@ionivetech/mugiwara 0.8.2 → 0.9.1

package/.claude-plugin/marketplace.json

@@ -5,13 +5,13 @@
   },
   "metadata": {
     "description": "The Straw Hat crew for AI agents",
-    "version": "0.8.2"
+    "version": "0.9.1"
   },
   "plugins": [
     {
       "name": "mugiwara",
       "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
-      "version": "0.8.2",
+      "version": "0.9.1",
       "source": "./"
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mugiwara",
   "displayName": "Mugiwara",
-  "version": "0.8.2",
+  "version": "0.9.1",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
   "author": {
     "name": "ionivetech"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mugiwara",
-  "version": "0.8.2",
+  "version": "0.9.1",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
   "author": {
     "name": "ionivetech"

package/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "mugiwara",
   "displayName": "Mugiwara",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
-  "version": "0.8.2",
+  "version": "0.9.1",
   "author": {
     "name": "ionivetech"
   },

package/.kimi-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mugiwara",
-  "version": "0.8.2",
+  "version": "0.9.1",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
   "author": {
     "name": "ionivetech"

package/.opencode/mugiwara-helpers.mjs

@@ -93,7 +93,7 @@ export const DEFAULT_CONFIG_LINES = [
   'mode=guided',
   'branch=feature/{type}-{issue}-{slug}',
   'commit=conventional',
-  'auto_commit=on',
+  'auto_commit=off',
   'coverage_new=85',
   'coverage_modified=90',
   'review_depth=full',

package/.opencode/plugins/mugiwara.mjs

@@ -17,7 +17,8 @@
 // or from the git repo:
 //   { "plugin": ["mugiwara@git+https://github.com/ionivetech/mugiwara.git"] }
 
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { readMode, parseModeChange, applyModeChange, ensureDefaultConfig } from '../mugiwara-helpers.mjs';
@@ -135,6 +136,144 @@ function readAgents(stepsEnabled = true) {
   return agents;
 }
 
