@joshuafolkken/kit 1.1471.0 → 1.1514.0

package/.claude/skills/workflow-commands/chain-rule.md

@@ -8,7 +8,8 @@ Review results and successful pushes are never turn boundaries.
 0. **A lane child**: `pnpm josh main:merge`, the self-check (`prompts/review.md` → "Before round 1 —
    the implementer's self-check"), the scoped pair, `pnpm josh ship --detach --review
    "<title> #<N>"` (`--cite <N>`), then **end the turn** on `launched`/`busy`. A stop relaunches a child
-   whose prompt names `pnpm josh ship --log <N>` and (Anthropic lane) the re-detach to run after
+   whose prompt carries the failed output's tail and the changed files (`pnpm josh ship --log <N>` when
+   the stage printed nothing) and (Anthropic lane) the re-detach to run after
    the fix — `pnpm josh ship --detach`, `--review` only if the stopped ship carried it and stopped before
    round 2, which is final (`scripts/run/ship/run-ship-next.ts`); the supervisor skips a recorded round 1.
    `failed` → step 1. A backgrounded `ship` issued alone is moved to the foreground by the hook
@@ -18,7 +19,8 @@ Review results and successful pushes are never turn boundaries.
    (`prompts/review.md` → "Before round 1 — the implementer's self-check"), run the final scoped lint/test pair and
    `pnpm josh run:review`: it starts `pnpm josh gate` in the background and prints the `/code-review`
    brief in one call, so the two overlap. Launch the `/code-review` subagent as the `general-purpose`
-   agent type with that brief (every tool, so `--fix` applies; never a guessed type name).
+   agent type with that brief and the alias of its `model=` id (`claude-opus-5-5` → `opus`) (every
+   tool, so `--fix` applies; never a guessed type name).
    Never load the review skill in the main line.
 2. Once the review returns, run `pnpm josh run:review --join` to join and read the gate before
    committing; it exits non-zero on a red gate. Fix any red check, then rerun the affected scoped check
@@ -40,7 +42,8 @@ Review results and successful pushes are never turn boundaries.
    **`pnpm josh followup` refuses the merge until the round is recorded**
    (`pnpm josh review:record --check --issue <N>`).
 5. **The clean path ships in one call** — with no second round due, background
-   `pnpm josh ship "<title> #<N>" --body-file <evidence.md>`: PR preflight → gate → `git -y` →
+   `pnpm josh ship "<title> #<N>" --body-file <evidence.md>` — the file carries `## 実機証跡` and
+   `## 受け入れ条件の対応` (`report-format.md`), both asked at the preflight: PR preflight → gate → `git -y` →
    `followup` → `run:tail`, stopping at the first failure. `--review` runs both rounds. **Else a due
    round 2 does not fit `ship`**: the PR opens between the rounds — background
    `pnpm josh git -y "<title> #<N>"`, round 2 beside CI, then `pnpm josh followup`.
@@ -54,9 +57,7 @@ Recommendations are informational; severity decides. A CodeRabbit rate-limit war
 ## Orchestration facts single-sourced here
 
 These are the gate → review → PR → merge facts other documents cite; this file is their single source
-(`prompts/review.md` carries the review _policy_, `prompts/review-rubric.md` the rubric). Where each
-rule came from and why it holds: `docs/maintainers/chain-rule-rationale.md` → "Where each rule came
-from", `docs/maintainers/chain-rule-rationale.md` → "Why the orchestration facts hold".
+(`prompts/review.md` carries the review _policy_, `prompts/review-rubric.md` the rubric).
 
 - **The gate runs beside this review, not in front of it** — started with the review, joined before the
   commit. A red gate is fixed and re-run whatever the review concluded.

package/.claude/skills/workflow-commands/delegation.md

@@ -37,15 +37,13 @@ classification lives in `backlogrun-child.md` → "Each child runs in a delegate
 main line.** The unit returns conclusions with `file:line` citations, never the file text. It may run
 a temporary probe script and return its output.
 
-**The threshold is 3 files, and it is a count, not a forecast.** When the next read reaches it,
-delegate the unread investigation. Brief the unit on what was already read; do not re-read it there.
-**A delegation resets the counter rather than spending it**; `pnpm josh investigation:guard` counts
-unedited files and search turns and refuses the threshold call. `pnpm josh delegate --list` prints
-the threshold.
+**The threshold is 3 files, and it is a count, not a forecast.** Brief the unit on what was already
+read. **A delegation resets the counter rather than spending it**; `pnpm josh investigation:guard`
+refuses the threshold call, in a lane child too (`pnpm josh delegate --list`; counting:
+`docs/josh-commands-automation.md` → "`josh investigation:guard`").
 
