@lovrozagar/grunt 0.10.0 → 0.11.0

package/.grok/skills/implement-plan/SKILL.md

@@ -4,10 +4,10 @@ description: 'Execute remaining leaves in a .tmp/grunt/plans checklist. Skip [x]
 ---
 # implement-plan
 
-You execute the plan in this session. Skip `[x]`. Start at the first open leaf. Flip only the box after each leaf. When a phase's children are `[x]`, mark the phase `[x]`. Frontmatter `in-progress` then `done`.
+You execute the plan in this session. Start only on a plan the user approved, or when the request said "plan and do it". Skip `[x]`. Start at the first open leaf. Flip only the box after each leaf. When a phase's children are `[x]`, mark the phase `[x]`. Frontmatter `in-progress` then `done`.
 
 Arg `{n|path}` picks that file. Empty arg: unique in-progress, else unique ready, else list serials.
 
-Format: `.rulesync/reference/plan-format.md`. Write-allowlist = paths listed in the plan. Run Verify leaves. Do not skip a test leaf. Do not flip a behavior leaf `[x]` until its test ran. Fat dumps go through `node scripts/grunt-job.mjs`.
+Format: `.rulesync/reference/plan-format.md`. Write-allowlist = paths listed in the plan. Run Verify leaves. Do not skip a test leaf. Do not flip a behavior leaf `[x]` until its test ran. Fat dumps go through `node .rulesync/scripts/grunt-job.mjs`.
 
 On start: if this plan has no journal, Write one under `.tmp/grunt/implementations/` (`IMPL_NAME:`, `IMPL_PLAN: {n}`). Format: `.rulesync/reference/implementation-format.md`. After each leaf: append `N.M [x] …` to Log, update Files (repo-relative product paths) and Done. Blocked → `status: blocked` and Blockers. Verify done → `status: done`. Straight shots do not write a journal.

package/.grok/skills/jev/SKILL.md

@@ -2,17 +2,17 @@
 name: jev
 description: >-
   Yes/no or named-option decision on text already saved. Run node
-  scripts/jev.mjs --available first. On yes, one decision call. On no, decide
+  .rulesync/scripts/jev.mjs --available first. On yes, one decision call. On no, decide
   yourself and do not mention Jev.
 ---
 # jev
 
 Use this when the source text is already saved and the leftover question is a yes/no or a choice among options the research already named. Spec: `.rulesync/reference/jev.md`.
 
-Run `node scripts/jev.mjs --available`. It prints `yes` or `no` and exits 0.
+Run `node .rulesync/scripts/jev.mjs --available`. It prints `yes` or `no` and exits 0.
 
 `no`: answer the question yourself. Do not run a decision call. Do not mention Jev, a missing key, or setup.
 
-`yes`: read `.rulesync/reference/jev.md`. Write the passage and one questions file under `.tmp/grunt/jev/`. Run `node scripts/jev.mjs --state <state> --questions <questions>` once. Use the printed label and confidence. A low confidence is the result. Do not call again.
+`yes`: read `.rulesync/reference/jev.md`. Write the passage and one questions file under `.tmp/grunt/jev/`. Run `node .rulesync/scripts/jev.mjs --state <state> --questions <questions>` once. Use the printed label and confidence. A low confidence is the result. Do not call again.
 
 Open research, code, and grunt-job stay with the session. If the decision call exits non-zero, answer from the sources. Do not invent a label.

package/.grok/skills/listen/SKILL.md

@@ -1,15 +1,15 @@
 ---
 name: listen
 description: >-
-  Speech-to-text via node scripts/listen.mjs (ffmpeg mic + local whisper.cpp,
+  Speech-to-text via node .rulesync/scripts/listen.mjs (ffmpeg mic + local whisper.cpp,
   OpenAI fallback). Input only.
 ---
 # listen
 
-When the user wants to dictate, transcribe a recording, or toggle a mic, run `node scripts/listen.mjs`. Spec: `.rulesync/reference/listen.md`. Input only (audio → text). Do not speak. Do not use `/speak`.
+When the user wants to dictate, transcribe a recording, or toggle a mic, run `node .rulesync/scripts/listen.mjs`. Spec: `.rulesync/reference/listen.md`. Input only (audio → text). Do not speak. Do not use `/speak`.
 
 `whoami` · `devices` · `rec [--seconds N]` · `start` · `stop` · `toggle` · `status` · `file --path P` · `latest`. `--clip` copies the transcript. `--cwd DIR` when the process is not already in the repo (hotkeys). `rec` prints the transcript and `transcript=.tmp/grunt/listen/latest.txt`.
 
 STT: local `whisper-cli` first (mac: `brew install whisper-cpp`); first listen downloads the ggml model to `~/.grunt/whisper/`. Else `OPENAI_API_KEY`. Mic verbs need ffmpeg. Do not tell them to pip-install openai-whisper or curl the model by hand.
 
-If the CLI exits non-zero, print its message. Lines with `setup:` are for the user — show that command. Tell them to run `node scripts/setup.mjs listen` (or `grunt setup`) in their terminal. Do not dump JSON. Do not invent a key. Spec: `.rulesync/reference/listen.md` `.rulesync/reference/setup.md`.
+If the CLI exits non-zero, print its message. Lines with `setup:` are for the user — show that command. Tell them to run `node .rulesync/scripts/setup.mjs listen` (or `grunt setup`) in their terminal. Do not dump JSON. Do not invent a key. Spec: `.rulesync/reference/listen.md` `.rulesync/reference/setup.md`.

package/.grok/skills/pickup/SKILL.md

@@ -18,7 +18,7 @@ Load a handoff and continue in this session. Not a mode. Not `/handoff`. Inverse
 
 ## Resolve
 
-Read `.tmp/grunt/handoffs/`. Use `node scripts/grunt-job.mjs --job search|exec` when the listing is fat.
+Read `.tmp/grunt/handoffs/`. Use `node .rulesync/scripts/grunt-job.mjs --job search|exec` when the listing is fat.
 
 Order:
 

package/.grok/skills/speak/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: speak
-description: Text-to-speech via node scripts/speak.mjs (ElevenLabs or OpenAI). Output only.
+description: Text-to-speech via node .rulesync/scripts/speak.mjs (ElevenLabs or OpenAI). Output only.
 ---
 # speak
 
-When the user wants spoken audio, run `node scripts/speak.mjs`. Spec: `.rulesync/reference/speak.md`. Output only (text → mp3). Do not record a mic. Do not transcribe.
+When the user wants spoken audio, run `node .rulesync/scripts/speak.mjs`. Spec: `.rulesync/reference/speak.md`. Output only (text → mp3). Do not record a mic. Do not transcribe.
 
 `whoami` · `voices` · `say --text T [--provider elevenlabs|openai] [--voice ID] [--out path] [--play]`.
 
 Auth: `ELEVENLABS_API_KEY` or `OPENAI_API_KEY` or `~/.grunt/speak.json`. Do not commit the key. Default voices: ElevenLabs George (`JBFqnCBsd6RMkjVDRZzb`), OpenAI `coral`.
 