+// Enforcement mirrors (E5, Stage B). The FORBIDDEN table is a copy of
+// src/guards.ts between the GUARDS-TABLE markers — plugin.test.ts asserts the
+// two blocks are byte-identical, so edit the source, never just this copy.
+// The tool hook surface is binary (throw = deny): enforce=warn degrades to
+// allow here, documented in docs/reference/harness-matrix.md.
+
+const FORBIDDEN = [
+// GUARDS-TABLE-START
+  [/\bgh\s+pr\s+(create|merge|ready)\b/, 'opening or merging a PR'],
+  [/\bgh\s+release\s+create\b/, 'creating a release'],
+  [/\bgit\s+merge\b/, 'merging a branch'],
+  [/\bgit\s+push\b[^|;&]*\b(main|master|production|release)\b/, 'pushing to a protected branch'],
+  [/\bgit\s+push\b[^|;&]*--force/, 'force-pushing'],
+  [/\bnpm\s+publish\b|\byarn\s+publish\b|\bpnpm\s+publish\b/, 'publishing a package'],
+  [/\bkubectl\s+(apply|delete|rollout)\b/, 'changing a cluster'],
+  [/\bterraform\s+(apply|destroy)\b/, 'changing infrastructure'],
+  [/\bdocker\s+push\b/, 'pushing an image'],
+  [/\baws\s+\w+\s+(create|delete|update|put)\b/, 'changing cloud resources'],
+// GUARDS-TABLE-END
+];
+
+function checkCommand(command) {
+  for (const [re, action] of FORBIDDEN) {
+    if (re.test(command)) return action;
+  }
+  return null;
+}
+
+function refusalMessage(action) {
+  return (
+    `Mugiwara: refusing to ${action}. The crew never creates a PR, merges, or ` +
+    `deploys — the human does, from the branch and the verdict the crew hands over. ` +
+    `Run it yourself, or set enforce=off in .mugiwara/config.`
+  );
+}
+
+function readEnforce(cwd) {
+  for (const base of [cwd, process.env.HOME || '']) {
+    if (!base) continue;
+    const file = join(base, '.mugiwara', 'config');
+    if (!existsSync(file)) continue;
+    for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
+      const [k, v] = line.split('=').map((s) => s.trim());
+      if (k !== 'enforce') continue;
+      if (v === 'off' || v === 'warn' || v === 'block') return v;
+      return 'block';
+    }
+  }
+  return 'block';
+}
+
+function markEngaged(cwd) {
+  try {
+    const dir = join(cwd, '.mugiwara');
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, '.engaged');
+    let firstSeen = new Date().toISOString();
+    try {
+      const prev = JSON.parse(readFileSync(file, 'utf8'));
+      if (prev && typeof prev.first_seen === 'string') firstSeen = prev.first_seen;
+    } catch { /* fresh marker */ }
+    writeFileSync(file, JSON.stringify({ first_seen: firstSeen, touched_at: new Date().toISOString() }, null, 2) + '\n');
+  } catch { /* fail open — no marker, no policing */ }
+}
+
+// Git working tree changed outside .mugiwara/, or null when git is unreadable
+// (no opinion — the caller treats null as "cannot tell", never as clean).
+function gitSourceChanged(cwd) {
+  try {
+    const out = execFileSync('git', ['status', '--porcelain'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    return out.split(/\r?\n/).map((l) => l.slice(3).trim()).filter(Boolean).some((p) => !p.startsWith('.mugiwara/'));
+  } catch { return null; }
+}
+
+function markerStart(cwd) {
+  try {
+    const marker = JSON.parse(readFileSync(join(cwd, '.mugiwara', '.engaged'), 'utf8'));
+    return Date.parse(marker.first_seen ?? '') || Date.parse(marker.touched_at ?? '') || 0;
+  } catch { return 0; }
+}
+
+function artifactWorkSince(cwd, start) {
+  try {
+    const stack = ['missions', 'spec', 'plans'].map((s) => join(cwd, '.mugiwara', s)).filter((p) => existsSync(p));
+    while (stack.length) {
+      const cur = stack.pop();
+      for (const e of readdirSync(cur, { withFileTypes: true })) {
+        const full = join(cur, e.name);
+        try {
+          // Symlinks never resolve: a dirent symlink reports isDirectory()
+          // false, so the symlink check must come first, not nested inside.
+          if (e.isSymbolicLink()) continue;
+          if (e.isDirectory()) { stack.push(full); continue; }
+          if (statSync(full).mtimeMs + 1000 >= start) return true;
+        } catch { /* skip */ }
+      }
+    }
+  } catch { /* no artifact opinion */ }
+  return false;
+}
+
+function triageOnDisk(cwd) {
+  const base = join(cwd, '.mugiwara', 'missions');
+  if (!existsSync(base)) return false;
+  for (const e of readdirSync(base, { withFileTypes: true })) {
+    if (!e.isDirectory()) continue;
+    for (const f of readdirSync(join(base, e.name))) {
+      const stem = f.replace(/\.json$/, '');
+      if (!f.endsWith('.json') || stem === 'continue' || stem.startsWith('continue-')) continue;
+      try {
+        const s = JSON.parse(readFileSync(join(base, e.name, f), 'utf8'));
+        if (s && typeof s.mission === 'string' && s.mission) return true;
+      } catch { /* corrupt savepoint is not triage */ }
+    }
+  }
+  return false;
+}
+
+// Check-1 port: engaged + (source or artifact work) + no triage on disk.
+// Crisp on-disk facts only, mirroring hooks/pipeline-guard.ts. Fail open:
+// any error returns null (no opinion), never a false accusation.
+function sessionWorkNoTriage(cwd) {
+  try {
+    if (readEnforce(cwd) === 'off') return null;
+    if (!existsSync(join(cwd, '.mugiwara', '.engaged'))) return null;
+    const source = gitSourceChanged(cwd);
+    if (source === null) return null;
+    const start = markerStart(cwd);
+    const artifacts = start ? artifactWorkSince(cwd, start) : false;
+    if (!source && !artifacts) return null;
+    if (triageOnDisk(cwd)) return null;
+    return (
+      'Mugiwara: this session did work (source and/or .mugiwara artifacts) but no ' +
+      'Flow 0 triage is on disk. Run Flow 0 (classify, size the lane, write the decision log).'
+    );
+  } catch { return null; }
+}
+
 export default async () => ({
   dispose: () => {},
 