-**Dispatch the unit as the `investigator` agent** (`kit:investigator` in a consumer) — the parent's
-model at a lowered effort, read-only.
-`docs/josh-commands-automation.md` → "`josh investigation:guard`" carries the command's counting details.
+**Dispatch the unit as the `investigator` agent** (`kit:investigator` in a consumer) — read-only, on
+the `model` its definition names.
 
 **The main line does not idle while the unit reads:** read files this run will edit, then verify the
 unit's cited lines. Independent investigations launch together; a brief that needs another unit's
@@ -54,3 +52,9 @@ answer waits for that answer.
 **When the Issue already names the file, function or rule, read that edit target in the main line.**
 It is not `survey`, and it is not `diagnosis`: the unit describes how the subject works;
 the main line decides what that means and what to change.
+
+## A `general-purpose` subagent names its model
+
+**A `general-purpose` dispatch → set `model`**: `sonnet` for routine work, `opus` for judgment; a review
+takes the alias of the `model=` id its brief prints (`claude-opus-5-5` → `opus`). Delivered by the
+`agent-model` row of `pnpm josh rule:guard`.

package/.claude/skills/workflow-commands/entry-sequence.md

@@ -1,8 +1,6 @@
 # The entry sequence and the stop branches — shared by `fullrun`, `halfrun` and `prrun`
 
-`fullrun.md`, `halfrun.md` and `prrun.md` name only how their own run differs from this shared
-procedure; `pnpm josh run:step <N>` prints the run's next single action. History:
-`docs/maintainers/entry-sequence-rationale.md` → "Where each rule came from".
+`pnpm josh run:step <N>` prints the run's next single action.
 
 ## The ordered entry sequence
 

package/.claude/skills/workflow-commands/followup.md

@@ -2,8 +2,7 @@
 
 Everything between a green CI and a merged PR: the command, the merge it authorizes, the notifications,
 the reviewer scan, the config report and the release ask. `fullrun` and `backlogrun` end here; `halfrun`
-stops before the commit. This file is the single source. Where each rule came from:
-`docs/maintainers/followup-rationale.md` → "Where each rule came from".
+stops before the commit.
 
 ## Run `pnpm josh followup`
 
@@ -106,15 +105,13 @@ pnpm josh notify --task-type failure --issue-url "<issue-url>" --body-file <reas
   non-zero; with it, the reason is posted and the run proceeds.
 - **A comment listing that could not be read is a standing blocker**.
 - **Temporary**: CodeRabbit is non-blocking end to end — out of the default required checks
-  (restore via `JOSH_REQUIRED_CHECKS`); its findings are audit notes. Reverting it:
-  `docs/maintainers/followup-rationale.md` → "The temporary CodeRabbit exemption".
+  (restore via `JOSH_REQUIRED_CHECKS`); its findings are audit notes.
 
 ## Config file reporting
 
 `followup` matches every changed path against what `josh sync` distributes (`AI_COPY_FILES`,
 `AI_COPY_FILE_MAPPINGS`, `AI_COPY_DIRECTORIES`, `SYNCED_PATHS`) and **reports** the claimed paths in the
-notification and the Issue report. **It stops nothing** (`docs/maintainers/followup-rationale.md` →
-"Why config claims are reported, not stopped"). `pnpm josh sync:scope` gives the same answer.
+notification and the Issue report. **It stops nothing.** `pnpm josh sync:scope` gives the same answer.
 
 ## When `pnpm josh release` runs
 

package/.claude/skills/workflow-commands/fullrun-steps.md

@@ -1,8 +1,7 @@
 # `fullrun` — the step lists and the branches
 
-**The detailed procedure behind `fullrun.md`'s manifest**, read on demand — `pnpm josh run:next <N>`
-names which step the run is at, and the sections below carry that step in full. History:
-`docs/maintainers/fullrun-steps-rationale.md` → "Where each rule came from".
+`pnpm josh run:next <N>` names which step the run is at, and the sections below carry that step in
+full.
 