-If the CLI exits non-zero, print its message. Lines with `setup:` are for the user — show that command. Tell them to run `node scripts/setup.mjs speak` (or `grunt setup`) in their terminal. Do not dump JSON. Do not invent a key. Spec: `.rulesync/reference/speak.md` `.rulesync/reference/setup.md`.
+If the CLI exits non-zero, print its message. Lines with `setup:` are for the user — show that command. Tell them to run `node .rulesync/scripts/setup.mjs speak` (or `grunt setup`) in their terminal. Do not dump JSON. Do not invent a key. Spec: `.rulesync/reference/speak.md` `.rulesync/reference/setup.md`.

package/.grok/skills/tmp/SKILL.md

@@ -33,9 +33,9 @@ TMP_EXT: md
 <artifact only>
 ```
 
-`TMP_EXT` optional. Write any root filename under `.tmp/grunt/` (not `plans|handoffs|implementations|browser|orchestrator-logs`). Grok `orchestrate-parent.js` runs `scripts/persist-tmp.mjs`: serial/slug/ext from `TMP_*`, strips those lines, no YAML frontmatter, rewrites path + content. Write outside that root or missing `TMP_NAME:` is denied.
+`TMP_EXT` optional. Write any root filename under `.tmp/grunt/` (not `plans|handoffs|implementations|browser|orchestrator-logs`). Grok `orchestrate-parent.js` runs `.rulesync/scripts/persist-tmp.mjs`: serial/slug/ext from `TMP_*`, strips those lines, no YAML frontmatter, rewrites path + content. Write outside that root or missing `TMP_NAME:` is denied.
 
-Host without that hook: name the file per **Path** yourself, or pipe the body to `node scripts/persist-tmp.mjs --workspace {repo}` and use its `path`.
+Host without that hook: name the file per **Path** yourself, or pipe the body to `node .rulesync/scripts/persist-tmp.mjs --workspace {repo}` and use its `path`.
 
 Never rewrite an existing dump; new serial. Artifact file content after hook = artifact only (no TMP_* lines no YAML frontmatter).
 

package/.grok/skills/write-plan/SKILL.md

@@ -4,10 +4,12 @@ description: 'Write a local checklist under .tmp/grunt/plans/. Then /implement-p
 ---
 # write-plan
 
-You author the plan. Persist under `.tmp/grunt/plans/` via Write (hook runs `scripts/persist-plan.mjs`). Format: `.rulesync/reference/plan-format.md`.
+You author the plan. Persist under `.tmp/grunt/plans/` via Write (hook runs `.rulesync/scripts/persist-plan.mjs`). Format: `.rulesync/reference/plan-format.md`.
 
 Empty task → ask for a task and stop.
 
 Body starts with `PLAN_NAME: <3-6 word name>`, then Goal, Context, Constraints, Watch-outs, Steps, Verify. All boxes `[ ]`. Tests: new behavior or bug → failing test leaf before impl; other behavior → test leaf right after impl; docs/rename/config/generated → skip. Verify is the end gate.
 
-Report: wrote serial N at `.tmp/grunt/plans/{file}`. Next `/implement-plan {n}`. Do not dump the plan.
+The plan is the proposal and caps the result (`.rulesync/reference/scope.md`). Before writing, research until every leaf is defensible; ask any plan-shaping question the user alone can answer, then research again on the answer. Do not default a plan-shaping choice. A minor open choice goes under Constraints as the chosen default plus "confirm".
+
+Report: serial N at `.tmp/grunt/plans/{file}`, the goal, the phase list, the top risks, and any assumption to confirm. Do not dump the plan. Stop and ask for approval; on feedback, revise this file and stop again. Run `/implement-plan {n}` in the same turn only when the request said "plan and do it".

package/.rulesync/hooks.jsonc

@@ -7,14 +7,14 @@
       {
         "matcher": "spawn_subagent|Task|Agent|spawn_agent",
         "type": "command",
-        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/scripts/scrub-spawn-prompt.mjs\"",
+        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.rulesync/scripts/scrub-spawn-prompt.mjs\"",
         "timeout": 5
       },
       {
         // Fat Read/Grep/Glob/Bash + Write/Edit scratch rewrite (never deny writes).
         "matcher": "Read|read_file|Grep|grep|Glob|list_dir|Bash|run_terminal_command|Write|Edit|write|search_replace",
         "type": "command",
-        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/scripts/gate-fat-tools.mjs\"",
+        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.rulesync/scripts/gate-fat-tools.mjs\"",
         "timeout": 5
       },
       {
@@ -29,7 +29,7 @@
       {
         // Code-only folder map as additionalContext (hooks-union keeps it first).
         "type": "command",
-        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/scripts/session-map.mjs\"",
+        "command": "node \"${GROK_WORKSPACE_ROOT:-${CLAUDE_PROJECT_DIR:-.}}/.rulesync/scripts/session-map.mjs\"",
         "timeout": 5
       }
     ],

package/.rulesync/reference/INDEX.md

@@ -10,7 +10,7 @@ Reserved (do not reuse in consumer custom skills): `ask` `auto` `browser` `clasp
 
 Override: same name → one SSOT path (`.rulesync/skills/<name>/`). Re-init / `grunt upgrade` force-refresh overwrites grunt-owned names; consumer extras kept. Maps `origin` badge ≠ content picker.
 
-Upgrade copies the current package trees and product scripts, then deletes cumulative retired grunt-owned names (skills `parent` `solo` `cascade`; agents `implementer` `thinker`; scripts `telemetry.mjs` `grunt-config.mjs`; paths `.grok/parent.md` `.grok/skills/shared` `.rulesync/grunt.config.jsonc` `.rulesync/grunt.config.local.jsonc` `.rulesync/grunt.config.local.jsonc.example`) and any reserved skill dir this package no longer ships. `fs.cpSync` does not remove dest extras; prune is what drops them. Consumer skills/refs/scripts not on those lists stay. Extra `##` headings in shared reference docs (e.g. `law.md`) are kept. `grunt:*` package scripts that differ from a known grunt default stay; `grunt:test:e2e` is added only when a vitest e2e config exists. Check steps omitted from dest `scripts/pipeline.mjs` seed `.rulesync/grunt.pipeline.jsonc`. doctor/listen/speak call `scripts/lib/env.mjs` `loadEnv` when that file exists.
+Upgrade copies the current package trees and product scripts (to `.rulesync/scripts/`), then deletes cumulative retired grunt-owned names (skills `parent` `solo` `cascade`; agents `implementer` `thinker`; scripts `telemetry.mjs` `grunt-config.mjs`; paths `.grok/parent.md` `.grok/skills/shared` `.rulesync/grunt.config.jsonc` `.rulesync/grunt.config.local.jsonc` `.rulesync/grunt.config.local.jsonc.example`) and any reserved skill dir this package no longer ships. `fs.cpSync` does not remove dest extras; prune is what drops them. Consumer skills/refs/scripts not on those lists stay. Extra `##` headings in shared reference docs (e.g. `law.md`) are kept. `grunt:*` package scripts that differ from a known grunt default stay; `grunt:test:e2e` is added only when a vitest e2e config exists. When a pre-0.11 root `scripts/` holds `guarded-roots.mjs` or `gate-fat-tools.mjs`, upgrade deletes the grunt product names there, removes the dir if that empties it, and rewrites `scripts/<grunt name>` refs in package scripts and `.rulesync/grunt.pipeline.jsonc`; consumer files and refs stay. Check steps omitted from the dest pipeline (`.rulesync/scripts/pipeline.mjs`, or the legacy root copy) seed `.rulesync/grunt.pipeline.jsonc`. doctor/listen/speak call the consumer's root `scripts/lib/env.mjs` `loadEnv` when that file exists.
 
