@ikon85/agent-workflow-kit 0.38.0 → 0.39.0

package/.claude/skills/setup-workflow/SKILL.md

@@ -216,6 +216,15 @@ Worktree Lifecycle for this repository?"* Offer exactly **Yes**, **Later**, and
 - **Disable** — remove only the exact kit-owned hook commands first, then set
   `enabled: false`; retain the profile, setup policy, and unknown keys.
 
+Whenever a profile already carries patterns — on **Yes** over an existing
+section and on **Existing** — run
+`python3 scripts/profile_globs.py docs/agents/workflow-capabilities.json` and
+report every pattern it names. Patterns whose match set narrows or widens under
+the shared dialect are a consumer decision: name them with their witness path,
+mark the deletion-authority keys, and let the consumer rewrite them. Never
+rewrite a pattern for them, and never accept a widened deletion-authority
+pattern silently.
+
 The default setup entry is
 `python3 scripts/worktree-lifecycle/setup.py`; a proven consumer-native helper
 may remain the configured `setupEntry` for parity. The handoff advisory always
@@ -273,6 +282,12 @@ repository?"* Offer exactly **Yes**, **Later**, and **No**.
 - **Disable** — remove exact kit-owned commands first, then set `enabled:
   false`; preserve every profile value and unknown key.
 
+`baseline.sourceGlobs` and the `preRefactor`/`stopChecks` surface globs use the
+same shared dialect as the Worktree Lifecycle patterns above. An adopted
+profile written for the older whole-string matcher can change meaning, so run
+`python3 scripts/profile_globs.py docs/agents/workflow-capabilities.json` and
+report every pattern it names before treating the section as reconciled.
+
 ### 2f. Section A7 — Optional Safety Guardrails
 
 > Safety Guardrails is a counted group of seven independently selectable
@@ -411,13 +426,29 @@ Seed `docs/agents/domain.md` from [domain.md](./domain.md).
 
 **Skip entirely if Section A is not GitHub** → write `board-sync.md` with `state=not-applicable`, `mode=none`, a one-line "this project does not use a GitHub-Projects board" note. Terminal; never re-prompts.
 
-**Preflight:** `gh auth status`. If `project`/`read:project` scope is missing, surface the exact remedy: `gh auth refresh -s project,read:project`, then fall through to the stub path below.
+**Preflight:** `gh auth status` (or `python3 scripts/board_bootstrap.py preflight --json` for the machine-readable answer). If `project`/`read:project` scope is missing, surface the exact remedy: `gh auth refresh -s project,read:project`, then fall through to the stub path below — without the write scope, never attempt creation.
 
-**Discover (the success path):** `gh project list --owner <remote-owner> --format json`. If **exactly one** project clearly belongs to this repo's owner, read its fields: `gh project field-list <number> --owner <owner> --format json`. Record each field's `id`, `name`, `dataType` (single-select / number / text), and for single-selects the option `id`s. Write `board-sync.md` with `state=filled`, `mode=github-projects-v2`, the project node id + repo + the discovered field/option IDs, seeded from [board-sync.md](./board-sync.md). Fill the `<!-- board-sync:profile -->` **JSON block** (the machine SSOT `scripts/board_config.py` parses) — replace each `<…>` placeholder under `repo`/`project`/`fields` with the discovered value; leave the convention values (`labels`/`branchPrefixes`/`prMarkers`/`headings`) at their seeded defaults unless this project's conventions differ.
+**Discover (the existing-board path):** `gh project list --owner <remote-owner> --format json`. If **exactly one** project clearly belongs to this repo's owner, read its fields: `gh project field-list <number> --owner <owner> --format json`. Record each field's `id`, `name`, `dataType` (single-select / number / text), and for single-selects the option `id`s. Write `board-sync.md` with `state=filled`, `mode=github-projects-v2`, the project node id + repo + the discovered field/option IDs, seeded from [board-sync.md](./board-sync.md). Fill the `<!-- board-sync:profile -->` **JSON block** (the machine SSOT `scripts/board_config.py` parses) — replace each `<…>` placeholder under `repo`/`project`/`fields` with the discovered value; leave the convention values (`labels`/`branchPrefixes`/`prMarkers`/`headings`) at their seeded defaults unless this project's conventions differ.
 
