@iowarp/clio-coder 0.3.0

package/skills/git/review-changes/SKILL.md

@@ -0,0 +1,103 @@
+---
+name: review-changes
+description: Use before committing, when the user asks to review the uncommitted work — "review my changes", "check this before I commit", "pre-commit review". Reads changed files in full against the project's documented standards, hunts real bugs and security issues, verifies findings before reporting them, and writes a severity-ranked report. Not for reviewing a branch or PR range; use the repo's review tooling for that.
+version: 0.2.0
+license: Apache-2.0
+allowed-tools:
+  - read
+  - grep
+  - find
+  - ls
+  - git
+  - bash
+  - context
+  - code_nav
+  - write
+  - artifact
+clio:
+  registry-id: iowarp/clio-coder
+  source-url: https://github.com/iowarp/clio-coder/tree/main/skills/git/review-changes
+  audit: pass
+  provenance: adapted
+  origin: https://github.com/coleam00/skills/tree/main/.claude/skills/review-changes
+  eval-status: smoke-checked
+  model-size: large
+  agents:
+    - main
+    - coder
+    - git-master
+---
+
+# Review Changes
+
+Technical review of the uncommitted work: real bugs, security, standards.
+Style nitpicks a formatter or linter would catch are not findings.
+
+## Step 1 — Load the project's bar
+
+Read the standards the diff will be judged against: the project instruction
+file (`CLIO-CODER.md`, `AGENTS.md`, `CLAUDE.md`), README, and documented standards
+under `docs/`. A finding that contradicts a documented project convention is
+wrong, not the code.
+
+## Step 2 — Collect the change set
+
+```bash
+git status
+git diff HEAD
+git diff --stat HEAD
+git ls-files --others --exclude-standard
+```
+
+Read every changed and new file in full, not just the diff hunks: bugs live
+in the interaction between the changed lines and the unchanged context.
+
+## Step 3 — Analyze each file
+
+Check, in priority order:
+
+1. **Logic errors**: off-by-one, inverted conditionals, missing error
+   handling, race conditions, broken edge cases.
+2. **Security**: injection, unsafe data handling, secrets or keys in code —
+   flag these CRITICAL.
+3. **Performance**: N+1 patterns, quadratic loops on unbounded input, leaks,
+   repeated computation.
+4. **Quality**: duplication a nearby helper already solves, functions doing
+   three jobs, misleading names, missing types where the project types.
+5. **Standards**: the documented conventions from Step 1 — testing, logging,
+   typing, structure.
+
+## Step 4 — Verify before reporting
+
+A suspected issue is confirmed by evidence, not vibes: run the specific test
+that exercises it, trigger the type checker, or trace the failing input
+concretely. A finding you could not verify is reported as "unverified" with
+the reason, or dropped when the check proved it wrong.
+
+## Step 5 — Report
+
+Write `.clio-coder/reviews/<YYYY-MM-DD>-<slug>.md` (`.clio-coder/` is local and
+ignored). Header stats: files modified/added/deleted, lines added/deleted
+(from `git diff --stat`). Then each finding:
+
+```
+severity: critical|high|medium|low
+file: path/to/file.ts
+line: 42
+issue: <one line>
+detail: <why this is a problem, concretely>
+suggestion: <the fix>
+verified: <how, or "unverified: <reason>">
+```
+
+Order findings by severity. If nothing survived verification, write exactly
+that: "Review passed. No verified technical issues." Done when the report
+file exists and its path plus a severity count summary has been given to the
+user.
+
+## Red flags
+
+- Findings quoted from the diff without reading the surrounding file.
+- Style complaints dressed up as findings.
+- A "critical" that was never verified.
+- Rewriting the code instead of reviewing it — this skill only reports.

package/skills/git/review-changes/evals.md

@@ -0,0 +1,85 @@
+# Evals — review-changes
+
+Baseline scenarios (subagent WITHOUT the skill vs WITH). Pass/fail per
+bullet. Fixtures seed a real git repo in the eval workspace (repo-relative
+shell only). Expected bullets describe transcript-observable behavior; a
+bullet passes only when the treatment transcript shows it.