 # Skills
 
@@ -18,7 +18,7 @@ Upgrade copies the current package trees and product scripts, then deletes cumul
 | --- | --- | --- | --- | --- | --- |
 | ask | local | Session flag. Finish one step, recap, then ask before the next. |  |  |  |
 | auto | local | Session flag. Default. Work the task through. Ask on blockers instead of monkey-patching. |  |  |  |
-| browser | local | Browse via node scripts/browser.mjs (Lightpanda). App e2e uses Playwright. |  |  |  |
+| browser | local | Browse via node .rulesync/scripts/browser.mjs (Lightpanda). App e2e uses Playwright. |  |  |  |
 | clasp | local | Low-level Apps Script CLI. Prefer /google-workspace for sheet, doc, meeting, mail. |  |  |  |
 | commit | local | Inspect the diff and commit with a Conventional Commits subject line. Use for /commit, "commit this", "commit these cha… |  |  |  |
 | commit-and-push | local | Alias of commit-push (1-release stub). Use for /commit-and-push, "commit and push", "commit this and push". Must push.… |  |  |  |
@@ -26,13 +26,13 @@ Upgrade copies the current package trees and product scripts, then deletes cumul
 | commit-push-deploy | local | Commit, push, then deploy only if allowlisted infra already exists. Use for /commit-push-deploy, "commit push deploy",… |  |  |  |
 | commit-push-release | local | Commit, push, bump package.json, tag vX.Y.Z, push the tag. CI publishes. Use for /commit-push-release, "commit push rel… |  |  |  |
 | explain | local | Longer human recap this reply only. |  |  |  |
-| google-workspace | local | Google Sheets, Docs, Slides, Calendar, Gmail via node scripts/google-workspace.mjs. |  |  |  |
+| google-workspace | local | Google Sheets, Docs, Slides, Calendar, Gmail via node .rulesync/scripts/google-workspace.mjs. |  |  |  |
 | handoff | local | Write a session handoff under .tmp/grunt/handoffs/. Continue with /pickup. |  |  |  |
 | implement-plan | local | Execute remaining leaves in a .tmp/grunt/plans checklist. Skip [x]. |  |  |  |
-| jev | local | Yes/no or named-option decision on text already saved. Run node scripts/jev.mjs --available first. On yes, one decision… |  |  |  |
-| listen | local | Speech-to-text via node scripts/listen.mjs (ffmpeg mic + local whisper.cpp, OpenAI fallback). Input only. |  |  |  |
+| jev | local | Yes/no or named-option decision on text already saved. Run node .rulesync/scripts/jev.mjs --available first. On yes, on… |  |  |  |
+| listen | local | Speech-to-text via node .rulesync/scripts/listen.mjs (ffmpeg mic + local whisper.cpp, OpenAI fallback). Input only. |  |  |  |
 | pickup | local | Continue a handoff under .tmp/grunt/handoffs/. |  |  |  |
-| speak | local | Text-to-speech via node scripts/speak.mjs (ElevenLabs or OpenAI). Output only. |  |  |  |
+| speak | local | Text-to-speech via node .rulesync/scripts/speak.mjs (ElevenLabs or OpenAI). Output only. |  |  |  |
 | su | local | Short status update: done, next, and blockers or on-track ETA. |  |  |  |
 | tmp | local | Dump a one-off convo artifact under .tmp/grunt/. |  |  |  |
 | write-plan | local | Write a local checklist under .tmp/grunt/plans/. Then /implement-plan {n}. |  |  |  |
@@ -42,18 +42,18 @@ Upgrade copies the current package trees and product scripts, then deletes cumul
 | path | title | tags | summary |
 | --- | --- | --- | --- |
 | .rulesync/reference/browser.md | Browser | browser | Zero-config in-tree session rail. Not MCP. Not env. Not raw Playwright. Lightpanda first; swap to Chromium when blocked. |
-| .rulesync/reference/cascade.md | Protocol | cascade | The session agent has tools. Fat Read/Grep/Bash dumps are rewritten to `scripts/grunt-job.mjs` (squeez + stash). Isolat… |
+| .rulesync/reference/cascade.md | Protocol | cascade | The session agent has tools. Fat Read/Grep/Bash dumps are rewritten to `.rulesync/scripts/grunt-job.mjs` (squeez + stas… |
 | .rulesync/reference/clasp.md | Clasp | clasp | Low-level Apps Script CLI. Optional. Doctor reports it. |
 | .rulesync/reference/google-workspace.md | google-workspace | google-workspace | Create and edit Google Sheets, Docs, Slides, Calendar events, and Gmail from the session. |
-| .rulesync/reference/hooks.md | Hooks | hooks | SessionStart carries only the folder map: Claude / Codex run `../../scripts/session-map.mjs`, which injects the code-on… |
+| .rulesync/reference/hooks.md | Hooks | hooks | SessionStart carries only the folder map: Claude / Codex run `../../.rulesync/scripts/session-map.mjs`, which injects t… |
 | .rulesync/reference/implementation-format.md | Implementation format (SSOT) |  | Local session journal for `/implement-plan`. Not a plan, handoff, or git commit. |
 | .rulesync/reference/jev.md | Jev | jev | Closed external decision. The source text is already saved. The question is a yes/no or a named choice. One call. Not o… |
 | .rulesync/reference/law.md | Law |  | Protocol stays overview; domain fills this. |
 | .rulesync/reference/listen.md | Listen | listen | Speech-to-text from the session. Input only. Not TTS. Not a live voice agent. Not MCP. |
 | .rulesync/reference/map.md | Map | map | Cheap outline. Not a file dump. |
-| .rulesync/reference/output.md | Output | output | en-US unless asked. Concise complete sentences with natural grammar. Skip filler and fluff. |
+| .rulesync/reference/output.md | Output | output | en-US unless asked. Concise complete sentences with natural grammar. Skip filler and fluff. Examples are a class. |
 | .rulesync/reference/plan-format.md | Plan format (SSOT) |  | Local session checklist. Not a design doc, PR stack, or DAG. |
 | .rulesync/reference/rtk.md | RTK | rtk | Shell stdout compression. PreToolUse: Bash → `rtk <cmd>`. Not Read/Grep/Glob/prompts/images. |
-| .rulesync/reference/scope.md | Scope | scope | Default: do the work. Escalate only when it is not a straight shot. This file is the size-gate SSOT. |
+| .rulesync/reference/scope.md | Scope | scope | Plan by default. A straight shot is the exception. The plan caps the result, so its depth scales with the work. This fi… |
 | .rulesync/reference/setup.md | Setup | setup | Handheld machine setup for optional integrations. Any OS. Secrets stay in `~/.grunt/` (Windows `%USERPROFILE%\.grunt`).… |
 | .rulesync/reference/speak.md | Speak | speak | Text-to-speech from the session. Output only. Not STT. Not a mic. Not MCP. Speech-to-text is `/listen`: `.rulesync/refe… |

package/.rulesync/reference/browser.md

@@ -7,7 +7,7 @@ tags: [browser]
 Zero-config in-tree session rail. Not MCP. Not env. Not raw Playwright. Lightpanda first; swap to Chromium when blocked.
 
