@kennethsolomon/shipkit 3.10.0 → 3.10.2

package/skills/sk:debug/debug_conductor.py

@@ -75,7 +75,6 @@ class DebugConductor:
             if not self._can_proceed(step):
                 print(f"\n⛔ BLOCKED: {self._gate_reason(step)}")
                 print("\nRun /debug again to continue from this step.")
-                self._save_progress()
                 return
 
             # Run step and update state
@@ -94,7 +93,6 @@ class DebugConductor:
                 proceed = input(f"\n✅ Step {step_num} complete. Continue to step {step_num + 1}? (y/n): ").strip().lower()
                 if proceed not in ['y', 'yes', '']:
                     print(f"Pausing after step {step_num}. Run /debug again to continue.")
-                    self._save_progress()
                     return
 
         print("\n" + "="*70)
@@ -161,12 +159,6 @@ class DebugConductor:
             return "No confirmed hypothesis yet—cannot propose fix."
         return "Precondition not met for this step."
 
-    def _save_progress(self):
-        """Save current state for resumption (optional)."""
-        # Could implement checkpoint system here
-        pass
-
-
 def main():
     """Entry point for /debug skill."""
     conductor = DebugConductor()

package/skills/sk:debug/lib/findings_writer.py

@@ -44,8 +44,8 @@ class FindingsWriter:
             self._append_entry(entry)
             print(f"\n✅ Findings written to {self.findings_path}")
             return True
-        except Exception as e:
-            print(f"\n❌ Error writing findings: {e}")
+        except OSError as e:
+            print(f"\n❌ Error writing findings to {self.findings_path}: {e}")
             return False
 
     def _ensure_file_exists(self):

package/skills/sk:debug/lib/lessons_writer.py

@@ -66,8 +66,8 @@ class LessonsWriter:
             self._append_lesson(entry)
             print(f"\n✅ New lesson added to {self.lessons_path}")
             return True
-        except Exception as e:
-            print(f"\n❌ Error writing lesson: {e}")
+        except OSError as e:
+            print(f"\n❌ Error writing lesson to {self.lessons_path}: {e}")
             return False
 
     def _ensure_file_exists(self):

package/skills/sk:debug/lib/step_runner.py

@@ -1,9 +1,11 @@
 """Execute individual debug steps (3-11)."""
 
+from __future__ import annotations
+
+import shlex
 import subprocess
-from typing import Dict
 from pathlib import Path
-import sys
+from typing import Dict
 
 
 class StepRunner:
@@ -42,8 +44,7 @@ class StepRunner:
             # Recent commits
             print("📋 Recent commits:")
             result = subprocess.run(
-                "git log --oneline -10",
-                shell=True,
+                ["git", "log", "--oneline", "-10"],
                 capture_output=True,
                 text=True
             )
@@ -52,8 +53,7 @@ class StepRunner:
             # Recent diffs
             print("\n📋 Recent file changes:")
             result = subprocess.run(
-                "git diff HEAD~3 --stat",
-                shell=True,
+                ["git", "diff", "HEAD~3", "--stat"],
                 capture_output=True,
                 text=True
             )
@@ -107,8 +107,7 @@ class StepRunner:
 
         try:
             result = subprocess.run(
-                command,
-                shell=True,
+                shlex.split(command),
                 capture_output=True,
                 text=True,
                 timeout=30
@@ -277,8 +276,7 @@ class StepRunner:
         if command:
             try:
                 result = subprocess.run(
-                    command,
-                    shell=True,
+                    shlex.split(command),
                     capture_output=True,
                     text=True,
                     timeout=30

package/skills/sk:e2e/SKILL.md

@@ -184,17 +184,17 @@ If any fail → apply Fix & Retest Protocol.
 
 When this gate requires a fix, classify it before committing:
 
-**a. Style/config/wording change** (CSS tweak, copy change, selector fix) → auto-commit with `fix(e2e): resolve failing E2E scenarios` and re-run `/sk:e2e`. Do not ask the user.
+**a. Style/config/wording change** (CSS tweak, copy change, selector fix) → include in the gate's squash commit and re-run `/sk:e2e`. Do not ask the user.
 
