes(WORKSPACE_BLOCK_BEGIN) || claudeMd && hasLegacyWorkspaceBlock(claudeMd)) {
         log("[dry-run] Would remove the workspace haus import block from CLAUDE.md");
       }
@@ -17331,7 +17714,7 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
   }
   let anyRepoFailed = false;
   for (const repo of config.repos) {
-    const repoRoot = path89.resolve(workspaceRoot, repo.path);
+    const repoRoot = path90.resolve(workspaceRoot, repo.path);
     log(`
 \u2192 ${repo.name} (${repo.path})`);
     try {
@@ -17360,20 +17743,20 @@ async function runWorkspaceUndo(workspaceRoot, options = {}) {
     const abs = hausPath(workspaceRoot, rel);
     if (await fs66.pathExists(abs)) {
       await fs66.remove(abs);
-      log(`Removed ${path89.relative(workspaceRoot, abs)}`);
+      log(`Removed ${path90.relative(workspaceRoot, abs)}`);
     }
   }
   const manifestFile = manifestPath(workspaceRoot);
   if (await fs66.pathExists(manifestFile)) {
     await fs66.remove(manifestFile);
-    log(`Removed ${path89.relative(workspaceRoot, manifestFile)}`);
+    log(`Removed ${path90.relative(workspaceRoot, manifestFile)}`);
   }
   const workspaceMdPath = hausPath(workspaceRoot, "WORKSPACE.md");
   if (await fs66.pathExists(workspaceMdPath)) {
     await fs66.remove(workspaceMdPath);
-    log(`Removed ${path89.relative(workspaceRoot, workspaceMdPath)}`);
+    log(`Removed ${path90.relative(workspaceRoot, workspaceMdPath)}`);
   } else {
-    const claudeMdPath = path89.join(workspaceRoot, "CLAUDE.md");
+    const claudeMdPath = path90.join(workspaceRoot, "CLAUDE.md");
     if (existsSync11(claudeMdPath)) {
       const prev = await readText(claudeMdPath);
       if (prev?.includes(WORKSPACE_BLOCK_BEGIN)) {
@@ -17442,7 +17825,7 @@ relationships: []
   log("Workspace initialized.");
 }
 async function scanWorkspace(workspaceRoot, opts) {
-  const configText = await readText(path90.join(workspaceRoot, WORKSPACE_FILE));
+  const configText = await readText(path91.join(workspaceRoot, WORKSPACE_FILE));
   if (!configText) {
     error(`Missing ${WORKSPACE_FILE}. Run \`haus workspace discover\` or \`init\` first.`);
     process.exitCode = 1;
@@ -17464,7 +17847,7 @@ async function scanWorkspace(workspaceRoot, opts) {
   const inputs = [];
   const failures = [];
   for (const repo of config.repos) {
-    const repoRoot = path90.resolve(workspaceRoot, repo.path);
+    const repoRoot = path91.resolve(workspaceRoot, repo.path);
     try {
       if (!existsSync12(repoRoot) || !statSync3(repoRoot).isDirectory()) {
         throw new Error("path is not a directory");
@@ -17533,7 +17916,7 @@ init_logger();
 init_paths();
 function cliVersion() {
   try {
-    const pkgPath = path91.join(packageRoot(), "package.json");
+    const pkgPath = path92.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -17543,7 +17926,7 @@ function cliVersion() {
 var program = new Command();
 function validateRuntimeNodeVersion() {
   try {
-    const pkgPath = path91.join(packageRoot(), "package.json");
+    const pkgPath = path92.join(packageRoot(), "package.json");
     const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
     const requiredRange = pkg.engines?.node;
     if (requiredRange && !satisfiesVersion(process.version, requiredRange)) {
@@ -17616,10 +17999,16 @@ program.command("init").description("Full setup: scan, recommend, and optionally
 ).option(
   "--allow-empty-cache",
   "Proceed when no catalog item has installable content: write core files and skip the catalog items. Still exits 1 if none installed (ADR-0060)"
+).option(
+  "--profile <profile>",
+  "Project profile to record when writing: production (default) | poc. Stored in .haus-workflow/haus.config.json (ADR-0125)"
 ).action(runInit);
 program.command("new").description("Create a new project from an allowed Haus stack, push it to GitHub, and run init").argument("[stack]", "Stack id (omit to pick interactively; see --list)").argument("[name]", "Project directory and repo name").option("--list", "Print the allowed stacks and exit").option("--org <org>", "GitHub org to create the repo in (default: personal account)").option("--public", "Create the GitHub repo public").option("--private", "Create the GitHub repo private (default)").option("--no-github", "Skip GitHub repo creation and push").option("--pm <pm>", "Package manager: yarn | npm | pnpm", "yarn").option("--dir <path>", "Directory to scaffold the project into (default: the cwd)").option("-y, --yes", "Skip confirmations (non-interactive)").option("--dry-run", "Print the full plan without executing anything").option("--json", "Emit a machine-readable result document").option(
   "--allow-empty-cache",
   "Proceed when no catalog item has installable content: write core files and skip the catalog items. Still exits 1 if none installed (ADR-0060)"
+).option(
+  "--profile <profile>",
+  "Project profile to record when writing: production (default) | poc. Stored in .haus-workflow/haus.config.json (ADR-0125)"
 ).action(runNew);
 program.command("clone").description("Clone a single git repository by URL").argument("<url>", "Git URL to clone").argument("[dir]", "Target directory (default: repo name derived from the URL)").option("--dry-run", "Print what would happen without cloning").action(
   (url, dir, opts) => runClone(url, { dir, dryRun: opts.dryRun })