 ```
-node scripts/browser.mjs nav|snap|click|fill|scroll|wait|hover|select|shot|pdf|stop|doctor|ensure
+node .rulesync/scripts/browser.mjs nav|snap|click|fill|scroll|wait|hover|select|shot|pdf|stop|doctor|ensure
 ```
 
 Default engine: **Lightpanda** (`lightpanda` on PATH). Chromium when a rule below requires it. Never report "can't browse" while Chromium is available.
@@ -27,14 +27,14 @@ Default engine: **Lightpanda** (`lightpanda` on PATH). Chromium when a rule belo
 | `shot` | screenshot (Chromium paint) |
 | `pdf` | PDF (Chromium paint) |
 | `stop` | reap engine pid; clear session; idempotent |
-| `doctor` | unified prereq doctor (`scripts/doctor.mjs`); alias `ensure` |
+| `doctor` | unified prereq doctor (`.rulesync/scripts/doctor.mjs`); alias `ensure` |
 | `ensure` | alias of `doctor` |
 
 Session + profile + artifacts: `.tmp/grunt/browser/` only.
 
 ## Install
 
-Run `grunt doctor` / `node scripts/doctor.mjs`. Handheld engine hints (no keys): `node scripts/setup.mjs browser`. Doctor/setup is enough. Do not read a README unless those are missing; then https://github.com/lovrozagar/grunt#prerequisites (not the consumer README).
+Run `grunt doctor` / `node .rulesync/scripts/doctor.mjs`. Handheld engine hints (no keys): `node .rulesync/scripts/setup.mjs browser`. Doctor/setup is enough. Do not read a README unless those are missing; then https://github.com/lovrozagar/grunt#prerequisites (not the consumer README).
 
 ## Engine
 
@@ -63,4 +63,4 @@ No user env. Never `GRUNT_BROWSER*`. Never `LIGHTPANDA_CDP_URL`.
 
 ## RTK
 
-`playwright` on the RTK command list is the **test-runner family only**. Browser rail is `lightpanda` + `scripts/browser.mjs`.
+`playwright` on the RTK command list is the **test-runner family only**. Browser rail is `lightpanda` + `.rulesync/scripts/browser.mjs`.

package/.rulesync/reference/cascade.md

@@ -4,9 +4,9 @@ tags: [cascade]
 
 # Protocol
 
-The session agent has tools. Fat Read/Grep/Bash dumps are rewritten to `scripts/grunt-job.mjs` (squeez + stash). Isolation facts stay ≤8 lines.
+The session agent has tools. Fat Read/Grep/Bash dumps are rewritten to `.rulesync/scripts/grunt-job.mjs` (squeez + stash). Isolation facts stay ≤8 lines.
 
-Run `node scripts/grunt-job.mjs --job search|exec|slice|fetch|test` first. Spawn a grunt model only when the dump needs judgment (browse snap, messy test log). Isolation work may run as grunt.
+Run `node .rulesync/scripts/grunt-job.mjs --job search|exec|slice|fetch|test` first. Spawn a grunt model only when the dump needs judgment (browse snap, messy test log). Isolation work may run as grunt.
 
 `need:` JSON (search|exec|slice|fetch) may be intercepted in-hook (cap 4). Peek/kill if a child is running: Grok `get_command_or_subagent_output` `timeout_ms=60000`. Other hosts: block on spawn return.
 

package/.rulesync/reference/clasp.md

@@ -6,7 +6,7 @@ tags: [clasp]
 
 Low-level Apps Script CLI. Optional. Doctor reports it.
 
-For create/edit sheet, doc, slide, meeting, or mail, use **google-workspace**: `.rulesync/reference/google-workspace.md` and `node scripts/google-workspace.mjs`. Do not start from clasp.
+For create/edit sheet, doc, slide, meeting, or mail, use **google-workspace**: `.rulesync/reference/google-workspace.md` and `node .rulesync/scripts/google-workspace.mjs`. Do not start from clasp.
 
 ```
 npm i -g @google/clasp

package/.rulesync/reference/google-workspace.md

@@ -7,35 +7,35 @@ tags: [google-workspace]
 Create and edit Google Sheets, Docs, Slides, Calendar events, and Gmail from the session.
 
 ```
-node scripts/google-workspace.mjs whoami
-node scripts/google-workspace.mjs scopes
-node scripts/google-workspace.mjs login
-node scripts/google-workspace.mjs sheet create --title "Q3" --csv "item,qty\nA,2"
-node scripts/google-workspace.mjs sheet set --id ID --cell A1 --value x
-node scripts/google-workspace.mjs sheet get --id ID --range A1:B10
-node scripts/google-workspace.mjs sheet append --id ID --csv "c,3"
-node scripts/google-workspace.mjs sheet clear --id ID --range A1:Z
-node scripts/google-workspace.mjs doc create --title "Notes" --body "hello"
-node scripts/google-workspace.mjs doc append --id ID --body "more"
-node scripts/google-workspace.mjs drive list --query "mimeType='application/vnd.google-apps.spreadsheet'"
-node scripts/google-workspace.mjs slide create --title "Deck"
-node scripts/google-workspace.mjs meeting create --title "Standup" --start 2026-09-15T09:00:00Z --end 2026-09-15T09:15:00Z --attendees a@x.com,b@y.com
-node scripts/google-workspace.mjs mail send --to you@example.com --subject hi --body hello
-node scripts/google-workspace.mjs mail list
+node .rulesync/scripts/google-workspace.mjs whoami
+node .rulesync/scripts/google-workspace.mjs scopes
+node .rulesync/scripts/google-workspace.mjs login
+node .rulesync/scripts/google-workspace.mjs sheet create --title "Q3" --csv "item,qty\nA,2"
+node .rulesync/scripts/google-workspace.mjs sheet set --id ID --cell A1 --value x
+node .rulesync/scripts/google-workspace.mjs sheet get --id ID --range A1:B10
+node .rulesync/scripts/google-workspace.mjs sheet append --id ID --csv "c,3"
+node .rulesync/scripts/google-workspace.mjs sheet clear --id ID --range A1:Z
+node .rulesync/scripts/google-workspace.mjs doc create --title "Notes" --body "hello"
+node .rulesync/scripts/google-workspace.mjs doc append --id ID --body "more"
+node .rulesync/scripts/google-workspace.mjs drive list --query "mimeType='application/vnd.google-apps.spreadsheet'"
+node .rulesync/scripts/google-workspace.mjs slide create --title "Deck"
+node .rulesync/scripts/google-workspace.mjs meeting create --title "Standup" --start 2026-09-15T09:00:00Z --end 2026-09-15T09:15:00Z --attendees a@x.com,b@y.com
+node .rulesync/scripts/google-workspace.mjs mail send --to you@example.com --subject hi --body hello
+node .rulesync/scripts/google-workspace.mjs mail list
 ```
 
 Each person has their own Google Cloud app. Creds stay in `~/.grunt/` on that machine. Do not share OAuth JSON or tokens. Do not commit them. Inviting others to a meeting is attendee emails, not shared creds.
 