 **b. Logic change** (new branch, modified condition, new data path, query change, new function, API change) → trigger protocol:
 1. Update or add failing unit tests for the new behavior
 2. Re-run `/sk:test` — must pass at 100% coverage
-3. Auto-commit tests + fix together with `fix(e2e): [description]`.
+3. Commit tests + fix together with `fix(e2e): [description]`.
 4. Re-run `/sk:e2e` from scratch
 
 **Exception:** Formatter auto-fixes are never logic changes — bypass protocol automatically.
 
-Gates own their commits — the fix-commit-rerun loop is fully internal. No manual commit step needed after this gate.
+> Squash gate commits — collect all fixes for the pass, then one commit: `fix(e2e): resolve failing E2E scenarios`. Do not commit after each individual fix.
 
 **This gate cannot be skipped.** All scenarios must pass before proceeding to `/sk:update-task`.
 

package/skills/sk:fast-track/SKILL.md

@@ -61,15 +61,6 @@ Before proceeding, check the scope of planned changes:
 ### 6. Finalize
 - Run `/sk:finish-feature` for changelog + PR
 
-## Workflow Status
-
-Fast-track updates `tasks/workflow-status.md` with abbreviated steps:
-- Steps 1-2 (read): done
-- Steps 3-6 (explore, design, accessibility, plan): skipped (fast-track)
-- Steps 7-11 (branch, implement, commit): done
-- Steps 12-17 (gates): handled by `/sk:gates`
-- Steps 18-21 (update, finalize, sync, release): done as applicable
-
 ## Model Routing
 
 | Profile | Model |

package/skills/sk:frontend-design/SKILL.md

@@ -63,6 +63,235 @@ Interpret creatively and make unexpected choices that feel genuinely designed fo
 
 Remember: Claude is capable of extraordinary creative thinking. Don't hold back on the design direction — show what can be envisioned when thinking outside the box and committing fully to a distinctive aesthetic.
 