+
+## S1 — seeded bug in a diff
+Setup: review my changes before I commit.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf 'function lastItems(items, n) {\n  return items.slice(items.length - n);\n}\nmodule.exports = { lastItems };\n' > items.js
+git add items.js
+git commit -qm "chore: seed items module"
+printf 'const API_KEY = "sk-live-9f8e7d6c5b4a3210fedcba9876543210";\n\nfunction lastItems(items, n) {\n  const out = [];\n  for (let i = items.length - n; i <= items.length; i++) {\n    out.push(items[i]);\n  }\n  return out;\n}\nmodule.exports = { lastItems, API_KEY };\n' > items.js
+```
+
+Expected:
+- Reads the changed file in full (a read of `items.js`), not only the diff
+  hunks.
+- Finds both seeded problems: the loop bound reads past the array end
+  (`i <= items.length`), and the hardcoded API key; the key is reported at
+  CRITICAL severity.
+- Each finding carries file, line, detail, suggestion, and a verification
+  status.
+- A report is written under `.clio-coder/reviews/` and summarized to the user;
+  `items.js` is never edited.
+
+## S2 — clean diff
+Setup: review my changes before I commit.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf 'function greet(name) {\n  return "Hello, " + name;\n}\nmodule.exports = { greet };\n' > greet.js
+git add greet.js
+git commit -qm "chore: seed greeter"
+printf 'function greet(name) {\n  return "Hello, " + String(name).trim();\n}\nmodule.exports = { greet };\n' > greet.js
+```
+
+Expected:
+- Concludes the review passed with no verified technical issues; no
+  manufactured findings and no formatting nitpicks presented as findings.
+
+## S3 — convention trap
+Setup: review my changes before I commit.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '# Contributing\n\nProject convention: error helpers return frozen plain objects carrying an err tag. Never throw or return Error instances from helpers.\n' > CONTRIBUTING.md
+printf 'function ok(value) {\n  return Object.freeze({ err: null, value });\n}\nmodule.exports = { ok };\n' > result.js
+git add CONTRIBUTING.md result.js
+git commit -qm "chore: seed result helpers"
+printf 'function ok(value) {\n  return Object.freeze({ err: null, value });\n}\nfunction fail(code) {\n  return Object.freeze({ err: code, value: null });\n}\nmodule.exports = { ok, fail };\n' > result.js
+```
+
+Expected:
+- Loads project context/conventions (reads CONTRIBUTING.md or equivalent)
+  before judging the diff; raises no finding against the documented
+  frozen-object error convention.
+
+## Baseline failure modes to watch for (RED)
+- Formatting nitpicks presented as findings.
+- Unverified speculation labeled critical.
+- Editing the code under review.
+
+## Smoke record (2026-08-13)
+
+One representative scenario via `clio-coder skills eval` against Nemo-3.5-Lightning
+(30B local, llamacpp on mini), full-auto sandbox. PASS. Read full files, wrote the report under .clio-coder/reviews/, judge 4/4.

package/skills/git/worktree-create/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: worktree-create
+description: Use when the user asks to set up one or more git worktrees for parallel work — "create a worktree", "set up worktrees for these branches", "spin up parallel branches". Detects the project's install, config, and health-check needs once, then stands up each worktree on its own branch with gitignored config copied in, dependencies installed, and a verified health check. Not for merging finished worktrees; use worktree-merge.
+version: 0.2.0
+license: Apache-2.0
+allowed-tools:
+  - read
+  - grep
+  - find
+  - ls
+  - git
+  - bash
+  - write
+  - ask_user
+  - artifact
+clio:
+  registry-id: iowarp/clio-coder
+  source-url: https://github.com/iowarp/clio-coder/tree/main/skills/git/worktree-create
+  audit: pass
+  provenance: adapted
+  origin: https://github.com/coleam00/skills/tree/main/.claude/skills/worktree-create
+  eval-status: smoke-checked
+  model-size: any
+  agents:
+    - main
+    - git-master
+---
+
+# Worktree Create
+
+Stand up isolated git worktrees, each on its own branch, genuinely ready to
+develop and validate in: config copied, dependencies installed, health
+check passed. Everything is detected from this repo; nothing about the
+stack is assumed.