 ## The `fullrun #N` step list
 
@@ -31,8 +30,7 @@ fit**: open the PR between the rounds with `pnpm josh git -y "<title> #<N>"`, ru
 default `ja`). Before implementing, run `pnpm josh ms`, then `pnpm josh latest:scope`
 and update dependencies only on `required` — `latest-gate.md` is its single source, and on `required`
 load the `dependency-update` skill afterwards. **A dispatched lane child skips `pnpm josh ms`** — it
-refuses in a lane, and `pnpm josh main:merge` brings the latest default in during the gate
-(`docs/maintainers/fullrun-steps-rationale.md` → "Why a lane child skips `josh ms`"). The parent runs
+refuses in a lane, and `pnpm josh main:merge` brings the latest default in during the gate. The parent runs
 `pnpm josh ms` in the primary checkout, never the child — `backlogrun-lanes.md` and
 `backlogrun-child.md` are the single sources. When running `pnpm josh followup`, pass an
 implementation summary via `--notify-message` in the session language, leading with the three

package/.claude/skills/workflow-commands/fullrun.md

@@ -1,11 +1,9 @@
 # `fullrun` — the manifest (plan → implement → PR → merge → notify)
 
-**This file is the manifest, not the procedure.** The entry sequence and the stop branches are
-`entry-sequence.md`, shared with `halfrun` and `prrun`; this file names only what is `fullrun`'s own.
-`pnpm josh run:step <N>` prints the run's next single action. `chain-rule.md`, `followup.md`,
-`background-commands.md` and `latest-gate.md` are **not entry reads** — each is fetched at its point of
-use. The step lists are `fullrun-steps.md`, read when a step needs its detail. History:
-`docs/maintainers/fullrun-rationale.md` → "Where each rule came from".
+The entry sequence and the stop branches are `entry-sequence.md`. `pnpm josh run:step <N>` prints the
+run's next single action. `chain-rule.md`, `followup.md`, `background-commands.md` and
+`latest-gate.md` are **not entry reads** — each is fetched at its point of use. The step lists are
+`fullrun-steps.md`, read when a step needs its detail.
 
 ## The difference — the entry and the end
 

package/.claude/skills/workflow-commands/halfrun.md

@@ -2,13 +2,9 @@
 
 When this run files a new Issue, file it with `pnpm josh issue:file`, which lints the body and applies the classification labels it declares beside the `--depth` and `--route` labels; `prompts/collaboration-workflow/issue-template.md` is the single source for this classification.
 
-`halfrun` sits between `kickoff` (plan only) and `fullrun` (full execution with auto-merge). It
-implements the change and runs the full verification gate, then **stops before commit** — nothing is
-committed, pushed, or opened as a PR — so a person verifies the working tree by hand. Use it when a change needs human eyes before shipping.
-
-**This file is the manifest.** The entry sequence and the stop branches are `entry-sequence.md`,
-shared with `fullrun` and `prrun`; this file names only what is `halfrun`'s own. History:
-`docs/maintainers/halfrun-rationale.md` → "Where each rule came from".
+`halfrun` implements the change and runs the full verification gate, then **stops before commit** —
+nothing is committed, pushed, or opened as a PR — so a person verifies the working tree by hand. The
+entry sequence and the stop branches are `entry-sequence.md`.
 
 ## The difference — the entry
 

package/.claude/skills/workflow-commands/into-target.md

@@ -2,8 +2,7 @@
 
 **This file is the suffix's single source, read at its point of use — the moment a `new` entry is
 typed with an `into <target>` suffix, not at any entry.** A run given a `#N` or a bare `new` never
-reaches it. `SKILL.md` → §2's table keeps the trigger and points here. Rationale:
-`docs/maintainers/into-target-rationale.md` → "Why the suffix reads as it does".
+reaches it.
 
 `kickoff new` / `fullrun new` / `halfrun new` accept a suffix naming the epic the run's artifact
 belongs to. Without it the artifact belongs to no epic, and `epic:next` only ever offers an epic's

package/.claude/skills/workflow-commands/issue-comments.md

@@ -1,7 +1,6 @@
 # An Issue's comments are part of the Issue
 
-**The single source of the comment read**, read before implementing a `#N` Issue. Rationale and
-history: `docs/maintainers/issue-comments-rationale.md` → "Why comments are read".
+Read before implementing a `#N` Issue.
 
 **Every `#N` entry point reads the Issue's comments before it implements** — `fullrun`, `halfrun` and
 `kickoff`; a `backlogrun` named issue and epic child inherit it through `fullrun`. One call, in the same
@@ -73,7 +72,8 @@ one this run still owes.
 body. A thread longer than the Issue is the pre-implementation reading `delegation.md` describes: brief
 a unit to return **the agreements in force plus the comment URLs that carry them**, never the text.
 
-**`pnpm josh rule:guard` refuses the body-only read** (`prompts/collaboration-workflow/rule-delivery.md`).
+**Under Claude Code the hook prepends the comments to a line that opens with a body-only `gh api` read
+and refuses every other body-only read; the Codex adapter refuses them all** (`prompts/collaboration-workflow/rule-delivery.md`).
 **This file is the rule, not the hook** — a session without hooks still owes the read.
 