@@ -170,4 +309,37 @@ export default async () => ({
       }
     }
   },
+
+  'tool.execute.before': async (input, output) => {
+    // E4 port: refuse irreversible bash commands before they run (throw =
+    // deny). Engagement for the session-end check is recorded here too: any
+    // tool call mentioning the crew marks the session engaged.
+    try {
+      const cwd = process.cwd();
+      let shape = '';
+      try { shape = JSON.stringify(input); } catch { /* unshaped — skip marking */ }
+      if (shape.toLowerCase().includes('mugiwara')) markEngaged(cwd);
+      if (input && input.tool === 'bash') {
+        const command = output && output.args && typeof output.args.command === 'string' ? output.args.command : '';
+        const action = checkCommand(command);
+        if (action && readEnforce(cwd) === 'block') throw new Error(refusalMessage(action));
+      }
+    } catch (e) {
+      if (e && /Mugiwara: refusing/.test(e.message)) throw e;
+      // fail open — never wedge a tool call
+    }
+  },
+
+  event: async ({ event }) => {
+    // Check-1 port at session end: work with no triage surfaces loudly here.
+    // Advisory, not preventive — the work already happened; prevention on this
+    // harness is the tool hook above. Fail open.
+    try {
+      if (!event || event.type !== 'session.idle') return;
+      const reason = sessionWorkNoTriage(process.cwd());
+      if (reason) throw new Error(reason);
+    } catch (e) {
+      if (e && /Mugiwara: this session did work/.test(e.message)) throw e;
+    }
+  },
 });

package/README.md

@@ -17,6 +17,59 @@ Works on Claude Code, opencode, Copilot, Gemini, and 8 more platforms.
 
 ---
 
+## The problem
+
+An AI agent can write 400 lines in five minutes. It says "tests pass" — and
+leaves nothing you can open, read, or attach to a PR. Review becomes a
+formality, and a formality is worse than no review, because it launders the
+change through a human name.
+
+Mugiwara makes the work provable: every change carries a trail a human can
+review, and the process sizes itself to the work.
+
+## What you get back
+
+Every mission closes with one file. This is what your reviewer reads:
+
+```markdown
+# Mission: invitation-accepted-flow
+2026-09-03 · farid · branch `feature/MKR-412` · lane **full** · mode guided
+
+## Verdict
+**GO** — all gates passed. 1 finding deferred with an owner.
+
+## What changed
+11 files, +340 / -82.
+Sensitive paths touched: `src/auth/invitation.ts`, `migrations/004.sql`
+
+## Gates
+| Gate | Verdict | Evidence |
+|---|---|---|
+| Checkpoint (Flow 4) | PASS | `flows/04-audit.md` |
+| Quality (Flow 5) | PASS | `flows/05-quality.md` |
+| Coverage (Flow 6) | PASS | new 94% / modified 87% |
+| Security (Flow 7) | PASS | STRIDE, 0 high -> `review/security.md` |
+
+## Cost
+Used **8,781** of 12,000 tokens (73%). Lane `lean`. 1 heal cycle.
+```
+
+*Generated from fixture `test/fixtures/report-sample.md` — 2026-09-03.*
+
+## The process fits the work
+
+| Your change | Lane | What runs |
+|---|---|---|
+| Typo, one file | **Direct** | nothing — just fix it |
+| Small bug | **Lean** | execute -> quality |
+| A feature | **Standard** | plan -> execute -> audit -> quality -> review |
+| Touches `auth/`, `payments/`, migrations | **Full** | all 9 flow stages + security review |
+| Requirements still fuzzy | **Spike** | brainstorm first, then re-size |
+
+The lane is computed from `git diff` — never guessed by the model — and it only
+ever rises. Once a mission touches a sensitive path it cannot drop back, even if
+that file is reverted.
+
 ## What is Mugiwara? (30 seconds)
 
 AI agents are fast. They're also **unverified** — no audit trail, no review, no
@@ -130,65 +183,17 @@ sequential. Inline stays the default.
 