+
+## Step 1 — Branch list
+
+The user's arguments are the branch list. No branches given → ask which to
+create (or offer to derive them from the tickets in play); never guess.
+
+## Step 2 — Detect the project setup ONCE
+
+Read `references/worktree-setup.md` — the checklist of what a fresh worktree
+needs and how to detect each piece. From this repo, determine one time:
+
+- install command(s), from manifests and lockfiles (one per package in a
+  monorepo);
+- gitignored env/config files to copy (or the repo's `.worktreeinclude` as
+  the source of truth);
+- the health-check command, preferring exactly what CI runs (read
+  `.github/workflows/*`, Makefile, manifest scripts) — a health endpoint if
+  the app has one, else build/typecheck/test smoke;
+- a base port, only if the health check starts a service; worktree N gets
+  `base + N` so parallel servers never collide.
+
+Worktree root is `worktrees/<branch>`, gitignored. If `worktrees/` is not
+ignored, add it to `.gitignore` first.
+
+## Step 3 — Set up each worktree sequentially
+
+For each branch, in order:
+
+1. `git worktree add worktrees/<branch> -b <branch>` off the intended base
+   (default branch for clean trees; current HEAD only if the user wants
+   in-progress work carried).
+2. Copy the detected gitignored config/secrets in, verifying each with
+   `git check-ignore <file>` before copying — a tracked file must never be
+   duplicated.
+3. Run the detected install command(s) inside the worktree.
+4. Run any generate/build step the app needs to boot; skip if none.
+5. Run the health check (on the assigned port when a service starts); stop
+   any server you started afterwards.
+6. Record: path · branch · deps installed · health PASS/FAIL · errors.
+
+A failed step fails that worktree; continue with the rest and report the
+failure. Do not mark a worktree ready that did not pass its health check.
+
+## Step 4 — Report
+
+Print the per-worktree table (path · branch · deps · health · port), a
+`N worktree(s) ready, M failed` line, the next step (start work in each),
+and the cleanup reminder: `git worktree remove worktrees/<branch>` once a
+branch is merged. Done when every requested branch is either ready or
+reported failed with its error.
+
+## Red flags
+
+- Assuming npm/pytest/anything instead of detecting from the repo.
+- Copying a file into the worktree without `git check-ignore` proving it is
+  untracked config.
+- Reporting a worktree ready with a failed or skipped health check.
+- Two parallel services fighting over one port.

package/skills/git/worktree-create/evals.md

@@ -0,0 +1,97 @@
+# Evals — worktree-create
+
+Baseline scenarios (subagent WITHOUT the skill vs WITH). Pass/fail per
+bullet. Fixtures seed a real Node git repo (valid empty lockfile so
+`npm ci` succeeds offline; gitignored `.env`; CI workflow declaring the
+commands). Expected bullets describe transcript-observable behavior; a
+bullet passes only when the treatment transcript shows it.
+
+## S1 — two worktrees on a Node repo
+Setup: set up worktrees for feat-a and feat-b.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "private": true,\n  "scripts": {\n    "test": "node test.js"\n  }\n}\n' > package.json
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "lockfileVersion": 3,\n  "requires": true,\n  "packages": {\n    "": {\n      "name": "eval-app",\n      "version": "1.0.0"\n    }\n  }\n}\n' > package-lock.json
+printf 'console.log("tests pass");\n' > test.js
+mkdir -p .github/workflows
+printf 'name: ci\non: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - run: npm ci\n      - run: npm test\n' > .github/workflows/ci.yml
+printf '.env\nworktrees/\nnode_modules/\n' > .gitignore
+printf 'APP_SECRET=eval-secret-not-real\n' > .env
+git add package.json package-lock.json test.js .gitignore .github/workflows/ci.yml
+git commit -qm "chore: seed node app"
+```
+
+Expected:
+- Detects the install and health-check commands from the CI workflow and
+  manifest (`npm ci`, `npm test`) rather than assuming them.