 ## A person's update mid-run

package/.claude/skills/workflow-commands/issue-scout.md

@@ -28,8 +28,9 @@ pnpm josh issue:file "<title>" --body-file <complete-draft.md> --depth <n> --dis
   `add_to_epic` / `create_epic` Tier A and `ask` a stop, in exactly the reading `into-target.md`'s
   `into <target>` suffix would have given by hand. Where the user typed `into <target>`, that naming wins.
 - **`Epic: not asked` is not `Epic: none`.** The epic half decides from the issue numbers the body
-  names. **Cite `#N` in the body whenever the work follows an existing Issue** — one line is enough,
-  and naming the epic itself (`part of epic #<E>`) is answered with that epic.
+  names in its acceptance criteria or its `parent: #N` line; a background mention does not count.
+  **Cite `#N` there whenever the work follows an existing Issue** — one line is enough, and naming
+  the epic itself (`parent: #<E>`) is answered with that epic.
 - **`epic:bundle` then runs on the new Issue, in the same call.** Act on its printed answer; a `⚠`
   means rerun `pnpm josh epic:bundle <N>` — the Issue exists, so never refile; a placing answer
   reads the `epic-commands` skill.

package/.claude/skills/workflow-commands/latest-gate.md

@@ -1,9 +1,7 @@
 # The dependency update — when `josh latest` runs
 
 `josh latest` updates every dependency, the published ranges, `pnpm audit` and pnpm, in that
-order and over the network. This file is the **single source** of when it runs; every entry point
-references it and none restates it. History: `docs/maintainers/latest-gate-rationale.md` → "Where
-each rule came from".
+order and over the network.
 
 ## Ask the command; do not decide
 
@@ -59,8 +57,6 @@ merge is CI**: the `Security Audit` job runs on every pull request and is one of
 
 **The lock file the update rewrites lands with whichever issue ran it.** `josh latest` leaves
 `pnpm-lock.yaml` modified and that issue's `pnpm josh git -y` commits it. Should the issue then fail
-CI on a bump rather than on its own change, fix it forward before parking the issue for it. Rationale
-for the elapsed-time window: `docs/maintainers/latest-gate-rationale.md` → "Why an elapsed-time
-window rather than once per batch".
+CI on a bump rather than on its own change, fix it forward before parking the issue for it.
 
 `docs/josh-commands-automation.md` documents the command itself.

package/.claude/skills/workflow-commands/needs-human-review.md

@@ -1,8 +1,6 @@
 # `needs-human-review` — the child that stops before its commit
 
-**The single source of the label**, read at its point of use — the moment `pnpm josh issue:state <N>`
-answers `human_review: yes`. Rationale and history: `docs/maintainers/needs-human-review-rationale.md`
-→ "Why the label exists".
+Read the moment `pnpm josh issue:state <N>` answers `human_review: yes`.
 
 An issue carrying **`needs-human-review`** is degraded to a `halfrun`-shaped stop, whichever entry
 point reached it — `fullrun` or `backlogrun` — and the label may be applied **only by a person**.
@@ -46,8 +44,7 @@ gh api repos/{owner}/{repo}/labels -f name=needs-human-review -f color=d93f0b -f
 **It is not `needs-decision`**: `needs-decision` withholds a run's *start*; this withholds its *end*.
 So a `needs-human-review` issue is still offered, and a child stopped by it **goes on holding its
 repository** — `scripts/issue/issue-labels.ts` keeps it out of `NOT_DIRECTLY_RUNNABLE_LABELS` and
-`scripts/epic/epic-busy.ts` keeps it out of the parked set (`docs/maintainers/needs-human-review-rationale.md`
-→ "Why it is not `needs-decision`").
+`scripts/epic/epic-busy.ts` keeps it out of the parked set.
 
 Each entry point's own branch stays in its own file — `fullrun.md`, `halfrun.md`,
 `backlogrun.md` — and routes here for the definition.

package/.claude/skills/workflow-commands/observation-filing.md

@@ -59,8 +59,6 @@ gh api repos/{owner}/{repo}/issues/<N>/labels -f 'labels[]=depth:1'   # an Issue
 - **An Issue carrying more than one counts as the lowest depth present.**
 - **An `epic` takes no depth label** and is excluded from the share's denominator.
 