 **Map the status roles (`fields.status.roles`):** the seeded map carries the recommended English stage names (`Idea/Triaged/Spec/In Progress/Review/Done`). Reconcile it against the **discovered** Status option names: an exact (case-sensitive) match keeps its seeded entry; for every role whose seeded name is NOT among the discovered options, ask the user which of their actual option names plays that role (a stage they don't have may be omitted from the map — say so). Never guess a mapping from similarity. Finish with a validation pass: every role value in the map MUST appear in `fields.status.options`, else fix before writing `state=filled`.
 
-**Fallback (the single catch-all — no board / >1 / ambiguous / scope error / read failure):** do **not** auto-create a board (`gh project create` alone cannot provision the Status options + workflow fields a board needs). Write `board-sync.md` with `state=stub`, `mode=github-projects-v2`, and inline **instructions**: which fields the workflow profile needs (a Status single-select with your stage options; optionally a Wave number, a Cluster text, a Spec-Path / Plan-Path text), how to create the board in the GitHub UI / `gh`, and "then run `/setup-workflow` again — it will discover and fill the IDs." Retryable.
+**Offer creation (no board found, scope present):** a fresh repo can reach a working board in this run — `gh project create` provisions the shell and `gh project field-create --single-select-options` provisions the Status single-select together with its options. Minting a GitHub Project is an outward, user-visible action, so **ask first and never create a board without an explicit yes**. Name the stage options the board will get (the seed's `fields.status.roles` values) in the question, and edit those role values in the seed *before* creating if the user wants a different stage vocabulary — they become the board's Status options verbatim. Present exactly two choices:
+
+- **Create it now** — run the one creation path (never hand-assemble the `gh` sequence):
+
+```bash
+python3 scripts/board_bootstrap.py create --owner <owner> --repo <owner>/<repo> \
+  --title "<repo> Workflow" --seed <path of this skill folder>/board-sync.md \
+  --out docs/agents/board-sync.md
+```
+
+  It re-checks the destination and the scope before it writes anything, creates the project, the Status single-select (option names read from the seed profile's `fields.status.roles` — the board's own stage vocabulary, never a literal), and the Wave / Cluster / Spec-Path / Plan-Path fields, then discovers the real field/option IDs via `gh project field-list` and writes `docs/agents/board-sync.md` at `state=filled`, `mode=github-projects-v2` **from that readback**. Show the user `--dry-run` output first if they want to see the exact sequence. Report the created project's number and URL, and that its Status roles now resolve.
+
+- **Not now** — create nothing and take the stub path below unchanged.
+
+**A non-zero exit is a stub, never a partial claim.** The helper writes no profile when the destination is consumer-owned, the scope is missing (exit 3), or creation/readback/validation fails — so a half-created board can never produce a profile claiming fields that do not exist. On any non-zero exit, relay its message (it names the project it created, if any, so the user can finish or delete it), then take the stub path; never hand-write a `state=filled` profile and never retry creation without asking again.
+
+**Fallback (the single catch-all — declined / no board / >1 / ambiguous / scope error / read failure / creation failure):** write `board-sync.md` with `state=stub`, `mode=github-projects-v2`, and inline **instructions**: which fields the workflow profile needs (a Status single-select with your stage options; optionally a Wave number, a Cluster text, a Spec-Path / Plan-Path text), how to create the board in the GitHub UI / `gh`, and "then run `/setup-workflow` again — it will discover and fill the IDs." Retryable.
 
 **Optional — Phase field + saved Views (Program route only):** never
 auto-discovered or auto-created, unlike the fields above — a Phase field's

package/.claude/skills/setup-workflow/board-sync.md

@@ -3,8 +3,8 @@
 How the board-managed workflow skills (`to-prd`, `to-issues`, `board-to-waves`, …) address this project's GitHub-Projects board. A board stores its fields under opaque GraphQL IDs that differ per board, so they are recorded here rather than hardcoded in any skill.
 