+- Creates `worktrees/feat-a` and `worktrees/feat-b`, each on its own
+  branch (git worktree add appears for both).
+- Copies `.env` into the worktrees only after a `git check-ignore` (or
+  equivalent ignore check) confirms it is untracked-by-design.
+- Runs the health check in each worktree and reports per-worktree
+  PASS/FAIL.
+
+## S2 — no branches given
+Setup: set up worktrees for me.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "private": true,\n  "scripts": {\n    "test": "node test.js"\n  }\n}\n' > package.json
+printf 'console.log("tests pass");\n' > test.js
+git add package.json test.js
+git commit -qm "chore: seed node app"
+```
+
+Expected:
+- Asks which branches to create (an ask, or an explicit statement of the
+  question where asking is unavailable); no `git worktree add` and no new
+  branch appears in the transcript.
+
+## S3 — health check fails in one worktree
+Setup: set up worktrees for feat-ok and feat-broken.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "private": true,\n  "scripts": {\n    "test": "node test.js"\n  }\n}\n' > package.json
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "lockfileVersion": 3,\n  "requires": true,\n  "packages": {\n    "": {\n      "name": "eval-app",\n      "version": "1.0.0"\n    }\n  }\n}\n' > package-lock.json
+printf 'console.log("tests pass");\n' > test.js
+printf '.env\nworktrees/\nnode_modules/\n' > .gitignore
+git add package.json package-lock.json test.js .gitignore
+git commit -qm "chore: seed node app"
+git branch feat-ok
+git checkout -qb feat-broken
+printf 'console.error("boom"); process.exit(1);\n' > test.js
+git commit -qam "test: break suite on this branch"
+git checkout -q main
+```
+
+Expected:
+- `worktrees/feat-broken` is reported FAILED with the actual health-check
+  error; `worktrees/feat-ok` still completes and is reported PASS; the
+  final summary never claims "all ready".
+
+## Baseline failure modes to watch for (RED)
+- Hardcoded package-manager or test commands.
+- Secrets/config missing so the app fails at boot later.
+- Untracked-vs-tracked confusion duplicating tracked files.
+
+## Smoke record (2026-08-13)
+
+One representative scenario via `clio-coder skills eval` against Nemo-3.5-Lightning
+(30B local, llamacpp on mini), full-auto sandbox. PASS. Commands detected from CI, worktrees created, check-ignore before .env copy, per-worktree health checks. Judge truncation caused the harness exit 1.

package/skills/git/worktree-create/references/worktree-setup.md

@@ -0,0 +1,66 @@
+# Worktree Setup — the general checklist
+
+A git worktree shares the repository's object store and **tracked** files, but is otherwise a *fresh checkout*. It
+is missing everything git does not track and everything that is machine-local state. To be genuinely ready to
+develop, run, and validate in, a worktree needs the items below. The list is **project-agnostic** — detect the
+specifics from the repo (see *Detecting the specifics*), never assume a stack.
+
+## What a fresh worktree needs
+
+1. **A branch off the right base.** Create the worktree on a new branch from the intended base — usually the
+   repo's default branch (`origin/HEAD`) for a clean tree matching the remote, or the current `HEAD` to carry
+   in-progress work. Put it under a gitignored root (`worktrees/<branch>`) so it never shows as untracked in the
+   main checkout.
+
+2. **Gitignored config & secrets — the commonly-missed layer.** A fresh checkout has NONE of the untracked files
+   the app reads at runtime: `.env`, `.env.local`, `.env.<stage>`, credential/service-account JSON, `*.pem` and
+   other keys, `.npmrc` / `.pypirc`, local settings (`.claude/settings.local.json`, `.clio-coder/` state), and anything similar. Copy
+   these from the main working tree into the worktree. Confirm each is actually ignored (`git check-ignore <f>`)
+   so tracked files are never duplicated. If the repo ships a `.worktreeinclude`, use that list as the source of
+   truth for what to copy.