-Rationale: `docs/maintainers/observation-filing-rationale.md` → "Why the depth label is applied at filing".
-
 - **A discretionary observation at depth 1 or deeper is filed only where it can cite the depth-0 work
   it stopped or delayed** — an Issue number or a run, never "this would slow runs down". **Cannot cite
   one, it is not filed**: it goes to the ledger (`observation-ledger.md`); the blockage arriving or a
@@ -74,12 +72,9 @@ Rationale: `docs/maintainers/observation-filing-rationale.md` → "Why the depth
   - **Cannot write both, it is not filed** — it goes to the ledger.
 - **This narrows depth 2 alone, and the exemptions above carry over unchanged.**
 
-Rationale: `docs/maintainers/observation-filing-rationale.md` → "Why depth gates a discretionary filing".
-
 **It governs this route only — the fourth row of `prerequisite.md`'s table.** A review finding routed
 to branch 2 of `prompts/review.md` → "Review round cap" is filed under that section's own bar and
 **does not take the depth test**. **That bar is the reason, and the subject's depth is not.**
-Rationale: `docs/maintainers/observation-filing-rationale.md` → "Why a review branch-2 filing skips the depth test".
 
 **And a PR that *adds* a measurement names its reader in the same way** — the Issue that read the value
 to decide something, or the path of the rule that reads it. **A measurement with no reader is not
@@ -98,8 +93,6 @@ added.** `route:tier-a` and `route:interrupt` carry over unchanged.
 
 **Two readings of the same backlog give the same number.**
 
-Rationale: `docs/maintainers/observation-filing-rationale.md` → "Why the depth-0 denominator is fixed".
-
 **What the number is for is not decided here** — no `backlog:next` change and no target value until it
 has been measured the same way more than once.
 
@@ -114,10 +107,3 @@ run's ceiling.
 appends what is left.** **The 10-per-run ceiling for this route is the parent's to count.** **Lines
 its own `review:record` and `measure:rerun` write are not this route** — they go to its issue's file in
 its lane (`observation-ledger.md` → "The ledger — where an observation that cannot cite a blockage goes").
-
-Rationale: `docs/maintainers/observation-filing-rationale.md` → "Why a delegated child neither files nor appends".
-
-**This file is the single source of every procedure above**; nothing under
-`prompts/collaboration-workflow/` restates it.
-
-Provenance: `docs/maintainers/observation-filing-rationale.md` → "Where each rule came from".

package/.claude/skills/workflow-commands/observation-ledger.md

@@ -1,14 +1,11 @@
 # The observation ledger — grammar, commit path and promotion
 
 **Read only when the depth test in `observation-filing.md` turns an observation away, or a user
-reports a bug** (its kind of miss, below), in the turn that appends the line. Single source of the
-ledger's grammar, commit path and second-sighting promotion. Provenance:
-`docs/maintainers/observation-ledger-rationale.md` → "Where each rule came from".
+reports a bug** (its kind of miss, below), in the turn that appends the line.
 
 ## The ledger — where an observation that cannot cite a blockage goes
 
-**An observation the depth test turns away is recorded in the ledger, not discarded.** Rationale:
-`docs/maintainers/observation-ledger-rationale.md` → "Why the ledger exists".
+**An observation the depth test turns away is recorded in the ledger, not discarded.**
 
 - **The destination is the `.josh/observations/` directory in the repository the observation is
   about**, **one file per issue**: `<N>.md` for the issue the run is executing (its branch's number,
@@ -60,8 +57,7 @@ blocked depth-0 work is filed as before.
 
 ## The commit path — how an appended line reaches the default branch
 
-**An append nobody commits is an append nobody can count.** Rationale:
-`docs/maintainers/observation-ledger-rationale.md` → "Why the ledger has a commit path".
+**An append nobody commits is an append nobody can count.**
 
 - **A run's appended lines ride its own commit** — `pnpm josh git` stages `.josh/observations/`
   (`scripts/git/git-staging.ts`). **Record before the commit, not after the merge:** a finding recorded
@@ -87,8 +83,7 @@ blocked depth-0 work is filed as before.
 
 ## The second sighting is what files it
 
-**A repeat is the citation** — counted, not judged (`docs/maintainers/observation-ledger-rationale.md`
-→ "Why a second sighting files"):
+**A repeat is the citation** — counted, not judged:
 
 - **On `observation:record` answering `file`, the observation is filed**, at depth 1 or deeper, with
   no depth-0 citation (only when exactly one earlier sighting exists).

package/.claude/skills/workflow-commands/pre-gate-cut.md

@@ -2,9 +2,9 @@
 
 The **pre-gate cut**: a dispatched lane child ends its process the moment implementation is done, and a
 **fresh** process resumes the same lane from the gate onward, without the implementation's accumulated
-context. Rationale: `docs/maintainers/pre-gate-cut-rationale.md` → "Why the cut exists".
+context.
 
-This file is the single source of the boundary: `run:cut` takes it, `run:cut --resume` is the fresh
+`run:cut` takes the boundary, `run:cut --resume` is the fresh
 process's entry check. A second boundary — the implementation-phase cut, _during_ implementation — is
 below; it states only what differs.
 