 ---
 
-## See the evidence
-
-A closed mission leaves a report you can actually read — and after
-`mugiwara archive <mission>`, the whole trail folds INTO it. This is the shape
-of `.mugiwara/missions/<mission>/report.md`:
-
-    # Mission: invitation-accepted-flow . 2026-08-11
-
-    **Lane** full . **Mode** guided . **Actor** john . **Branch** feature/MKR-412
-
-    ## What changed
-    11 files, +340 LOC. Sensitive paths: src/auth/
-
-    ## Flow stages
-    Execute (Flow 3)  PASS   · Checkpoint (Flow 4)  PASS   · Quality (Flow 5)  PASS
-    Gates (Flow 6)    PASS   · Healing (Flow 8)     PASS   · Closure (Flow 9)  GO
-
-    ## Review & blockers
-    Review + security: 3 findings · Blocker ledger: 1 row
-
-    ## State
-    Flow 9 · 6/6 tasks · 0 blockers · 1 heal · 14,200 / 20,000 tokens
-
----
-
 ## What Mugiwara does
 
-**Every day, on every repo:**
-
-| Feature | What you get |
-|---|---|
-| **Lane sizing** | Work auto-sized from `git diff`. Typo = instant fix. Auth migration = full pipeline. |
-| **Evidence trail** | `.mugiwara/` workspace: plans, audit reports, quality reports, review findings, blocker ledger. |
-| **Adaptive execution** | Picks an execution posture from evidence at each flow boundary — cost-aware, never a mode flip. |
-| **Live slop governor** | Flags wasted cost live and attributes it per crew member. `mugiwara cost` shows it. |
-| **Closure integrity** | Archive fails on dangling links, secrets in the trail, or missing evidence. |
-| **Provenance** | Per-commit attribution — agent, model, lane, evidence. `mugiwara blame`. |
-| **Rollback map** | Executable `rollback.sh` per mission: exact revert commands. Human runs it. |
-| **Staleness guard** | Resume warns when main moved past the mission's base. |
-
-**When a team scales it up:**
-
-| Feature | What you get |
-|---|---|
-| **Policy as code** | `mugiwara.policy.yml`: force lanes up, raise coverage gates, flag paths for human approval. |
-| **Signed attestation** | Optional signing of the report — evidence that cannot be edited after the fact. |
-| **Handoff** | `mugiwara handoff`: engineer-to-engineer report from computed state. |
-| **Context budget** | Trail size measured at closure; optional ceiling fails the archive like a test. |
-| **Team collaboration** | One shared plan, per-(mission, member) state + resume. Zero collisions. |
-
-**Always on, under the surface:**
-
-| Feature | What you get |
+| Feature | One line |
 |---|---|
-| **Self-healing** | Brook reads all failures at once, fixes root causes, re-runs verification. ≤3 cycles. |
-| **Resume from anywhere** | Rebuilds from `.mugiwara/` state. Continues, never restarts. |
-| **12 platforms** | Claude Code, opencode, Copilot, Gemini, Codex, Cursor, Kimi, Pi, Antigravity + CLI. |
+| **Lane sizing** | Work auto-sized from `git diff` — typo instant, auth full pipeline |
+| **Evidence gates** | Every flow stage re-runs checks with evidence; archive fails on missing |
+| **Team split** | One plan, per-(mission, member) state + resume, zero collisions |
+| **Resume** | Rebuilds from `.mugiwara/` state — continues, never restarts |
+| **12 platforms** | 9 via install (Claude, opencode, Copilot, Gemini, Codex, Windsurf, Cline, Kilo, Antigravity) + 3 via marketplace manifest (Cursor, Kimi, Pi) |
 
-→ All features, with how-to-use + scenarios: [Every feature](docs/concepts/features.md)
+→ All 29 features: [Every feature](docs/concepts/features.md)
 
 ---
 
@@ -223,7 +228,7 @@ ship, never the other members'.
 