+
+3. **Dependencies.** Install with the project's own package manager, detected from the manifests/lockfiles
+   present. A monorepo needs an install per package (e.g. a backend and a frontend). Install *into* the worktree
+   so its environment is isolated from the main checkout.
+
+4. **Language runtime & an isolated environment.** Use the runtime version the project pins (`.python-version`,
+   `.nvmrc`, `.tool-versions`, the `go`/`node` field in the manifest). Create the virtualenv / `node_modules`
+   *inside* the worktree — never share the main checkout's — so versions can diverge per branch.
+
+5. **Generated or downloaded artifacts install won't produce.** If the app needs codegen (protobuf, GraphQL, ORM
+   clients), compiled assets, or downloaded models/caches to boot, run the project's generate/build step. Skip if
+   there is none.
+
+6. **Isolation for concurrent runs.** Only if you will actually *run* services in several worktrees at once: give
+   each worktree a distinct **port** per long-running service so they don't collide, and where the app writes to a
+   shared local database, a separate **database or schema** (or a disposable containerized DB) per worktree. If
+   you are only building and testing, not serving, skip this.
+
+7. **Verification — a detected health check.** Prove the worktree works before handing it off. Use the cheapest
+   meaningful check the project supports, in order: start the app and hit its health endpoint if it exposes one →
+   else a fast build / typecheck / test-collection smoke → else at minimum confirm dependencies resolved and the
+   app imports/builds. Detect the command; do not assume one.
+
+8. **Registration & later cleanup.** The worktree is now tracked (`git worktree list`). Know it exists so it can be
+   removed (`git worktree remove <path>`) once its branch is merged, so stale worktrees don't pile up.
+
+## Detecting the specifics (per repo, not assumed)
+
+- **Install command** — from the lockfile/manifest present: `uv.lock`/`pyproject.toml` → `uv sync`; `poetry.lock`
+  → `poetry install`; `requirements.txt` → `pip install -r requirements.txt`; `package-lock.json` → `npm ci`;
+  `pnpm-lock.yaml` → `pnpm install`; `yarn.lock` → `yarn`; `bun.lockb` → `bun install`; `Cargo.toml` →
+  `cargo build`; `go.mod` → `go mod download`; `Gemfile` → `bundle install`; `composer.json` → `composer install`.
+  Several present → monorepo; install each in its own package dir.
+- **Env/config files to copy** — intersect the repo's ignored, untracked files with common secret/config patterns:
+  `git ls-files --others --ignored --exclude-standard` filtered to `.env*`, `*.local`, key/credential files. Or
+  read `.worktreeinclude` if present. Check subdirectories too (e.g. `backend/.env`, `app/.env`).
+- **Run command + port** — check the README, the manifest's scripts (`package.json` `scripts`, `pyproject` entry
+  points), a `Procfile`, `docker-compose.yml`, or a `Makefile`; read a `PORT` / `*_PORT` from env or config.
+- **Health endpoint** — grep the code/README for a health route (`/health`, `/api/health`, `/healthz`, `/ping`) or
+  a `healthcheck` in `docker-compose.yml`. None → fall back to the build/test smoke.
+- **Validation commands** — prefer **what CI already runs**: read `.github/workflows/*`, a `Makefile`, or the
+  manifest's test/lint scripts and reuse those exact commands (test runner, type checker, linter). CI is the
+  project's own source of truth for "what proves this code works" — don't invent `pytest`/`mypy` if the repo uses
+  something else.
+
+> **Detect, don't hardcode** — everything above is discovered from the target repo at runtime.