 `/setup-workflow` writes this file in one of three states (see the sentinel on the first line):
-- **`state=filled`** — the IDs below were discovered from your board.
-- **`state=stub`** — no single board was found; fill the IDs by creating the board (below) and re-running `/setup-workflow`.
+- **`state=filled`** — the IDs below were discovered from your board (an existing one, or the one `/setup-workflow` offered to create for you).
+- **`state=stub`** — no single board was filled: you declined the creation offer, `gh` lacked the `project` scope, several boards were ambiguous, or creation failed. Create the board (below) and re-run `/setup-workflow`.
 - **`state=not-applicable`** (`mode=none`) — this project does not use a GitHub-Projects board.
 
 ## Board profile — fields the workflow skills use
@@ -106,6 +106,10 @@ their titles unchanged; set it once to match your board's language.
 
 ## If the IDs are not yet filled (stub)
 
+**Let setup create the board.** Ensure `gh` has the scopes (`gh auth refresh -s project,read:project`) and re-run `/setup-workflow`: with no board and the scope present it *offers* to create one. On your yes it runs `scripts/board_bootstrap.py`, which creates the project plus the Status single-select (its options named after the `roles` map below) and the Wave / Cluster / Spec-Path / Plan-Path fields, reads the real IDs back, and rewrites this file at `state=filled`. Nothing is created without that explicit yes, and a failed run leaves this stub in place rather than a half-true profile.
+
+**Or build it by hand:**
+
 1. Create a GitHub-Projects (v2) board for this owner and add the fields above (at minimum a `Status` single-select with your stage options — the recommended stage names are `Idea, Triaged, Spec, In Progress, Review, Done`, matching the seeded `roles` defaults).
 2. Ensure `gh` has the scopes: `gh auth refresh -s project,read:project`.
 3. Re-run `/setup-workflow` — it discovers the board (`gh project field-list`) and fills the IDs here automatically.

package/.claude/skills/setup-workflow/workflow-advisories.md

@@ -74,6 +74,40 @@ key. Consumer values are never normalized on adoption.
 Empty command surfaces are honest inactive defaults. Setup recommends concrete
 project commands from the tools already present, then asks before activating.
 
+## Profile glob dialect
+
+`baseline.sourceGlobs`, `preRefactor.surfaces[].globs`, and
+`stopChecks.surfaces[].globs` are matched by the one shared dialect in
+`scripts/profile_globs.py` — the same matcher Worktree Lifecycle uses for its
+scratch and landing-artifact policies. There is no second matcher and no
+per-capability variant:
+
+- `*` matches any run of characters inside one path segment, never `/`.
+- `?` matches exactly one character inside one path segment.
+- `[seq]` and `[!seq]` are per-segment character classes; `/` is always a
+  separator and never a class member.
+- `**` as a complete segment matches zero or more segments, so a leading `**/`
+  also matches the repository root and `dir/**` also matches `dir` itself.
+- Matching is always case-sensitive, on every host filesystem.
+- A pattern must match the whole repository-relative path.
+
+Thus `src/**` covers `src/a/b.ts`, `**/*.ts` covers both `index.ts` and
+`src/index.ts`, and `*.ts` covers only a root-level file.
+
+A profile written for the older whole-string matcher can therefore change
+meaning. When adopting an existing profile, or after any kit update, review it:
+
+```bash
+python3 scripts/profile_globs.py docs/agents/workflow-capabilities.json
+```
+
+The check names every pattern whose match set narrows or widens, prints the
+concrete witness path that proves the difference, and separately flags patterns
+that only matched case-insensitively on the previous matcher. Exit code 1 means
+at least one pattern needs review. Report the named patterns and let the
+consumer rewrite them; never migrate a pattern automatically. The check reads
+the profile and never edits it.
+
 ## Hook ownership
 
 - PreToolUse on Read:

package/.claude/skills/setup-workflow/worktree-lifecycle.md

@@ -99,11 +99,40 @@ If an existing enabled profile lacks the key, report one actionable setup
 decision and leave the project layer unchanged until the consumer confirms the
 derived list.
 