+## UX Quality Constraints
+
+Apply these rules as hard constraints during design. They are organized by priority — address CRITICAL issues first, then HIGH, then MEDIUM. Skip categories irrelevant to the current design (e.g., Charts for a landing page).
+
+| Priority | Category | Impact | Key Rule |
+|---|---|---|---|
+| 1 | Accessibility | CRITICAL | Contrast 4.5:1, keyboard nav, aria-labels, focus rings |
+| 2 | Touch & Interaction | CRITICAL | Min 44×44px targets, tap feedback, no hover-only |
+| 3 | Performance | HIGH | WebP/AVIF images, lazy load, skeleton screens, no layout shift |
+| 4 | Style Selection | HIGH | Match style to product type, SVG icons (never emoji), one primary CTA |
+| 5 | Layout & Responsive | HIGH | Mobile-first, breakpoints 375/768/1024/1440, no horizontal scroll |
+| 6 | Typography & Color | MEDIUM | Base 16px body, line-height 1.5, semantic color tokens |
+| 7 | Animation | MEDIUM | 150–300ms duration, transform/opacity only, respect prefers-reduced-motion |
+| 8 | Forms & Feedback | MEDIUM | Visible labels, error near field, loading → success/error on submit |
+| 9 | Navigation | HIGH | Bottom nav ≤5 items, predictable back, deep linking |
+| 10 | Charts & Data | LOW | Match chart to data type, accessible colors, legend visible |
+
+### 1. Accessibility (CRITICAL)
+
+- Minimum 4.5:1 contrast ratio for normal text (large text 3:1)
+- Visible focus rings on all interactive elements (2–4px outline)
+- Descriptive alt text on all meaningful images
+- `aria-label` on icon-only buttons
+- Tab order matches visual order; full keyboard navigation supported
+- `label[for]` on every form input — never placeholder-only
+- Never convey information by color alone (add icon or text)
+- Respect `prefers-reduced-motion` — reduce or disable animations when set
+- Sequential heading hierarchy h1→h6, no skipped levels
+- Screen reader logical reading order; meaningful accessibilityLabel/Hint
+- Skip-to-main-content link for keyboard users
+
+### 2. Touch & Interaction (CRITICAL)
+
+- Minimum 44×44pt (iOS) / 48×48dp (Android) tap target — expand hitSlop if icon is smaller
+- Minimum 8px gap between adjacent touch targets
+- Never rely on hover-only for primary interactions — use click/tap
+- Disable buttons during async operations; show spinner or progress
+- Add `cursor-pointer` to all clickable elements (web)
+- Provide visual feedback on press within 100ms (ripple, opacity, elevation)
+- Use `touch-action: manipulation` to eliminate 300ms tap delay (web)
+- Avoid horizontal swipe on scrollable content — prefer vertical scroll
+- Don't block system gestures (back swipe, Control Center, home indicator)
+
+### 3. Performance (HIGH)
+
+- Use WebP/AVIF with `srcset`/`sizes`; lazy load non-hero images
+- Declare `width`/`height` or `aspect-ratio` on images to prevent CLS
+- Use `font-display: swap` or `optional` to avoid FOIT
+- Preload only critical fonts — avoid preloading every weight variant
+- Lazy load non-hero components via dynamic import / route-level splitting
+- Load third-party scripts `async`/`defer`
+- Reserve space for async content to avoid layout jumps (CLS < 0.1)
+- Virtualize lists with 50+ items
+- Use skeleton/shimmer for loads >300ms — never a blank frame
+- Keep per-frame work <16ms (60fps); move heavy tasks off main thread
+- Debounce/throttle scroll, resize, and input handlers
+
+### 4. Style Selection (HIGH)
+
+- Match style to product type and industry — no random style mixing
+- Use SVG icons (Heroicons, Lucide) — never emojis as structural icons
+- Use one icon set throughout — consistent stroke width, corner radius, filled vs outline
+- Each screen has exactly one primary CTA; secondary actions are visually subordinate
+- Apply a consistent elevation/shadow scale — no arbitrary shadow values
+- Design light and dark variants together; don't assume light values work in dark mode
+- Blur signals background dismissal (modals, sheets) — not decoration
+- Respect platform idioms (iOS HIG vs Material Design) for navigation, controls, motion