package/skills/git/worktree-merge/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: worktree-merge
+description: Use when parallel worktree branches are finished and the user asks to integrate them — "merge my worktrees", "integrate these branches". Merges any number of branches through one throwaway integration branch, testing after each merge, running the full detected suite before the main line moves, with exact rollback on any failure. Not for creating worktrees; use worktree-create.
+version: 0.2.0
+license: Apache-2.0
+allowed-tools:
+  - read
+  - grep
+  - ls
+  - git
+  - bash
+  - ask_user
+  - artifact
+clio:
+  registry-id: iowarp/clio-coder
+  source-url: https://github.com/iowarp/clio-coder/tree/main/skills/git/worktree-merge
+  audit: pass
+  provenance: adapted
+  origin: https://github.com/coleam00/skills/tree/main/.claude/skills/worktree-merge
+  eval-status: smoke-checked
+  model-size: any
+  agents:
+    - main
+    - git-master
+---
+
+# Worktree Merge
+
+Integrate finished branches through a disposable integration branch. The
+original branch moves only after every merge lands and the full suite
+passes; nothing reaches it red.
+
+## Step 1 — Inputs and preconditions
+
+- Fewer than two branches named → ask which to integrate; never guess.
+- Confirm you are at the repository root, not inside `worktrees/`
+  (`pwd` containing `/worktrees/` is an abort).
+- Store the current branch as `<original>`.
+- `git rev-parse --verify <branch>` for every branch in the list; any
+  missing branch aborts before anything is created.
+- Uncommitted changes on `<original>` → stop: commit or stash first.
+
+## Step 2 — Detect the validation commands ONCE
+
+Reuse exactly what CI runs: read `.github/workflows/*`, the Makefile, or
+the manifest's scripts for the test, type-check, and lint commands. Never
+substitute a generic runner for the project's own. Identify the fast test
+command (per-merge) and the full suite (final gate).
+
+## Step 3 — Integration branch
+
+Create one throwaway branch off `<original>`, named for the set
+(`integration-<first-branch>`, suffixed if needed, filesystem-safe). All
+merging happens here.
+
+## Step 4 — Merge each branch in order
+
+Per branch: `git merge --no-ff <branch>`, then run the fast test command,
+so a break is localized to the branch that caused it.
+
+- **Conflict** → stop. Name the conflicting branch and files, give the
+  resolution steps (resolve → `git add` → `git commit` → re-run with the
+  same list), and do not attempt automatic resolution.
+- **Test failure** → stop. Report which tests failed and the rollback:
+  `git checkout <original> && git branch -D <integration>`.
+
+## Step 5 — Full gate, then land
+
+All branches merged → run the full detected suite (tests, type checks,
+lint). Any failure: report and roll back as above. All green:
+`git checkout <original> && git merge --no-ff <integration>`, then delete
+the integration branch.
+
+## Step 6 — Offer cleanup
+
+Ask (via `ask_user` when active): remove the merged worktrees and delete
+their feature branches, or keep them? On yes, per branch:
+`git worktree remove worktrees/<branch> && git branch -d <branch>`. Never
+clean up without the answer.
+
+## Step 7 — Report
+
+Success: integration branch used, each branch with its post-merge test
+result, the full-gate result, the merge into `<original>`, cleanup status
+(with manual commands if kept). Failure: the exact step and branch, current
+state, rollback commands, and how to continue after fixing. Done when one
+of those two reports is delivered and the repo is on `<original>`.
+
+## Red flags
+
+- Merging directly into `<original>` "to save a step".
+- Running a guessed test command instead of the repo's own.
+- Auto-resolving conflicts.
+- Deleting worktrees or branches nobody approved.
+- A red full gate absorbed into "mostly passing".

package/skills/git/worktree-merge/evals.md

@@ -0,0 +1,114 @@
+# Evals — worktree-merge
+
+Baseline scenarios (subagent WITHOUT the skill vs WITH). Pass/fail per
+bullet. Fixtures seed a real git repo with feature branches and a runnable
+test script. Expected bullets describe transcript-observable behavior; a
+bullet passes only when the treatment transcript shows it.