-Patterns use repository-relative POSIX semantics: `*` stays within one segment,
-while `**` crosses `/`; a leading `**/` also matches the repository root.
+## Profile glob dialect
+
+Every consumer-profile glob in this kit — Worktree Lifecycle and Workflow
+Advisories alike — is matched by the one shared dialect in
+`scripts/profile_globs.py`. There is no second matcher and no per-capability
+variant:
+
+- `*` matches any run of characters inside one path segment, never `/`.
+- `?` matches exactly one character inside one path segment.
+- `[seq]` and `[!seq]` are per-segment character classes; `/` is always a
+  separator and never a class member.
+- `**` as a complete segment matches zero or more segments, so a leading `**/`
+  also matches the repository root and `dir/**` also matches `dir` itself.
+- Matching is always case-sensitive, on every host filesystem.
+- A pattern must match the whole repository-relative path.
+
 Thus `**/__pycache__/**` covers root and nested caches, while `dist-kit/*` does
 not cover `dist-kit/a/b`.
 
+When adopting an existing profile, or after any kit update, review it before
+trusting its patterns:
+
+```bash
+python3 scripts/profile_globs.py docs/agents/workflow-capabilities.json
+```
+
+The check names every pattern whose match set narrows or widens against that
+key's legacy matcher, prints the concrete witness path that proves the
+difference, and marks the keys that carry deletion authority. Exit code 1 means
+at least one pattern needs review. Report the named patterns and let the
+consumer rewrite them; never migrate a pattern automatically and never treat a
+widened deletion-authority pattern as an accepted default. The check reads the
+profile and never edits it.
+
 The shipped read-only inventory is
 `python3 scripts/worktree-lifecycle/cleanup.py sweep`. The same profile powers
 its branch issue extraction and scratch-only cleanup verdicts.

package/.claude/skills/wrapup/SKILL.md

@@ -127,6 +127,30 @@ matching path; classify or move those blockers first. Do not use relinquish for
 an exact unchanged frozen attempt: a normal retry validates that evidence and
 resumes deterministically.
 
+An attempt journaled under the superseded v1 contract is **legacy, not
+corruption**. The STOP says so explicitly and names the same
+`--abandon-unfinished-attempt` archive route; archival stays valid for a v1 and
+a v2 receipt even without a creation baseline or a local main profile, and no
+generated or consumer file is deleted or claimed on that route.
+
+If canonical `origin/main` changed its scratch or generator policy *after* the
+attempt started, the PR can merge and cleanup then STOPs with `worktree cleanup
+policy differs from merged canonical origin/main`. That STOP stays fail-closed
+and names its one supported route out:
+
+```bash
+python3 scripts/wrapup-land.py land --branch "<branch>" --recover-canonical-cleanup
+```
+
+This resumes the teardown of an **already-merged** worktree only. It never reads
+the stale worktree candidate policy: it re-reads the merged canonical policy,
+requires the branch to already be an ancestor of canonical `origin/main`, and
+revalidates each frozen landing identity against that canonical policy before
+the ordinary shared assessment and removal run. Evidence the canonical policy no
+longer names, a changed identity, and any pre-existing or foreign file are hard
+STOPs that delete nothing. Re-running after a successful teardown is a no-op.
+The flag is mutually exclusive with `--abandon-unfinished-attempt`.
+
 ### 6 · Post-merge (agent)
 - **Sibling propagation:** for each `drift_markers` entry in the land report, append the note to the target issue's `vor_bau` section + re-stamp its `plan_revision`. Log-based markers → **write directly, then show what was written where** (mandatory report — visibility moved from a pre-gate into the report, decision 2026-07-06); fallback candidates the user hasn't confirmed yet → confirm first. Program context widens the target set to unbuilt wave-stubs/leaves and the Program-PRD itself — same append-only mechanism. **Exception:** appends to the Program-PRD or unbuilt wave-stubs do **not** re-stamp `plan_revision` — that stays reserved for structural wave-plan edits via the `to-waves` escalation path; a mere drift note must not stale-block published stubs.
 - **Anchor close:** report says `anchor_complete: true` → `gh issue close <anchor> -c "Wave complete — all slices merged via PR #<pr>."` and verify board status Done. The guard keeps anchors away from every auto-close — this verified close is the only close path; without it the anchor stays silently open after the last slice. **Then re-run the upward propagation**: the land-time `program-sync` ran BEFORE this close, so on a wave-completing slice the Wellenplan still shows 🔄 and the Phasen-Gate stays unchecked — after the board shows Done, run `python3 scripts/board-sync.py program-sync <program-prd#>` once more (the report's `program_sync.program` names it; skip when the report says the parent is not a program). Board auto-rules can lag the close (Close→Done race) — verify Done first, that's what the token reads.