@@ -55,8 +55,7 @@ pnpm josh run:cut <N>
 ### The gate refuses until the cut has been taken
 
 `pnpm josh rule:guard` **refuses `pnpm josh gate`** in a lane with no cut record carried, handing back
-the command above. Rationale: `docs/maintainers/pre-gate-cut-rationale.md` → "Why the rules are
-guards, not prose".
+the command above.
 
 - **It fires for a marked child and nowhere else**: the working directory is `<lane root>/<issue
   number>` **and** `JOSH_LANE_CHILD` names that issue. `run:cut` uses an open-lane lookup instead, so
@@ -66,8 +65,7 @@ guards, not prose".
 - **It fires once per run.**
 - **`--resume`, `--end` and `--json` do not count as taking the cut.**
 
-Its row: `prompts/collaboration-workflow/rule-delivery.md`. Suites: `docs/maintainers/pre-gate-cut-rationale.md`
-→ "Which suites pin each guard".
+Its row: `prompts/collaboration-workflow/rule-delivery.md`.
 
 ## Resuming — the fresh process's entry check
 
@@ -92,8 +90,7 @@ pnpm josh run:cut --resume <N>
 ### The stage is passed to the resumed child, not reconstructed by it
 
 **Skip the entry it has already done**: do not re-read the workflow skill, repeat the split assessment
-or re-normalize the title; the plan and decisions are read back from the issue. Rationale:
-`docs/maintainers/pre-gate-cut-rationale.md` → "Why the resume carries what it carries".
+or re-normalize the title; the plan and decisions are read back from the issue.
 
 ## What is carried, and what is not
 
@@ -127,21 +124,21 @@ Same `cost_verdict.per_request_cost` through `cost_cli.session_verdict` as `back
 **The trigger**: `pnpm josh rule:guard` refuses an `Edit` / `Write` in a dispatched lane child over
 threshold, handing back `pnpm josh run:cut --impl <N> --handoff <path>`. `cut` ends the turn; the
 fresh process's `run:cut --resume <N>` answers `resume-impl` — **the implementation resume clears the
-record**, so the cut may fire again. **A cut that relaunches its successor owes no Telegram**. Outside a
+record**, so the cut may fire again. **A cut that relaunches its successor owes no Telegram** — the
+`Stop` hook reads the relaunch off the turn's own `run:cut` output, not off the record the resume
+clears. Outside a
 lane, `run:cut --impl` prints the held run's instruction: on `over`, keep the hold, send a
 `confirmation` Telegram naming `fullrun #<N>`, end the turn. **It fires on every threshold crossing,
 not once per run**; **An edit reissued right after a refusal passes**; **An unmeasurable session
-warrants the cut**; **It is silent between a cut and its resume**. Rationale:
-`docs/maintainers/pre-gate-cut-rationale.md` → "Why the rules are guards, not prose"
-(`scripts/rules/implementation-cut.ts`). A child that ended without cutting is detected by
+warrants the cut**; **It is silent between a cut and its resume** (`scripts/rules/implementation-cut.ts`).
+A child that ended without cutting is detected by
 `pnpm josh run:ending <N> --output <path>`.
 
 ## The threshold
 
 `CONTEXT_CUT_THRESHOLD` and `cost_verdict.per_request_cost` live in
 `scripts/cost-runtime/context-cut-payback.ts`; both cuts and the parent hand-off read the same verdict,
-and an unmeasurable session is always cut. Rationale: `docs/maintainers/pre-gate-cut-rationale.md` →
-"Why the threshold is a break-even". Both cuts end the turn **before** the gate, so the push is never a
+and an unmeasurable session is always cut. Both cuts end the turn **before** the gate, so the push is never a
 turn boundary (`chain-rule.md`).
 
 ## A lane child records its park before it stops
@@ -162,5 +159,3 @@ until then — **It fires once per run.** (`scripts/rules/lane-park.ts`).
 fires; `pnpm josh rule:guard` refuses `AskUserQuestion` for a marked lane child on every occurrence — park the question instead.
 `pnpm josh run:ending` lifts a slipped ask into the park basis (`scripts/rules/lane-interactive-ask.ts`,
 `scripts/agent/interactive-ask.ts`).
-
-Provenance of each rule: `docs/maintainers/pre-gate-cut-rationale.md` → "Where each rule came from".

package/.claude/skills/workflow-commands/prerequisite.md

@@ -1,8 +1,7 @@
 # A prerequisite discovered mid-run — a dependency, not a park
 
 **The single source of the prerequisite branch**, read at its point of use — the moment a run
-discovers that another Issue in this repository has to land first. History:
-`docs/maintainers/prerequisite-rationale.md` → "Where each rule came from".
+discovers that another Issue in this repository has to land first.
 