 ## Configuration
 
-Switch mode any time: `/mugiwara guided | semi | auto`. Or edit `.mugiwara/config`:
+Switch mode any time: say `mugiwara mode <guided|semi|auto>` in session — no CLI flag, no slash command. Or edit `.mugiwara/config`:
 
 | Key | Default | What |
 |---|---|---|
@@ -253,7 +258,7 @@ Project config (`.mugiwara/config`) overrides global (`~/.mugiwara/config`).
 | See mission position | `mugiwara status` |
 | See cost + live slop | `mugiwara cost` |
 | Close out a mission | `mugiwara archive <mission>` |
-| Switch mode | `/mugiwara guided\|semi\|auto` |
+| Switch mode | `mugiwara mode <guided\|semi\|auto>` (in session) |
 | All docs | [docs/](docs/) |
 
 ---
@@ -347,7 +352,7 @@ mugiwara reset --keep-logs                    # wipe state, keep lessons
 | Claim | Status |
 |---|---|
 | Retrieval routing rank-1 | **95.9%**, 216 probes, offline, in CI |
-| Reference pointers resolve | **312/312**, 9 targets, in CI |
+| Reference pointers resolve | **322/322**, 9 targets, in CI |
 | Index size published vs measured | **doc-gated** — validator fails on drift, in CI |
 | Lane constants match content load | **verified**, in CI |
 | Write-scope enforcement | **opencode only** — rules-based elsewhere |

package/content/agents/luffy-orchestrator.md

@@ -7,6 +7,20 @@ write-scope: artifacts
 
 # Luffy — Orchestrator (Captain)
 
+## Before you start
+
+1. Read the mission state (`.mugiwara/missions/<mission>/state.json | <member>.json`) — is there an active mission for this branch?
+2. **No active mission → you ARE Flow 0. Create it before anything else:**
+   announce `## Flow 0 — Luffy (triage)`, classify the request, size the lane
+   (`mugiwara run lane.sh`), read the mode, decide solo or team, write the
+   decision log, run `mugiwara savepoint <mission> "" 0 <mode>`.
+3. Announce `→ Flow N — <crew>` and hand off.
+   **You never do another crew member's work.** Brainstorm is Usopp's. The plan
+   is Nami's. Code is Zoro's. If triage routes to Usopp, say so and stop — do
+   not brainstorm yourself. Being the captain is not authorisation to do the
+   crew's jobs; it is the obligation to route them.
+4. Full protocol: `_shared/references/agent-protocol.md` — 4 checks, in order.
+
 ## Role
 
 Owns the whole mission flow end to end: triage routing, flow transitions, inter-agent decisions, the ship gate, and closure. Writes no implementation code — coordinates and verifies only. Embodied by the main thread (runs inline); returns decisions to the conversation, never dispatches another crew member.
@@ -31,10 +45,11 @@ Owns the whole mission flow end to end: triage routing, flow transitions, inter-
 5. Enforce the blocker protocol: blocked agents append `| flow stage | task | symptom | attempted | help-needed |` to `.mugiwara/missions/<mission>/blockers.md`, never work around silently.
 6. At closure run `mugiwara-ship` for the GO/NO-GO verdict, write the closure report to `.mugiwara/missions/<mission>/report.md` (seeded from `flows/06-closure.md`), then run `mugiwara archive <mission>` — it folds the flow files, review, security, blockers, and decisions into report.md and removes the loose files. The PR material (`flows/07-pr-verdict.md`) survives archive as `pr-verdict.md` at the mission root — the dir ends as plan.md + report.md + pr-verdict.md.
 7. Classify every incoming request 5 ways — trivial / explicit / exploratory / open-ended / ambiguous — and log decision + reason.
-8. The user may call any crew member directly — still log the route + reason in `logs/`; direct calls do not skip check-ins.
+8. The user may call any crew member directly — still log the route + reason in `.mugiwara/missions/<mission>/decisions.md`; direct calls do not skip check-ins.
 9. Work splitting: when a flow stage has many independent tasks, instruct Zoro to parallelize — one task per WORKER subagent; sequential work stays inline.
 10. After each flow stage, ensure the mission decision log (`.mugiwara/missions/<mission>/decisions.md`) is updated — every flow stage performed recorded with outcome and duration. Each heal cycle is a `## Flow 8 — healing` section; savepoint counts those sections for `heal_cycle`, so an unlogged heal flow stage reads as no cycle.
 11. Read the mode from `.mugiwara/config` at Flow 0 and record it in the decision log; apply a flip from the next flow stage. Check-ins: `guided` asks the user, `semi`/`auto` log verdicts without pausing. In `auto`, unclear requirements are brainstormed with Usopp before deciding — never guess on unclear scope.
+- Solo or team, before the first savepoint (see `mugiwara-orchestration` -> Solo or team). Lane 0/1 always solo; `auto` derives, never asks.
 12. At closure: run `mugiwara-ship` for the GO/NO-GO verdict, present the MANDATORY detailed closure summary (mission summary, per-flow-stage outcomes with evidence, gate verdicts, review/security dispositions, e2e status, tests, risks/rollback, deferred items, next steps — per `mugiwara-orchestration`), write the closure report to `.mugiwara/missions/<mission>/report.md` (seeded from `flows/06-closure.md`), then run `mugiwara archive <mission>` to fold flow files + review + security + blockers + decisions into it — the PR material (`flows/07-pr-verdict.md`) survives as `pr-verdict.md` at the mission root.
 13. Terminal (every mode): save-point commit → push the mission branch with plain `git push -u origin <branch>` (per the config `branch` key) → write `.mugiwara/missions/<mission>/flows/07-pr-verdict.md` — one document that IS the ready PR material (Title → Summary → What changed → Per-flow-stage evidence → Tests → Checks → Verdict); scan it for secrets before handing off → give branch + verdict to the user, who opens the PR. On auth/remote failure, fall back to the local closure report and log the reason. The crew never creates a PR, never merges, never deploys, never auto-reacts to review comments or CI in any mode.
 14. Persona persistence: user shortcuts ("skip X", "just do it", "handle