package/README.md

@@ -434,6 +434,12 @@ Until the explicit policy is committed, `wrapup-land` fails closed before
 landing instead of assuming that no generated artifact is eligible for
 session-owned cleanup.
 
+You do not have to remember this note. `kit-update` carries a versioned
+registry of required consumer migrations and names any outstanding one in its
+preview and in its terminal report — interactively, under `--yes`, as JSON via
+`update --json`, and in the automated update pull request. It reports the
+decision you still owe; it never writes a cleanup policy for you.
+
 ### 0.33.0 — capability-gated orchestration
 
 `kit-update` reconciles this release for you. These notes matter only if you
@@ -463,6 +469,37 @@ the old way. Decision record:
 
 ## Release notes
 
+### 0.39.0 — self-explaining guards, one glob dialect, a board you can create
+
+Nothing in this release requires a consumer action. `kit-update` reconciles it.
+
+- **`kit-update` tells you what you still owe.** A versioned registry of
+  required consumer migrations is evaluated against your repository and named in
+  the preview and in the terminal report — interactively, under `--yes`, as JSON
+  via `update --json`, and in the automated update pull request. It reports a
+  decision you owe; it never writes a cleanup policy for you.
+- **`setup-workflow` can create the GitHub-Projects board.** When your tracker
+  is GitHub and no board exists, setup now *offers* to provision one — Status
+  with its stage options plus the workflow fields — and writes the board profile
+  from a read-back of what was actually created. It asks first, and a decline
+  leaves the previous stub path byte-unchanged.
+- **One repository-relative glob dialect.** Worktree Lifecycle and Workflow
+  Advisories now match consumer profile globs through the same matcher, so an
+  advisory and a deletion decision can never disagree about which paths a
+  pattern selects. A review command classifies your installed patterns and
+  reports, with a concrete witness path, any whose match set narrows or widens.
+- **A merged worktree is never stranded.** A landing attempt that started before
+  canonical cleanup policy changed now has a supported recovery route, and a
+  landing journal written by the previous contract version is classified as
+  legacy rather than as corruption — with the exact safe command named in the
+  stop. Both routes revalidate frozen evidence against canonical policy and
+  delete strictly less than the ordinary path.
+- **Guards say what happened and where.** A drift-blocked handoff now names the
+  checkout it evaluated (and says so explicitly when your working directory is a
+  sibling worktree of the same repository), a census status reports *what*
+  drifted rather than only *that* something did, and a handoff anchored on an
+  issue link no longer adopts an issue from a foreign repository.
+
 ### 0.38.0
 