+
+### 5. Layout & Responsive (HIGH)
+
+- `<meta name="viewport" content="width=device-width, initial-scale=1">` — never disable zoom
+- Design mobile-first; scale up to 768, 1024, 1440
+- No horizontal scroll on mobile; all content fits viewport width
+- Use 4pt/8dp incremental spacing system throughout
+- Consistent `max-w-6xl`/`7xl` container on desktop
+- Define a z-index scale (e.g., 0 / 10 / 20 / 40 / 100 / 1000) — no arbitrary values
+- Fixed navbars/bottom bars must pad underlying scroll content
+- Use `min-h-dvh` instead of `100vh` on mobile
+- Establish hierarchy via size, spacing, contrast — not color alone
+- Core content first on mobile; fold or hide secondary content
+
+### 6. Typography & Color (MEDIUM)
+
+- Minimum 16px body text on mobile (prevents iOS auto-zoom)
+- Line-height 1.5–1.75 for body text
+- 60–75 characters per line on desktop; 35–60 on mobile
+- Consistent type scale (e.g., 12 / 14 / 16 / 18 / 24 / 32)
+- Bold headings (600–700), regular body (400), medium labels (500)
+- Define semantic color tokens (`--color-primary`, `--color-error`, `--color-surface`) — never raw hex in components
+- Dark mode: use desaturated/lighter tonal variants, not inverted colors; test contrast independently
+- All foreground/background pairs must meet 4.5:1 (AA); use a contrast checker
+- Use tabular/monospaced figures for prices, data columns, and timers
+- Use whitespace intentionally to group related items and separate sections
+
+### 7. Animation (MEDIUM)
+
+- Duration: 150–300ms for micro-interactions; complex transitions ≤400ms; never >500ms
+- Animate `transform` and `opacity` only — never `width`, `height`, `top`, `left`
+- Use ease-out for entering elements; ease-in for exiting
+- Every animation expresses cause-effect — no purely decorative motion
+- State changes (hover, active, expanded, modal) animate smoothly — no snapping
+- Page transitions maintain spatial continuity (shared element, directional slide)
+- Exit animations should be 60–70% of enter duration to feel responsive
+- Stagger list/grid item entrance by 30–50ms per item
+- Animations must be interruptible — user tap cancels in-progress animation immediately
+- Never block user input during an animation
+- Scale feedback on press: subtle 0.95–1.05 scale on tappable cards/buttons
+- `prefers-reduced-motion` must reduce or disable animations entirely
+
+### 8. Forms & Feedback (MEDIUM)
+
+- Every input has a visible label — never placeholder-only
+- Show errors immediately below the related field (not only at the top)
+- Mark required fields (asterisk or explicit label)
+- Submit button: loading state → success or error state
+- Auto-dismiss toasts in 3–5s; toasts must not steal focus (`aria-live="polite"`)
+- Confirm before destructive actions (modals, undo toasts)
+- Validate on blur, not on every keystroke
+- Use semantic input types (`email`, `tel`, `number`) for correct mobile keyboard
+- Provide show/hide toggle on password fields
+- Error messages state the cause + how to fix — not just "Invalid input"
+- Multi-step forms show a step indicator and allow back navigation
+- After submit error, auto-focus the first invalid field
+
+### 9. Navigation (HIGH)
+
+- Bottom navigation: maximum 5 items with both icon and text label
+- Back navigation is predictable and restores scroll/filter state
+- All key screens are deep-linkable via URL/route
+- Current location is visually highlighted in navigation (color, weight, indicator)
+- Modals have a clear close affordance; support swipe-down to dismiss on mobile
+- Never use modals for primary navigation flows
+- Large screens (≥1024px) prefer sidebar; small screens use bottom/top nav
+- Don't mix Tab + Sidebar + Bottom Nav at the same hierarchy level
+- Dangerous actions (logout, delete account) are visually separated from normal nav
+- After route change, move focus to main content region for screen readers
+
+### 10. Charts & Data (when applicable)
+