-Handheld (any OS): `node scripts/setup.mjs google-workspace` or `npm exec grunt setup` → google-workspace. Opens each Cloud Console page, waits, copies the Desktop JSON into `~/.grunt/google-oauth.json`, then browser Allow. Non-TTY: `--creds PATH` to a Desktop download. `--account NAME` for a second Google user.
+Handheld (any OS): `node .rulesync/scripts/setup.mjs google-workspace` or `npm exec grunt setup` → google-workspace. Opens each Cloud Console page, waits, copies the Desktop JSON into `~/.grunt/google-oauth.json`, then browser Allow. Non-TTY: `--creds PATH` to a Desktop download. `--account NAME` for a second Google user.
 
 Doctor reports google-workspace as optional: `ok` when Desktop OAuth JSON, tokens, gcloud ADC, or `~/.clasprc.json` exists, else `missing (optional)`. It prints source names (`oauth` `tokens` `adc` `clasprc`), not secrets. `clasprc` is Drive-only.
 
 Two Google accounts on one machine: `--account NAME` (or `WORKSPACE_ACCOUNT`). Default is `default` (legacy files `~/.grunt/google-oauth.json` + `workspace-tokens.json` still work). Other accounts use `~/.grunt/workspace/NAME/`.
 
 ```
-node scripts/google-workspace.mjs --account work login
-node scripts/google-workspace.mjs --account work whoami
-node scripts/google-workspace.mjs accounts
+node .rulesync/scripts/google-workspace.mjs --account work login
+node .rulesync/scripts/google-workspace.mjs --account work whoami
+node .rulesync/scripts/google-workspace.mjs accounts
 ```
 
 Each account needs its own Desktop JSON in that folder (`google-oauth.json`) and its own `login`.
@@ -44,7 +44,7 @@ Clasp’s public OAuth client is Drive-only. Calendar and Gmail are restricted;
 
 ## Agent: setup e2e
 
-If `whoami` works but `meeting` / `mail` / `sheet set` fail with missing scope or “app is blocked”, run **this user** through `node scripts/setup.mjs google-workspace` (TTY). Do not reuse another person’s JSON. Do not invent a client JSON.
+If `whoami` works but `meeting` / `mail` / `sheet set` fail with missing scope or “app is blocked”, run **this user** through `node .rulesync/scripts/setup.mjs google-workspace` (TTY). Do not reuse another person’s JSON. Do not invent a client JSON.
 
 Local dir is created by setup (`~/.grunt/`, mode 700 on Unix). Manual equivalent: `mkdir -p "$HOME/.grunt" && chmod 700 "$HOME/.grunt"` then:
 
@@ -59,21 +59,21 @@ Local dir is created by setup (`~/.grunt/`, mode 700 on Unix). Manual equivalent
    - Application type: **Desktop app**.
    - Create → **Download JSON**.
 5. Copy the download to `$HOME/.grunt/google-oauth.json` (Windows: `%USERPROFILE%\.grunt\google-oauth.json`). chmod 600 on Unix. Confirm it has `"installed"` and `client_id`. For `--account NAME`, use `$HOME/.grunt/workspace/NAME/google-oauth.json`.
-6. From the repo: `node scripts/google-workspace.mjs login` (or `--account NAME`) — browser Allow. Tokens write beside the JSON (`workspace-tokens.json` or `workspace/NAME/tokens.json`).
+6. From the repo: `node .rulesync/scripts/google-workspace.mjs login` (or `--account NAME`) — browser Allow. Tokens write beside the JSON (`workspace-tokens.json` or `workspace/NAME/tokens.json`).
 7. Smoke:
 
 ```
-node scripts/google-workspace.mjs whoami
-node scripts/google-workspace.mjs scopes
-node scripts/google-workspace.mjs sheet create --title smoke-sheet --csv "k,v\nok,1"
-node scripts/google-workspace.mjs doc create --title smoke-doc --body ok
-node scripts/google-workspace.mjs slide create --title smoke-slide
-node scripts/google-workspace.mjs meeting create --title smoke-meeting --start 2026-09-16T09:00:00Z --end 2026-09-16T09:15:00Z
-node scripts/google-workspace.mjs mail send --to THEIR_EMAIL --subject smoke --body ok
+node .rulesync/scripts/google-workspace.mjs whoami
+node .rulesync/scripts/google-workspace.mjs scopes
+node .rulesync/scripts/google-workspace.mjs sheet create --title smoke-sheet --csv "k,v\nok,1"
+node .rulesync/scripts/google-workspace.mjs doc create --title smoke-doc --body ok
+node .rulesync/scripts/google-workspace.mjs slide create --title smoke-slide
+node .rulesync/scripts/google-workspace.mjs meeting create --title smoke-meeting --start 2026-09-16T09:00:00Z --end 2026-09-16T09:15:00Z
+node .rulesync/scripts/google-workspace.mjs mail send --to THEIR_EMAIL --subject smoke --body ok
 ```
 
 `scopes` must include `calendar`, `gmail.modify` or `gmail.send`, `spreadsheets`, `documents`, `drive`. If login times out, they did not finish Allow; re-run `login`.
 
-If `google-oauth.json` is missing, `login` prints `setup: node scripts/setup.mjs google-workspace`. Prefer the handheld setup (it opens the Project ID URLs). Manual steps above still work.
+If `google-oauth.json` is missing, `login` prints `setup: node .rulesync/scripts/setup.mjs google-workspace`. Prefer the handheld setup (it opens the Project ID URLs). Manual steps above still work.
 
 `gcloud` on PATH is an alternate login (`gcloud auth application-default login` with the extra scopes). Still per person, still local.

package/.rulesync/reference/hooks.md

@@ -4,15 +4,15 @@ tags: [hooks]
 
 # Hooks
 
-SessionStart carries only the folder map: Claude / Codex run `../../scripts/session-map.mjs`, which injects the code-only map from `../../scripts/folder-map.mjs` as `additionalContext` (capped under Claude Code's 10,000-char per-hook `additionalContext` limit, about 2.4k tokens, below the 5k `grunt map` budget; cache-stable, fail-open) and logs `{rows, tokens}` to `.tmp/grunt/sessions/<sid>/map.json`. Inject nothing else at SessionStart. Antigravity has no rulesync sessionStart. Do not register a SessionStart hook on `../../.grok/hooks/orchestrate-parent.json`.
+SessionStart carries only the folder map: Claude / Codex run `../../.rulesync/scripts/session-map.mjs`, which injects the code-only map from `../../.rulesync/scripts/folder-map.mjs` as `additionalContext` (capped under Claude Code's 10,000-char per-hook `additionalContext` limit, about 2.4k tokens, below the 5k `grunt map` budget; cache-stable, fail-open) and logs `{rows, tokens}` to `.tmp/grunt/sessions/<sid>/map.json`. Inject nothing else at SessionStart. Antigravity has no rulesync sessionStart. Do not register a SessionStart hook on `../../.grok/hooks/orchestrate-parent.json`.
 