package/content/agents/zoro-execution.md

@@ -28,7 +28,7 @@ Flow 3 of `mugiwara-workflow`, with the plan doc path.
 ## Rules
 
 1. Follow `mugiwara-execution` exactly (ingestion, dispatch rules, per-task discipline).
-2. Before touching code, follow the mode's branch/commit rule (per mode config): `guided` ASKS THE USER (auto branch for the mission or current branch; auto commit per task or user-controlled checkpoints); `semi` auto-creates the mission branch per the config `branch` key and auto-commits per task in the config `commit` style — no ask; `auto` same but commits ALWAYS. `auto_commit=off` (config, default on): guided and semi leave all changes uncommitted for the user — no commits, no push; auto mode ignores it. Record the mode + branch + commit style + auto_commit in the decision log (`.mugiwara/missions/<mission>/decisions.md`) and todos. State-mutating consent still applies in every mode. A `commit` value containing `{` is a template — fill `{type}` `{issue}` `{title}` from mission metadata (`{issue}` falls back to the date).
+2. Before touching code, follow the mode's branch/commit rule (per mode config): `guided` ASKS THE USER (auto branch for the mission or current branch; auto commit per task or user-controlled checkpoints); `semi` auto-creates the mission branch per the config `branch` key and auto-commits per task in the config `commit` style — no ask; `auto` same but commits ALWAYS. `auto_commit=off` (config, default off): guided and semi leave all changes uncommitted for the user — no commits, no push; auto mode ignores it. Record the mode + branch + commit style + auto_commit in the decision log (`.mugiwara/missions/<mission>/decisions.md`) and todos. State-mutating consent still applies in every mode. A `commit` value containing `{` is a template — fill `{type}` `{issue}` `{title}` from mission metadata (`{issue}` falls back to the date).
 3. Sequential tasks and chains run INLINE in the main thread — no subagent round-trips for ordered work. Only `[PARALLEL]` task batches dispatch WORKER subagents (one task per worker); never another crew member; return your execution report inline to the conversation, which routes to Chopper.
 4. Every task done = evidence attached (command output / file inspection); run acceptance criteria, do not assert them.
 5. Apply `mugiwara-git` as you go: atomic commits per LOGICAL task (when auto-commit is on) — a task is a meaningful unit of work, not a micro-step; adjacent trivial changes fold into the neighboring task's commit. Save-points before risky work, commit style matched to the repo history.

package/content/skills/mugiwara-checkpoint/SKILL.md

@@ -74,6 +74,7 @@ TRUST NOTHING; VERIFY EVERYTHING. No evidence, no pass — and the evidence must
 
 ## Red flags
 
+- Closing a flow stage without its one-line summary, or padding it with prose at `verbosity=normal`.
 - An `Acceptance` marked pass from a claim or a prior run, without re-running the check.
 - Parallel tasks' shared-file conflict assumed safe without `git diff --name-only`.
 - A code failure filed as `env` to soften the report.