+- Match chart type to data: trend → line, comparison → bar, proportion → pie/donut
+- Avoid pie/donut for >5 categories — use bar chart instead
+- Use accessible color palettes; never red/green only (colorblind users)
+- Always show a legend near the chart (not below a scroll fold)
+- Provide tooltips/data labels on hover (web) or tap (mobile)
+- Label all axes with units; avoid rotated labels on mobile
+- Charts must reflow on small screens (horizontal bar instead of vertical, fewer ticks)
+- Show skeleton/shimmer while chart data loads — never an empty axis frame
+- Grid lines should be low-contrast (e.g., `gray-200`) so they don't compete with data
+- Provide a text summary or `aria-label` describing the chart's key insight
+
+---
+
+## Professional UI Anti-Patterns
+
+These are frequently overlooked issues that make UI look unprofessional. Flag any of these in the design spec so implementation avoids them.
+
+### Icons & Visual Elements
+- **No emoji as icons** — use Heroicons, Lucide, or equivalent SVG sets
+- **No raster icons** — SVG only; PNGs blur and can't adapt to dark mode
+- **No mixed icon styles** — pick one set; consistent stroke width and fill style throughout
+- **No inconsistent sizing** — define icon size tokens (sm/md/lg = 16/20/24pt)
+- **Pressed states must not shift layout** — use opacity/color/elevation, not transforms that reflow siblings
+
+### Interaction
+- **No tap-only no-feedback** — every tappable element responds visually within 100ms
+- **No hover-only states on mobile** — hover states are fine for desktop, never the only affordance
+- **No disabled elements that look enabled** — use `opacity: 0.38–0.5` + `cursor: not-allowed` + semantic `disabled` attribute
+- **No precision-required targets** — avoid requiring taps on thin edges or pixel-perfect areas
+
+### Light/Dark Mode
+- **No hardcoded hex in components** — use semantic tokens that map per theme
+- **No light-mode-only testing** — always verify dark mode contrast independently
+- **No weak modal scrims** — use 40–60% black so background doesn't compete with foreground
+- **No color-only state indicators** — always pair color with icon or label
+
+### Layout & Spacing
+- **No safe-area violations** — respect notch, Dynamic Island, and gesture bar on mobile
+- **No scroll content hidden behind fixed bars** — add correct insets
+- **No random spacing** — every gap follows the 4/8dp rhythm
+- **No edge-to-edge paragraphs on tablets** — constrain long-form text width for readability
+
+---
+
+## Pre-Delivery Checklist
+
+Include this checklist at the end of every design output. Implementation must pass all applicable items before shipping.
+
+```
+### Pre-Delivery Checklist
+
+**Accessibility**
+- [ ] All text contrast ≥4.5:1 (normal) or ≥3:1 (large/UI)
+- [ ] Focus rings visible on all interactive elements
+- [ ] All images/icons have alt text or aria-label
+- [ ] No color-only information conveyance
+- [ ] prefers-reduced-motion respected
+
+**Touch & Interaction**
+- [ ] All tap targets ≥44×44pt
+- [ ] Every tappable element has pressed-state feedback
+- [ ] No hover-only interactions on mobile
+- [ ] cursor-pointer on all clickable web elements
+
+**Layout**
+- [ ] No horizontal scroll at 375px
+- [ ] Safe areas respected (notch, gesture bar, tab bar)
+- [ ] Scroll content not hidden behind fixed bars
+- [ ] 4/8dp spacing rhythm consistent throughout
+
+**Typography & Color**
+- [ ] Body text ≥16px on mobile
+- [ ] Semantic color tokens used (no raw hex in components)
+- [ ] Dark mode contrast verified independently
+
+**Performance**
+- [ ] Images use WebP/AVIF with declared dimensions
+- [ ] Skeleton/shimmer shown for loads >300ms
+- [ ] No layout shift from async content (CLS < 0.1)
+
+**Animation**
+- [ ] All transitions 150–300ms
+- [ ] Only transform/opacity animated (no width/height/top/left)
+- [ ] Animations interruptible; no input blocking
+
+**Icons**
+- [ ] No emojis used as icons (SVG only)
+- [ ] Consistent icon family and stroke style throughout
+```
+
 ## Output Format
 