 Grok PostToolUse / SessionStart are observe-only — do not attempt output scrub; compress via RTK / spawn / isolation facts only. Do not add PostToolUse scrub hooks. UserPromptSubmit may emit a one-line `sessionGate=auto|ask` plus session receipt, then up to 8 other live lines from `~/.grunt/board/` (`hookSpecificOutput.additionalContext`). The current session's own line is omitted. Skip host Stop banners. `/ask` exact-match slash stamps `session-gate-{sid}` to `ask`. `/auto` unlinks. Sid-less: no stamp. Default: `auto`.
 
 In `sessionGate=ask`, parent Stop on `end_turn` blocks unless the recap asks (`?`) or is exactly `[orchestrator]: wait grunt`. Reason: `ask after this step`. Cap 3. `sessionGate=auto` does not Stop-block.
 
-Claude / Codex / Antigravity PreToolUse still run `../../scripts/scrub-spawn-prompt.mjs` and `../../scripts/gate-fat-tools.mjs`. Grok spawn/fat rewrite is `../../.grok/hooks/orchestrate-parent.js`. RTK stays `../../.grok/hooks/rtk.json`.
+Claude / Codex / Antigravity PreToolUse still run `../../.rulesync/scripts/scrub-spawn-prompt.mjs` and `../../.rulesync/scripts/gate-fat-tools.mjs`. Grok spawn/fat rewrite is `../../.grok/hooks/orchestrate-parent.js`. RTK stays `../../.grok/hooks/rtk.json`.
 
-Session agent tools are on. Fat Read/Grep/Glob/Bash still gate. Writes under `.tmp/grunt/plans/`, `.tmp/grunt/handoffs/`, `.tmp/grunt/implementations/`, and `.tmp/grunt/` root files persist via `../../scripts/persist-plan.mjs` / `persist-handoff.mjs` / `persist-implementation.mjs` / `persist-tmp.mjs`. Invalid body denies.
+Session agent tools are on. Fat Read/Grep/Glob/Bash still gate. Writes under `.tmp/grunt/plans/`, `.tmp/grunt/handoffs/`, `.tmp/grunt/implementations/`, and `.tmp/grunt/` root files persist via `../../.rulesync/scripts/persist-plan.mjs` / `persist-handoff.mjs` / `persist-implementation.mjs` / `persist-tmp.mjs`. Invalid body denies.
 
 SubagentStop (and child Stop with `subagentType`) intercepts a parseable `need:` whose jobs are all `search|exec|slice|fetch` (cap 4): runs grunt-job in-hook and continues the child with concatenated facts. Mixed/web/test, parse fail, FALLBACK, `stopHookActive`, or more than 3 intercepts per child session → empty stdout (allow stop).
 

package/.rulesync/reference/implementation-format.md

@@ -60,9 +60,9 @@ No other `##` headings.
 
 ## Write
 
-Write under `.tmp/grunt/implementations/` (any filename in that dir). Grok `orchestrate-parent.js` runs `scripts/persist-implementation.mjs` on create (`IMPL_NAME:`): serial/slug from the name, injects frontmatter, rewrites path + content. Updates to an existing file keep the path; full-body writes are validated in place. Invalid create/update denies — fix the body, do not retry elsewhere.
+Write under `.tmp/grunt/implementations/` (any filename in that dir). Grok `orchestrate-parent.js` runs `.rulesync/scripts/persist-implementation.mjs` on create (`IMPL_NAME:`): serial/slug from the name, injects frontmatter, rewrites path + content. Updates to an existing file keep the path; full-body writes are validated in place. Invalid create/update denies — fix the body, do not retry elsewhere.
 
-Host without that hook: name the file per **Path**, or pipe the body to `node scripts/persist-implementation.mjs --workspace {repo}` and use its `path`.
+Host without that hook: name the file per **Path**, or pipe the body to `node .rulesync/scripts/persist-implementation.mjs --workspace {repo}` and use its `path`.
 
 Never allocate a new serial to log a leaf. Append Log, update Files/Done, flip the plan box.
 

package/.rulesync/reference/jev.md

@@ -9,7 +9,7 @@ Closed external decision. The source text is already saved. The question is a ye
 ## Availability
 
 ```
-node scripts/jev.mjs --available
+node .rulesync/scripts/jev.mjs --available
 ```
 
 Prints `yes` or `no` and exits 0. No request. No setup line.
@@ -18,14 +18,14 @@ Prints `yes` or `no` and exits 0. No request. No setup line.
 
 `yes`: continue below.
 
-A key is `TYPESAFE_API_KEY` or `apiKey` in `~/.grunt/jev.json` (mode 0600). Env wins. Setup, when a person asks for it: `node scripts/setup.mjs jev`. Spec: `.rulesync/reference/setup.md`.
+A key is `TYPESAFE_API_KEY` or `apiKey` in `~/.grunt/jev.json` (mode 0600). Env wins. Setup, when a person asks for it: `node .rulesync/scripts/setup.mjs jev`. Spec: `.rulesync/reference/setup.md`.
 
 ## Decision
 
 Write `.tmp/grunt/jev/<slug>-state.txt` (plain text or a JSON object) and `.tmp/grunt/jev/<slug>-questions.json` (the System One questions map). Put every label for that study in the one map. At most 8 questions. State at most 64000 characters.
 
 ```
-node scripts/jev.mjs --state .tmp/grunt/jev/<slug>-state.txt --questions .tmp/grunt/jev/<slug>-questions.json
+node .rulesync/scripts/jev.mjs --state .tmp/grunt/jev/<slug>-state.txt --questions .tmp/grunt/jev/<slug>-questions.json
 ```
 
 Yes/no:

package/.rulesync/reference/law.md

@@ -8,4 +8,4 @@ Reserved (do not reuse in consumer custom skills): `ask` `auto` `browser` `clasp
 
 Override: same name → one SSOT path (`.rulesync/skills/<name>/`). Re-init / `grunt upgrade` force-refresh overwrites grunt-owned names; consumer extras kept. Maps `origin` badge ≠ content picker.
 