 - added: `docs/adr/0007-session-teardown-requires-provenance-bound-ownership.md`

package/agent-workflow-kit.package.json

@@ -1,5 +1,5 @@
 {
-  "kitVersion": "0.38.0",
+  "kitVersion": "0.39.0",
   "files": [
     {
       "path": ".agents/skills/ask-matt/SKILL.md",
@@ -377,7 +377,7 @@
       "ownerSkill": "kit-update",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "ea34bd16072783325c263b4afc4eefc39f0aabdbb53731b84500b46db69ef2c1",
+      "sha256": "15d265be0c2b3b73c32f786644d271fffb4b269cf8e3c624c61296fe838dda9e",
       "mode": 420,
       "origin": "kit"
     },
@@ -587,7 +587,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "928a771ecadd4b199169f20deb79647894fe3c0675973b0b97050cad0b675cc4",
+      "sha256": "c6855a479c030f93be30f6fb65b36b8ca317251f9627fd3f6f0f994d9a8b64fb",
       "mode": 420,
       "origin": "kit"
     },
@@ -687,7 +687,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "a5733b71f9257f0999c866bfdea551aedf4b9066572bd484fc263440cb292ca6",
+      "sha256": "4ef2a06e17e08f0fc0c5cc09e4414af67a186a73ca7634e8c378aab5b5638274",
       "mode": 420,
       "origin": "kit"
     },
@@ -737,7 +737,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "81ce0f5573d5f062adbc87149172e74ab322315bf348025c0ff2c27f8d8ec67b",
+      "sha256": "6ff4ad3980f0802b3b041e051d86fb4df7a65884c7ded98ff878e2cd584d80f1",
       "mode": 420,
       "origin": "kit"
     },
@@ -757,7 +757,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "e53e6b37bdfdfb0014e2e7ad8fe84cfc2af302eb1a9c6e9e682b1eec05036f1e",
+      "sha256": "bf68e0a80b212159f6838bc2bcd3e85714a70cceeff55ed019f87246175182e7",
       "mode": 420,
       "origin": "kit"
     },
@@ -997,7 +997,7 @@
       "ownerSkill": "wrapup",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "2f84b787b81b6f63ebda996a648a6a32c0c79c5894d6471f84250c0f2a24a2c3",
+      "sha256": "de5d451d23b019498104bd8e0ebcbf3385f37aad822496bdb0c47d7021de8761",
       "mode": 420,
       "origin": "kit"
     },
@@ -1087,7 +1087,7 @@
       "path": ".claude/hooks/drift-guard.py",
       "kind": "hook",
       "installRole": "consumer",
-      "sha256": "a248eb3697522b8804fd7d68d1fe3e95613a71829464501c8c7fa4c09d229a64",
+      "sha256": "1480bd322d988a546ed589a2420796b38bbf0f52300598a1dd9aa9ddbeb3ea1d",
       "mode": 493,
       "origin": "kit"
     },
@@ -1699,7 +1699,7 @@
       "ownerSkill": "kit-update",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "ea34bd16072783325c263b4afc4eefc39f0aabdbb53731b84500b46db69ef2c1",
+      "sha256": "15d265be0c2b3b73c32f786644d271fffb4b269cf8e3c624c61296fe838dda9e",
       "mode": 420,
       "origin": "kit"
     },
@@ -1929,7 +1929,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "928a771ecadd4b199169f20deb79647894fe3c0675973b0b97050cad0b675cc4",
+      "sha256": "c6855a479c030f93be30f6fb65b36b8ca317251f9627fd3f6f0f994d9a8b64fb",
       "mode": 420,
       "origin": "kit"
     },
@@ -2029,7 +2029,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "a5733b71f9257f0999c866bfdea551aedf4b9066572bd484fc263440cb292ca6",
+      "sha256": "4ef2a06e17e08f0fc0c5cc09e4414af67a186a73ca7634e8c378aab5b5638274",
       "mode": 420,
       "origin": "kit"
     },
@@ -2079,7 +2079,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "81ce0f5573d5f062adbc87149172e74ab322315bf348025c0ff2c27f8d8ec67b",
+      "sha256": "6ff4ad3980f0802b3b041e051d86fb4df7a65884c7ded98ff878e2cd584d80f1",