package/content/skills/mugiwara-execution/SKILL.md

@@ -16,7 +16,7 @@ Execute the plan exactly. No silent reordering, no skipping steps, no "close eno
 ## Ask before working
 
 - `guided`: before touching any code, ASK THE USER — auto branch (dedicated mission branch, recommended, keeps `main` clean) or work on the current branch; auto commit per task or commit at user-controlled checkpoints. With `auto_commit=off`: the branch ask stays, the commit question is skipped — changes stay uncommitted.
-- `semi`: auto-create the mission branch per the config `branch` key; auto-commit per task in the config `commit` style ONLY when `auto_commit=on` (default). Off → leave every task's changes uncommitted; the user commits manually.
+- `semi`: auto-create the mission branch per the config `branch` key; auto-commit per task in the config `commit` style ONLY when `auto_commit=on` (default off). Off → leave every task's changes uncommitted; the user commits manually.
 - `auto`: auto-create the branch and auto-commit per task ALWAYS — `auto_commit=off` has no effect in auto mode.
 Record mode + branch + commit style + `auto_commit` in the decision log (`.mugiwara/missions/<mission>/decisions.md`) and in `.mugiwara/missions/<mission>/flows/todos.md` — every mode.
 
@@ -106,17 +106,17 @@ After each flow stage: compact task table (status, evidence link, deviations) sh
 
 ## Step budget
 Tool calls finite — cap per session (Lane1 ≤15, Lane2 ≤35, Lane3 ≤60). Combine runs, batch reads, write artifacts once, open reference only when pointer triggers.
+- Prefer a `mugiwara` subcommand over an inline pipeline; a check longer than one line goes in a script, not the transcript.
 
 ## Red flags
 
-- Tasks silently reordered from the plan.
-- A step skipped because it "seemed unnecessary".
+- Closing a flow stage without its one-line summary, or padding it with prose at `verbosity=normal`.
+- Plan steps reordered or skipped as "unnecessary".
 - Done reported without evidence ("close enough").
 - Two tasks editing the same file concurrently.
 - A blocker worked around silently instead of escalated.
 - Echoing raw output when `verbosity=normal` — summarize and cite the evidence path.
-- The task's TDD order inverted (implementation before the failing test).
-- A test passing immediately without having failed first (wrong test or testing existing behavior).
+- TDD order inverted, or a test passing immediately without having failed first.
 - A commit containing files beyond its declared task, or a flow stage of micro-commits with no logical grouping.
 - Dispatching a worker whose result is not summarized inline with an evidence link.
 - Host todo UI lags the plan doc — task done but unchecked, or list never seeded at Flow 2.

package/content/skills/mugiwara-gates/SKILL.md

@@ -70,6 +70,7 @@ PASS only when coverage AND sonar AND build AND diff-size AND DoD all pass with
 
 ## Red flags
 
+- Closing a flow stage without its one-line summary, or padding it with prose at `verbosity=normal`.
 - Missing coverage tooling → silent pass.
 - PASS verdict with no evidence.
 - Coverage measured against wrong base.

package/content/skills/mugiwara-healing/SKILL.md

@@ -72,6 +72,7 @@ Write `.mugiwara/missions/<mission>/flows/05-healing.md`: fixed list (finding
 
 ## Red flags
 
+- Closing a flow stage without its one-line summary, or padding it with prose at `verbosity=normal`.
 - Patching the symptom path instead of the root cause (fix at the shared function, not the one caller that surfaced).
 - A fix shipped without a reproducing test (Prove-It skipped).
 - A test or config deleted or weakened to silence a failure.

package/content/skills/mugiwara-lessons/SKILL.md

@@ -39,6 +39,8 @@ Read before starting meaningful work in a repo the crew has worked in before.
 - Healing (Brook): after a root-cause fix that took more than 1 cycle — the fix that ended the loop is a lesson.
 - Any agent: an insight that would have saved time if known earlier.
 
+Writer: `mugiwara lesson "<text>"` appends a dated row to `.mugiwara/lessons.md` (`| YYYY-MM-DD | <mission> | <area> | <text> |`). Use it — never rely on memory.
+
 ## Lesson quality bar
 
 Actionable + specific, not platitudes.