-Upgrade copies the current package trees and product scripts, then deletes cumulative retired grunt-owned names (skills `parent` `solo` `cascade`; agents `implementer` `thinker`; scripts `telemetry.mjs` `grunt-config.mjs`; paths `.grok/parent.md` `.grok/skills/shared` `.rulesync/grunt.config.jsonc` `.rulesync/grunt.config.local.jsonc` `.rulesync/grunt.config.local.jsonc.example`) and any reserved skill dir this package no longer ships. `fs.cpSync` does not remove dest extras; prune is what drops them. Consumer skills/refs/scripts not on those lists stay. Extra `##` headings in shared reference docs (e.g. `law.md`) are kept. `grunt:*` package scripts that differ from a known grunt default stay; `grunt:test:e2e` is added only when a vitest e2e config exists. Check steps omitted from dest `scripts/pipeline.mjs` seed `.rulesync/grunt.pipeline.jsonc`. doctor/listen/speak call `scripts/lib/env.mjs` `loadEnv` when that file exists.
+Upgrade copies the current package trees and product scripts (to `.rulesync/scripts/`), then deletes cumulative retired grunt-owned names (skills `parent` `solo` `cascade`; agents `implementer` `thinker`; scripts `telemetry.mjs` `grunt-config.mjs`; paths `.grok/parent.md` `.grok/skills/shared` `.rulesync/grunt.config.jsonc` `.rulesync/grunt.config.local.jsonc` `.rulesync/grunt.config.local.jsonc.example`) and any reserved skill dir this package no longer ships. `fs.cpSync` does not remove dest extras; prune is what drops them. Consumer skills/refs/scripts not on those lists stay. Extra `##` headings in shared reference docs (e.g. `law.md`) are kept. `grunt:*` package scripts that differ from a known grunt default stay; `grunt:test:e2e` is added only when a vitest e2e config exists. When a pre-0.11 root `scripts/` holds `guarded-roots.mjs` or `gate-fat-tools.mjs`, upgrade deletes the grunt product names there, removes the dir if that empties it, and rewrites `scripts/<grunt name>` refs in package scripts and `.rulesync/grunt.pipeline.jsonc`; consumer files and refs stay. Check steps omitted from the dest pipeline (`.rulesync/scripts/pipeline.mjs`, or the legacy root copy) seed `.rulesync/grunt.pipeline.jsonc`. doctor/listen/speak call the consumer's root `scripts/lib/env.mjs` `loadEnv` when that file exists.

package/.rulesync/reference/listen.md

@@ -7,24 +7,24 @@ tags: [listen]
 Speech-to-text from the session. Input only. Not TTS. Not a live voice agent. Not MCP.
 
 ```
-node scripts/listen.mjs whoami
-node scripts/listen.mjs devices
-node scripts/listen.mjs rec [--seconds 8] [--device D] [--clip]
-node scripts/listen.mjs start [--device D]
-node scripts/listen.mjs stop [--clip]
-node scripts/listen.mjs toggle [--clip]
-node scripts/listen.mjs status
-node scripts/listen.mjs file --path clip.wav [--clip]
-node scripts/listen.mjs latest
+node .rulesync/scripts/listen.mjs whoami
+node .rulesync/scripts/listen.mjs devices
+node .rulesync/scripts/listen.mjs rec [--seconds 8] [--device D] [--clip]
+node .rulesync/scripts/listen.mjs start [--device D]
+node .rulesync/scripts/listen.mjs stop [--clip]
+node .rulesync/scripts/listen.mjs toggle [--clip]
+node .rulesync/scripts/listen.mjs status
+node .rulesync/scripts/listen.mjs file --path clip.wav [--clip]
+node .rulesync/scripts/listen.mjs latest
 ```
 
 `rec` records then transcribes (default 8s, cap 120s). `toggle` is the hotkey verb: first run starts, second run stops and prints the transcript. Audio and `latest.txt` live under `.tmp/grunt/listen/`. `--cwd /path/to/repo` when the hotkey does not already run in the repo.
 
 ## Auth and capture
 
-Handheld (any OS): `node scripts/setup.mjs listen` or `npm exec grunt setup` → listen. Prints OS install commands for ffmpeg / whisper-cli (does not run them), optional ggml download into `~/.grunt/whisper/`, OpenAI fallback key if local STT is missing.
+Handheld (any OS): `node .rulesync/scripts/setup.mjs listen` or `npm exec grunt setup` → listen. Prints OS install commands for ffmpeg / whisper-cli (does not run them), optional ggml download into `~/.grunt/whisper/`, OpenAI fallback key if local STT is missing.
 
-If ffmpeg, whisper-cli, a ggml model, or `OPENAI_API_KEY` is missing, the CLI prints `setup: node scripts/setup.mjs listen` and exits 1. Agents should show that line, not a stack or JSON. Do not invent a key.
+If ffmpeg, whisper-cli, a ggml model, or `OPENAI_API_KEY` is missing, the CLI prints `setup: node .rulesync/scripts/setup.mjs listen` and exits 1. Agents should show that line, not a stack or JSON. Do not invent a key.
 
 STT prefers **local whisper.cpp**. Install the binary; the first `listen` downloads `ggml-base.en.bin` (~142MB) into `~/.grunt/whisper/`. No API cost after that. If the binary or download is missing, it falls back to OpenAI `whisper-1` (`OPENAI_API_KEY` or `~/.grunt/speak.json`). Force with `LISTEN_STT=local` or `LISTEN_STT=openai`. Never commit keys.
 
@@ -45,7 +45,7 @@ One install:
 - linux: build https://github.com/ggml-org/whisper.cpp (`whisper-cli` on PATH)
 - win: whisper.cpp release `whisper-cli.exe` on PATH
 
-Then `node scripts/listen.mjs whoami` or `rec`. The first run fetches `ggml-base.en.bin` to `~/.grunt/whisper/`. Do not pip-install OpenAI Whisper. Do not curl the model yourself unless the auto-download fails.
+Then `node .rulesync/scripts/listen.mjs whoami` or `rec`. The first run fetches `ggml-base.en.bin` to `~/.grunt/whisper/`. Do not pip-install OpenAI Whisper. Do not curl the model yourself unless the auto-download fails.
 
 Larger models: put another `ggml-*.bin` in that folder or set `WHISPER_MODEL`. Doctor reports `whisper-cli` as optional. `whoami` prints `stt=local` or `stt=openai`.
 

package/.rulesync/reference/map.md

@@ -13,7 +13,7 @@ Cheap outline. Not a file dump.
 - `.rulesync/reference/hooks.md` — hook policy
 - `.rulesync/reference/map.md` — this file
 - `.rulesync/reference/output.md` — default voice
-- `.rulesync/reference/scope.md` — size gate; research → suggest → wait → `/write-plan` → `/implement-plan`
+- `.rulesync/reference/scope.md` — size gate; plan by default: research → `/write-plan` → approval → `/implement-plan`
 - `.rulesync/reference/law.md` — domain law (stub; protocol stays cascade/overview)
 - Generated catalogs: `.rulesync/reference/INDEX.md` — aggregate catalog composed from slices (law.md, skills-map.md, refs-map.md). Maps/law = slices for deep dive. INDEX always. Not if-maps-else
 
@@ -29,35 +29,35 @@ Cheap outline. Not a file dump.
 - Init/upgrade prune (cumulative): retired skills `parent` `solo` `cascade`; agents `implementer` `thinker` (host files + `.grok/roles/{name}.toml` + `.gemini/agents/{name}/`); scripts `telemetry.mjs` `grunt-config.mjs`; `.grok/parent.md`; `.grok/skills/shared`; `.rulesync/grunt.config.jsonc` plus local overlay and example; reserved skill dirs this package no longer ships
 - `.grok/hooks/rtk.json` — RTK
 - `.grok/skills/` — generated from `.rulesync/skills/`; do not hand-edit
-- `.grok/global-settings.toml` — merged into `~/.grok/config.toml` by `scripts/sync-global-settings.mjs` (not auto-loaded; project config cannot set `[features]`)
+- `.grok/global-settings.toml` — merged into `~/.grok/config.toml` by `.rulesync/scripts/sync-global-settings.mjs` (not auto-loaded; project config cannot set `[features]`)
 - `.rulesync/global-settings/` — host manifest and reserved noop payloads
 - `.rulesync/mcp-policy.jsonc` — MCP deny-default SSOT (`default: deny`, `allow: []`)
 - `.rulesync/skills/{ask,auto,browser,clasp,commit,commit-and-push,commit-push,commit-push-deploy,commit-push-release,explain,google-workspace,handoff,implement-plan,listen,pickup,speak,tmp,write-plan}/` — skill SSOT; `rulesync -f skills` emits host mirrors byte-equal
 