+
+## S1 — clean two-branch integration
+Setup: merge my worktree branches feat-a and feat-b.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "private": true,\n  "scripts": {\n    "test": "node test.js"\n  }\n}\n' > package.json
+printf 'console.log("tests pass");\n' > test.js
+printf 'alpha\n' > a.txt
+printf 'beta\n' > b.txt
+git add package.json test.js a.txt b.txt
+git commit -qm "chore: seed"
+git checkout -qb feat-a
+printf 'alpha 2\n' > a.txt
+git commit -qam "feat: extend alpha"
+git checkout -q main
+git checkout -qb feat-b
+printf 'beta 2\n' > b.txt
+git commit -qam "feat: extend beta"
+git checkout -q main
+```
+
+Expected:
+- Detects the test command from the manifest (`npm test` / `node test.js`)
+  rather than assuming one.
+- Creates a throwaway integration branch and merges each feature branch
+  `--no-ff`, with a test run between the merges.
+- Runs the full suite before `main` moves; the integration branch is
+  deleted afterwards.
+- Asks (or explicitly states the question where asking is unavailable)
+  before deleting feature branches or removing worktrees.
+
+## S2 — conflicting branches
+Setup: merge my worktree branches feat-a and feat-b.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "private": true,\n  "scripts": {\n    "test": "node test.js"\n  }\n}\n' > package.json
+printf 'console.log("tests pass");\n' > test.js
+printf 'shared base\n' > shared.txt
+git add package.json test.js shared.txt
+git commit -qm "chore: seed"
+git checkout -qb feat-a
+printf 'from a\n' > shared.txt
+git commit -qam "feat: a rewrites shared"
+git checkout -q main
+git checkout -qb feat-b
+printf 'from b\n' > shared.txt
+git commit -qam "feat: b rewrites shared"
+git checkout -q main
+```
+
+Expected:
+- Stops at the conflict on the integration branch; names the conflicting
+  branch and `shared.txt`; gives manual resolution steps.
+- No automatic conflict resolution is attempted; `main` still points at
+  the seed commit at the end (never received a merge).
+
+## S3 — test failure after the second merge
+Setup: merge my worktree branches feat-a and feat-b.
+
+Fixture:
+```bash
+git init -q .
+git branch -M main
+git config user.email eval@clio.local
+git config user.name "Clio Eval"
+git config commit.gpgsign false
+printf '{\n  "name": "eval-app",\n  "version": "1.0.0",\n  "private": true,\n  "scripts": {\n    "test": "node test.js"\n  }\n}\n' > package.json
+printf 'console.log("tests pass");\n' > test.js
+printf 'alpha\n' > a.txt
+git add package.json test.js a.txt
+git commit -qm "chore: seed"
+git checkout -qb feat-a
+printf 'alpha 2\n' > a.txt
+git commit -qam "feat: extend alpha"
+git checkout -q main
+git checkout -qb feat-b
+printf 'console.error("regression"); process.exit(1);\n' > test.js
+git commit -qam "feat: b breaks the suite"
+git checkout -q main
+```
+
+Expected:
+- The test failure is localized to feat-b (feat-a's merge tested green
+  first); the report names feat-b as the breaking branch.
+- Exact rollback commands are given; `main` never moves to the red state
+  (still at the seed commit at the end).
+
+## Baseline failure modes to watch for (RED)
+- Merging straight into the current branch without an integration branch.
+- Skipping the per-merge test run, losing failure localization.
+- Cleanup without asking.
+
+## Smoke record (2026-08-13)
+
+One representative scenario via `clio-coder skills eval` against Nemo-3.5-Lightning
+(30B local, llamacpp on mini), full-auto sandbox. PASS. Integration branch, --no-ff merges with tests between. Terminal artifact was blocked by the then-missing allowed-tools entry (fixed same day); git branch -D stays permission-gated at full-auto. A post-fix re-smoke ran exit 1 at 12:16 CDT with no scored breakdown drained before the hard cutoff; the first run's core-workflow pass stands.