 **A prerequisite discovered mid-run is a dependency, not a park** — the Issue in hand is still one
 deliverable, it just needs another one before it.

package/.claude/skills/workflow-commands/progress-watcher.md

@@ -40,7 +40,6 @@ silence clock (`docs/josh-commands-run.md` → "`josh run:progress`").
 `JOSH_PROGRESS_INTERVAL_MINUTES` moves both sides; `josh` → `progress_interval_minutes` in
 `package.json` sits one step below it. **`--interval` moves the watcher alone** — quieter, never the
 guard stricter.
-Rationale: `docs/maintainers/progress-watcher-rationale.md` → "Why the heartbeat reads as it does".
 
 ### What a report says
 
@@ -61,8 +60,7 @@ off-screen, start `pnpm josh run:board --every <minutes>` in the background (`do
 
 **A stop is the only interrupt**: a `backlogrun` that has stopped ends with
 `pnpm josh run:carry --end --stopped "<reason>"`, which sends one ⏸️ confirmation; a parked child sends
-its own (`backlogrun-park.md`). Rationale: `docs/maintainers/progress-watcher-rationale.md` → "Why the
-signal tiers are split this way".
+its own (`backlogrun-park.md`).
 
 ### Who starts it, and what counts as a report
 
@@ -85,7 +83,4 @@ tool result only you read is not one.** `--output` is omitted there, and `record
 **A run that merges needs no teardown; a run that stops has to end the reporting itself** — **no
 further `--wait` is started** after the stop notification, and the running one is stopped in the same
 turn: `halfrun`'s stop before commit, a `needs-human-review`, split or prerequisite stop, a
-`backlogrun` named issue's failure stop. Rationale: `docs/maintainers/progress-watcher-rationale.md` →
-"Why the watcher runs where it does".
-
-Provenance of each rule: `docs/maintainers/progress-watcher-rationale.md` → "Where each rule came from".
+`backlogrun` named issue's failure stop.

package/.claude/skills/workflow-commands/prrun.md

@@ -1,10 +1,8 @@
 # `prrun` — the manifest (plan → implement → PR → green → stop, a person merges)
 
-`prrun` sits between `halfrun` (stop before commit) and `fullrun` (auto-merge). It runs `fullrun`
-up to a green, mergeable pull request and **stops before the merge**, so a person merges by hand.
-**Read `fullrun.md` and `entry-sequence.md` for every step** — the entry
-sequence, the step lists, the gate, the review and the stop branches are `fullrun`'s, unchanged. This
-file names only the difference.
+`prrun` runs `fullrun` up to a green, mergeable pull request and **stops before the merge**, so a
+person merges by hand. **Read `fullrun.md` and `entry-sequence.md` for every step** — the entry
+sequence, the step lists, the gate, the review and the stop branches are `fullrun`'s, unchanged.
 
 ## The difference — the entry
 

package/.claude/skills/workflow-commands/retrospective.md

@@ -8,9 +8,6 @@ mark the step done. Read this file in full, in the same turn, before filing.
 drained, *before* the idle watch, so the watch picks up what it files; a run that stops without
 draining — the failure guard, `--idle 0` — still prints it at the stop position. Kit-only.
 
-Rationale: `docs/maintainers/retrospective-rationale.md` → "Why the retrospective is read at its step";
-provenance: `docs/maintainers/retrospective-rationale.md` → "Where each rule came from".
-
 ## The digest is read, not skimmed
 
 The command `run:step` prints folds four existing measurements into one digest — it adds none:
@@ -30,9 +27,12 @@ and anything the run surfaced that lives outside it).
 **The filing condition is the existing depth test, unchanged** (`observation-filing.md` → "The depth
 test"). What cannot pass it is not filed — not a shortfall, just not yet a finding.
 
+**A cost regression is filed.** The digest's `File a cost regression: …` line passes the depth test as
+printed — measured, with the command it names as the reproduction — and ranks first: one Issue names
+every regressed row, and the scout keeps a repeat sighting from filing twice.
+
 **Order what passes by effect, and file the top two.** **The third onward is stacked in the observation
 ledger** (drained by `pnpm josh observations:flush`). **File nothing when nothing passes.**
-`docs/maintainers/retrospective-rationale.md` → "Why the top two are a selection, not a ration".
 