 End every `/sk:frontend-design` session with a structured summary:
@@ -93,6 +322,9 @@ End every `/sk:frontend-design` session with a structured summary:
 
 ### Implementation Notes
 [Specific Tailwind classes, CSS patterns, or gotchas for /sk:execute-plan]
+
+### Pre-Delivery Checklist
+[Copy the checklist from the UX Quality Constraints section above and mark which items are covered by this design, and which need special attention during implementation]
 ```
 
 After presenting the design summary, you **MUST** stop and ask — do not continue or summarize further:

package/skills/sk:gates/SKILL.md

@@ -65,11 +65,10 @@ All gates passed. Run /sk:update-task
 
 ## Failure Handling
 
-- Each agent handles its own fix → auto-commit → re-run loop internally
+- Each agent handles its own fix → re-run loop internally
+- **Squash gate commits:** When a gate requires fixes, collect all fixes for that pass, then make ONE commit: `fix(<gate>): resolve <gate> issues`. Do not commit after each individual fix.
 - If any agent fails after 3 attempts → stop all gates and report to user
 - Do NOT proceed to the next batch if the current batch has unresolved failures
-- Update `tasks/workflow-status.md` for each gate as it completes:
-  - Steps 12-17 marked `done` with attempt count in Notes
 
 ## 3-Strike Protocol
 

package/skills/sk:lint/SKILL.md

@@ -111,10 +111,10 @@ If any analyzer reports errors or the dep audit blocks:
 2. Re-run formatters (fixes may need formatting)
 3. Re-launch all analyzers in parallel
 4. Re-run dep audit if any dependency was fixed
-5. Auto-commit with message `fix(lint): resolve lint and dep audit issues` — do NOT ask the user
-6. Re-run from step 3 until every tool exits clean
+5. Re-run from step 3 until every tool exits clean
+6. Once all tools pass clean, make ONE squash commit: `fix(lint): resolve lint and dep audit issues` — do NOT ask the user
 
-> Gates own their commits — the fix-commit-rerun loop is fully internal. No manual commit step needed after this gate.
+> Squash gate commits — collect all fixes for the pass, then one commit. Do not commit after each individual fix.
 
 ### 7. Report Results
 
@@ -171,8 +171,8 @@ Read `.shipkit/config.json` from the project root if it exists.
 
 | Profile | Model |
 |---------|-------|
-| `full-sail` | sonnet |
-| `quality` | sonnet |
+| `full-sail` | opus (inherit) |
+| `quality` | opus (inherit) |
 | `balanced` | haiku |
 | `budget` | haiku |
 

package/skills/sk:perf/SKILL.md

@@ -12,8 +12,8 @@ Run this skill after implementing and passing lint/tests, but before `/sk:review
 
 ## Hard Rules
 
-- **Fix all critical and high in-scope findings** (files in `git diff main..HEAD --name-only`) immediately after the audit. Auto-commit with `fix(perf): resolve [severity] performance findings`. Re-run the audit until critical/high = 0.
-- **Medium/low in-scope findings:** fix them in the same commit if straightforward, otherwise log to `tasks/tech-debt.md`.
+- **Fix all critical and high in-scope findings** (files in `git diff main..HEAD --name-only`) immediately after the audit. Re-run the audit until critical/high = 0. Once clean, make ONE squash commit: `fix(perf): resolve performance findings`.
+- **Medium/low in-scope findings:** fix them in the same pass if straightforward, otherwise log to `tasks/tech-debt.md`.
 - **Pre-existing findings** (files outside the current branch diff): log to `tasks/tech-debt.md` using this format — do NOT fix inline:
   ```
   ### [YYYY-MM-DD] Found during: sk:perf
@@ -21,7 +21,7 @@ Run this skill after implementing and passing lint/tests, but before `/sk:review
   Issue: description of the performance issue
   Severity: critical | high | medium | low
   ```
-- **Gates own their commits** — the fix-commit-rerun loop is fully internal. No manual commit step needed after this gate.
+- **Squash gate commits** — collect all fixes for the pass, then one commit. Do not commit after each individual fix.
 - **Every finding must cite a specific file and line number.**
 - **Every finding must include an estimated impact** (high/medium/low) and a recommendation.
 - **Auto-detect the stack** — only run checks relevant to what's present.

package/skills/sk:retro/SKILL.md

@@ -23,7 +23,6 @@ Read these files to build the retrospective:
 |------|----------------|
 | `tasks/todo.md` | Planned tasks — count total, completed, dropped |
 | `tasks/progress.md` | Work log — errors, resolutions, session timestamps |
-| `tasks/workflow-status.md` | Step-by-step status — attempt counts, skip reasons |
 | `tasks/findings.md` | Design decisions — were they validated? |
 | `tasks/lessons.md` | New lessons added during this task |
 | `tasks/tech-debt.md` | Tech debt logged during gates |
@@ -51,7 +50,7 @@ git rev-list main..HEAD --count
 |--------|-----|
 | **Completion rate** | Completed tasks / Planned tasks * 100 |
 | **Velocity** | Commits per day, files changed per day |
-| **Gate performance** | Extract attempt counts from workflow-status.md Notes (e.g., "clean on attempt 3") |
+| **Gate performance** | Count fix commits per gate from git log (e.g., `fix(lint):`, `fix(test):`) |
 | **Blocker count** | Count "FAIL", "error", "blocked", "3-Strike" entries in tasks/progress.md |
 | **Rework rate** | Count fix commits (fix(lint):, fix(test):, etc.) vs feature commits |
 

package/skills/sk:review/SKILL.md

@@ -450,14 +450,14 @@ After presenting the review report, fix **all** findings regardless of severity
   Severity: critical | high | medium | low
   ```
 