       "mode": 420,
       "origin": "kit"
     },
@@ -2099,7 +2099,7 @@
       "ownerSkill": "setup-workflow",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "e53e6b37bdfdfb0014e2e7ad8fe84cfc2af302eb1a9c6e9e682b1eec05036f1e",
+      "sha256": "bf68e0a80b212159f6838bc2bcd3e85714a70cceeff55ed019f87246175182e7",
       "mode": 420,
       "origin": "kit"
     },
@@ -2347,7 +2347,7 @@
       "ownerSkill": "wrapup",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "2f84b787b81b6f63ebda996a648a6a32c0c79c5894d6471f84250c0f2a24a2c3",
+      "sha256": "de5d451d23b019498104bd8e0ebcbf3385f37aad822496bdb0c47d7021de8761",
       "mode": 420,
       "origin": "kit"
     },
@@ -2431,6 +2431,14 @@
       "mode": 420,
       "origin": "kit"
     },
+    {
+      "path": "scripts/board_bootstrap.py",
+      "kind": "script",
+      "installRole": "consumer",
+      "sha256": "52f4bc89fb078bb9a8735481488bc60d2be438c5c8175555195ac84775e40bfb",
+      "mode": 493,
+      "origin": "kit"
+    },
     {
       "path": "scripts/board_config.py",
       "kind": "script",
@@ -2555,7 +2563,7 @@
       "path": "scripts/kit-update-pr.mjs",
       "kind": "script",
       "installRole": "consumer",
-      "sha256": "c28bbd5a45583a92eca12758c1d626e04bce820300178b54933340759d1690fd",
+      "sha256": "17084eede8601d7cf7dd9da85f7738d618111797933a362c93627058fbd335d4",
       "mode": 493,
       "origin": "kit"
     },
@@ -2623,6 +2631,14 @@
       "mode": 493,
       "origin": "kit"
     },
+    {
+      "path": "scripts/profile_globs.py",
+      "kind": "script",
+      "installRole": "consumer",
+      "sha256": "dd11f6e2513eb43813242ace8f4ea00e10b0fa33f4e13fd125afa4a654d61eff",
+      "mode": 493,
+      "origin": "kit"
+    },
     {
       "path": "scripts/program_graph_parse.py",
       "kind": "script",
@@ -2771,7 +2787,7 @@
       "path": "scripts/workflow-advisories/core.py",
       "kind": "script",
       "installRole": "consumer",
-      "sha256": "75b8d8b781344c54edf9f83c6976a999c10ceea6904af765c7179161e82d3bd6",
+      "sha256": "fcc13d24944a9b1534529e62cc1437617e394f6fe3402647c17cee4ea96aade5",
       "mode": 420,
       "origin": "kit"
     },
@@ -2795,7 +2811,7 @@
       "path": "scripts/worktree-lifecycle/core.py",
       "kind": "script",
       "installRole": "consumer",
-      "sha256": "a869ecc4646fc3493b883521594c3976e53b9b896d1361c87e1085adea10052c",
+      "sha256": "50c60de1e0238fa1f5cd627f67e57ca4f378275136691411487f36d7fda580dd",
       "mode": 420,
       "origin": "kit"
     },
@@ -2811,7 +2827,7 @@
       "path": "scripts/worktree-lifecycle/README.md",
       "kind": "doc",
       "installRole": "consumer",
-      "sha256": "55c62d00f84e5a1e008d059dc1aad2e026f35dab25437e5cb3c53b717d621a06",
+      "sha256": "91cfa8ebb74872ccec1160c0a7b28edcfacea3217900805034dca0f0c8f39c05",
       "mode": 420,
       "origin": "kit"
     },
@@ -2835,7 +2851,7 @@
       "path": "scripts/wrapup-land.py",
       "kind": "script",
       "installRole": "consumer",
-      "sha256": "f92779efab05fb17447abf47b8aec3fab6a501eff8e11735c245e5f615f9e460",
+      "sha256": "476012558bb786070ce47458c6f0734ff110d5d957af72e13b20d49a37a03592",
       "mode": 493,
       "origin": "kit"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikon85/agent-workflow-kit",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.",
   "type": "module",
   "bin": {