 **Exclude what is already filed or already done, through the existing scout** (`issue-scout.md`): file
 with `pnpm josh issue:file`, which scouts first — an **open** candidate covering it means do not file, a

package/.claude/skills/workflow-commands/split-assessment.md

@@ -1,9 +1,7 @@
 # The split assessment — one definition, every entry point
 
 Before any entry point starts work on an Issue, decide whether the request is **one** deliverable or
-several. This file is the single definition; every command applies it identically. Reasons:
-`docs/maintainers/split-assessment-rationale.md` → "Why the default is not to split" and
-`docs/maintainers/split-assessment-rationale.md` → "Why diff size is not a reason to split".
+several. Every command applies it identically.
 
 ## The question
 

package/.claude/skills/workflow-commands/target-repository.md

@@ -2,8 +2,7 @@
 
 **This file is the prefix's single source, read at its point of use — the moment an entry is typed with an
 `owner/repo#` prefix (or a short `repo#` name), not at any entry.** A run given a bare `#N` or `new`
-targets the session's own repository and never reaches it. `SKILL.md` → §2's table keeps the trigger and
-points here. Rationale: `docs/maintainers/target-repository-rationale.md` → "Why the prefix reads as it does".
+targets the session's own repository and never reaches it.
 
 Every entry point takes the target repository in front of the Issue reference. Without it the target
 is the repository the session runs in.

package/.claude/skills/workflow-commands/working-tree-hold.md

@@ -1,7 +1,6 @@
 # The working-tree hold — one run per tree
 
-**The single source of the hold**, read at its point of use — the moment a run is about to claim or
-release the tree. History: `docs/maintainers/working-tree-hold-rationale.md` → "Where each rule came from".
+Read the moment a run is about to claim or release the tree.
 
 **Ask `pnpm josh run:hold` before anything else, and obey what it answers** — the first call of
 `fullrun` and `halfrun`, before the title, before `pnpm josh ms`, and **before a `new` entry files its
@@ -23,8 +22,7 @@ pnpm josh run:release --force # a record left behind by a run that has ended
 
 **The unit is the working tree** — one branch, one index and one uncommitted diff, and a linked work
 tree has its own three. **`backlogrun`'s per-repository guard (`epic-busy.ts`) is a separate layer.** **`kickoff`
-does not claim it** (`docs/maintainers/working-tree-hold-rationale.md` → "Why the unit is the working
-tree").
+does not claim it.**
 
 **Claim it in the checkout the run will edit** — a cross-repository `fullrun owner/repo#N` resolves
 that checkout from `pnpm josh doctor` **first** (a read) and claims there.

package/.codex/hooks.json

@@ -6,7 +6,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision",
+						"command": "if project_root=\"$(unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\"; fi && cd \"$project_root\" && sh scripts/hooks/run-hook.sh audit-provision",
 						"timeout": 180
 					}
 				]
@@ -17,7 +17,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
+						"command": "if project_root=\"$(unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\"; fi && cd \"$project_root\" && sh scripts/hooks/run-hook.sh session-lang",
 						"timeout": 10
 					}
 				]
@@ -25,11 +25,11 @@
 		],
 		"PreToolUse": [
 			{
-				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|apply_patch",
+				"matcher": "Bash|Edit|Read|Write|AskUserQuestion|Agent|Task|apply_patch",
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
+						"command": "if project_root=\"$(unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\"; fi && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter pretool",
 						"timeout": 20
 					}
 				]
@@ -41,7 +41,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
+						"command": "if project_root=\"$(unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\"; fi && cd \"$project_root\" && sh scripts/hooks/run-hook.sh codex-hook-adapter posttool",
 						"timeout": 90
 					}
 				]
@@ -53,7 +53,7 @@
 				"hooks": [
 					{
 						"type": "command",
-						"command": "project_root=\"$(env -u GIT_ALTERNATE_OBJECT_DIRECTORIES -u GIT_COMMON_DIR -u GIT_DIR -u GIT_INDEX_FILE -u GIT_NAMESPACE -u GIT_OBJECT_DIRECTORY -u GIT_WORK_TREE git rev-parse --show-toplevel 2>/dev/null || git rev-parse --show-toplevel)\" && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
+						"command": "if project_root=\"$(unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; git rev-parse --show-toplevel 2>/dev/null)\"; then unset GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_DIR GIT_INDEX_FILE GIT_NAMESPACE GIT_OBJECT_DIRECTORY GIT_WORK_TREE; else project_root=\"$(git rev-parse --show-toplevel)\"; fi && cd \"$project_root\" && sh scripts/hooks/run-hook.sh stop-guard",
 						"timeout": 20
 					}
 				]

package/.github/actions/setup-node/action.yml

@@ -26,7 +26,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '24'
         registry-url: ${{ inputs.registry-url }}

package/.github/workflows/ci.yml

@@ -493,7 +493,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run security audit
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
         with:
           scan-args: --lockfile=pnpm-lock.yaml