-After all in-scope fixes are applied: auto-commit with `fix(review): address review findings`. Do not ask the user. Re-run `/sk:review` from scratch.
+After all in-scope fixes are applied: make ONE squash commit with `fix(review): address review findings`. Do not ask the user. Re-run `/sk:review` from scratch.
 
 Loop until the review is completely clean (0 findings across all severities for in-scope code).
 
 When clean:
 > "Review complete — 0 findings. Run `/sk:finish-feature` to finalize the branch and create a PR."
 
-**Note:** Gates own their commits — the fix-commit-rerun loop is fully internal. No manual commit step needed after this gate.
+> Squash gate commits — collect all fixes for the pass, then one commit. Do not commit after each individual fix.
 
 ### Fix & Retest Protocol
 

package/skills/sk:setup-claude/SKILL.md

@@ -22,7 +22,7 @@ After bootstrapping a project, the recommended workflow becomes:
 ## What Gets Bootstrapped In The Target Repo
 
 ### Planning / Memory Files (in `tasks/`)
-- `tasks/todo.md` — plan + checkboxes + results
+- `tasks/todo.md` — plan + checkboxes + results (also tracks workflow progress via checkboxes)
 - `tasks/findings.md` — discoveries + decisions
 - `tasks/progress.md` — chronological work log + test results
 - `tasks/lessons.md` — durable “don’t repeat mistakes” log (**never overwrite**)
@@ -352,7 +352,6 @@ Rendered from `templates/.claude/settings.json.template`. Contains:
 Copied from `templates/.claude/statusline.sh` (made executable). Displays:
 - Context window usage percentage
 - Current model
-- Current workflow step (from `tasks/workflow-status.md`)
 - Git branch
 - Current task name
 

package/skills/sk:setup-claude/scripts/apply_setup_claude.py

@@ -271,7 +271,16 @@ def _write_file_if_missing(dest: Path, content: str) -> Tuple[str, Path]:
     if dest.exists():
         return ("skipped", dest)
     dest.parent.mkdir(parents=True, exist_ok=True)
-    dest.write_text(content, encoding="utf-8")
+    # Atomic write: write to temp file then rename to avoid TOCTOU race
+    import tempfile
+    fd, tmp_path = tempfile.mkstemp(dir=dest.parent, suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            f.write(content)
+        Path(tmp_path).replace(dest)
+    except BaseException:
+        Path(tmp_path).unlink(missing_ok=True)
+        raise
     return ("created", dest)
 
 
@@ -282,7 +291,7 @@ def _write_file_if_generated(dest: Path, content: str, template_path: Optional[P
         return ("created", dest)
     try:
         existing = dest.read_text(encoding="utf-8")
-    except Exception:
+    except (OSError, UnicodeDecodeError):
         return ("skipped", dest)
     if GENERATED_MARKER in existing:
         # Check if content is identical (fast path)
@@ -311,7 +320,7 @@ def _plan_file_if_generated(dest: Path, content: str) -> str:
         return "created"
     try:
         existing = dest.read_text(encoding="utf-8")
-    except Exception:
+    except (OSError, UnicodeDecodeError):
         return "skipped"
     if GENERATED_MARKER not in existing:
         return "skipped"
@@ -442,7 +451,6 @@ def apply(
     add("templates/tasks/progress.md.template", "tasks/progress.md", "missing")
     add("templates/tasks/lessons.md.template", "tasks/lessons.md", "missing")
     add("templates/tasks/security-findings.md.template", "tasks/security-findings.md", "missing")
-    add("templates/tasks/workflow-status.md.template", "tasks/workflow-status.md", "missing")
     add("templates/tasks/cross-platform.md.template", "tasks/cross-platform.md", "missing")
 
     # commands (update if generated)

package/skills/sk:setup-claude/templates/.claude/statusline.sh

@@ -26,20 +26,6 @@ fi
 # Branch
 BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "none")
 
-# Current workflow step
-STEP="—"
-if [ -f "tasks/workflow-status.md" ]; then
-    NEXT_LINE=$(grep -E ">>\s*next\s*<<" "tasks/workflow-status.md" 2>/dev/null | head -1)
-    if [ -n "$NEXT_LINE" ]; then
-        # Extract step number and name from table row
-        STEP_NUM=$(echo "$NEXT_LINE" | grep -oE '^\|[[:space:]]*[0-9]+' | grep -oE '[0-9]+')
-        STEP_NAME=$(echo "$NEXT_LINE" | sed 's/.*| *>> next << *|.*//' | sed 's/|.*//;s/^ *//;s/ *$//')
-        if [ -n "$STEP_NUM" ]; then
-            STEP="Step ${STEP_NUM}"
-        fi
-    fi
-fi
-
 # Task name from todo.md
 TASK="—"
 if [ -f "tasks/todo.md" ]; then
@@ -47,4 +33,4 @@ if [ -f "tasks/todo.md" ]; then
 fi
 
 # Output single line
-echo "[${CTX_PCT}%] ${MODEL} | ${STEP} | ${BRANCH} | ${TASK}"
+echo "[${CTX_PCT}%] ${MODEL} | ${BRANCH} | ${TASK}"