 ## Scripts
-- `scripts/pipeline.mjs` — inner generate/check/watch chain (rulesync + emit-* + hooks-union / check-globals). Called by `guarded-roots`; not a public npm script (`rulesync:generate` `rulesync:check` `rulesync:watch` only)
-- `scripts/guarded-md.mjs` — sentinel merge for `AGENTS.md` `CLAUDE.md` `GEMINI.md`; copied into consumers
-- `scripts/guarded-roots.mjs` — snapshot/remerge `AGENTS.md` `CLAUDE.md` `GEMINI.md` around pipeline; check interiors wrapper
-- `scripts/check-globals.mjs` — `$HOME/.grok/config.toml` `[agent].name==orchestrator` + `[features].two_pass_compaction==true`
-- `scripts/gate-fat-tools.mjs`
-- `scripts/scrub-spawn-prompt.mjs`
-- `scripts/grunt-job.mjs` — flags `--job` `--query` `--path` `--glob` (repeatable) `--cwd`; regex in `--query` OK; never `cd &&`; unknown flags / exec shell-meta → FALLBACK
-- `scripts/parse-need.mjs`
-- `scripts/persist-handoff.mjs` — `.tmp/grunt/handoffs/{serial}-{slug}-{stamp}.md`
-- `scripts/persist-tmp.mjs` — `.tmp/grunt/{serial}-{slug}-{stamp}.{ext}` root files
-- `scripts/persist-plan.mjs`
-- `scripts/persist-implementation.mjs` — `.tmp/grunt/implementations/{serial}-{slug}-{stamp}.md`
-- `scripts/sync-global-settings.mjs`
-- `scripts/purge-global-mcps.mjs`
-- `scripts/emit-mcp-policy.mjs`
-- `scripts/emit-gemini.mjs`
-- `scripts/emit-agent-shell-tools.mjs`
-- `scripts/browser.mjs` — session browser rail
-- `scripts/google-workspace.mjs` — Sheets Docs Slides Calendar Gmail Drive
-- `scripts/speak.mjs` — TTS
-- `scripts/listen.mjs` — STT
-- `scripts/setup.mjs` — handheld speak / listen / google-workspace / browser (`~/.grunt/`)
-- `scripts/doctor.mjs` — unified prereqs; optional google-workspace (`oauth` `tokens` `adc` `clasprc`), speak, clasp, ffmpeg, whisper-cli
+- `.rulesync/scripts/pipeline.mjs` — inner generate/check/watch chain (rulesync + emit-* + hooks-union / check-globals). Called by `guarded-roots`; not a public npm script (`rulesync:generate` `rulesync:check` `rulesync:watch` only)
+- `.rulesync/scripts/guarded-md.mjs` — sentinel merge for `AGENTS.md` `CLAUDE.md` `GEMINI.md`; copied into consumers
+- `.rulesync/scripts/guarded-roots.mjs` — snapshot/remerge `AGENTS.md` `CLAUDE.md` `GEMINI.md` around pipeline; check interiors wrapper
+- `.rulesync/scripts/check-globals.mjs` — `$HOME/.grok/config.toml` `[agent].name==orchestrator` + `[features].two_pass_compaction==true`
+- `.rulesync/scripts/gate-fat-tools.mjs`
+- `.rulesync/scripts/scrub-spawn-prompt.mjs`
+- `.rulesync/scripts/grunt-job.mjs` — flags `--job` `--query` `--path` `--glob` (repeatable) `--cwd`; regex in `--query` OK; never `cd &&`; unknown flags / exec shell-meta → FALLBACK
+- `.rulesync/scripts/parse-need.mjs`
+- `.rulesync/scripts/persist-handoff.mjs` — `.tmp/grunt/handoffs/{serial}-{slug}-{stamp}.md`
+- `.rulesync/scripts/persist-tmp.mjs` — `.tmp/grunt/{serial}-{slug}-{stamp}.{ext}` root files
+- `.rulesync/scripts/persist-plan.mjs`
+- `.rulesync/scripts/persist-implementation.mjs` — `.tmp/grunt/implementations/{serial}-{slug}-{stamp}.md`
+- `.rulesync/scripts/sync-global-settings.mjs`
+- `.rulesync/scripts/purge-global-mcps.mjs`
+- `.rulesync/scripts/emit-mcp-policy.mjs`
+- `.rulesync/scripts/emit-gemini.mjs`
+- `.rulesync/scripts/emit-agent-shell-tools.mjs`
+- `.rulesync/scripts/browser.mjs` — session browser rail
+- `.rulesync/scripts/google-workspace.mjs` — Sheets Docs Slides Calendar Gmail Drive
+- `.rulesync/scripts/speak.mjs` — TTS
+- `.rulesync/scripts/listen.mjs` — STT
+- `.rulesync/scripts/setup.mjs` — handheld speak / listen / google-workspace / browser (`~/.grunt/`)
+- `.rulesync/scripts/doctor.mjs` — unified prereqs; optional google-workspace (`oauth` `tokens` `adc` `clasprc`), speak, clasp, ffmpeg, whisper-cli
 
 ## Tmp
 - `.tmp/grunt/plans/` — persist-plan; format SSOT = `.rulesync/reference/plan-format.md`

package/.rulesync/reference/output.md

@@ -4,7 +4,15 @@ tags: [output]
 
 # Output
 
-en-US unless asked. Concise complete sentences with natural grammar. Skip filler and fluff.
+en-US unless asked. Concise complete sentences with natural grammar. Skip filler and fluff. Examples are a class.
+
+An example, an open list, or a negative example is a class, not the whole set and not a script. `...`, `…`, `etc`, `etc.`, etcetera, and a `;` between specimens are that same class. Infer the class and do what reasonably fits this case, including what they did not name. Cue names are examples too: example, e.g., for instance, such as, and so on, a sketched sentence, one labeled case. A `;` in code or an ordinary clause join is not a cue. A negative example is a class to avoid. Do not copy its words, stop at the named items, reuse one reply for every turn, or add work outside the class. Pick the count and the form for this case.
+
+A closed instruction stays literal. Cues of that kind include only, exactly, just these, verbatim, no others, a schema, an identifier, a command, or quoted text. When an open cue and a closed cue both apply, the closed cue wins.
+
+A question or a work result opens with the least demanding lines: the verdict, the counts, or the outcome, failures and gaps included. The middle is the short explanation, tied to the constraint they named. The last line lands those same facts as the decision or the one real next step. Do not invent a question, soften a mixed result, or let the close introduce new numbers. One sentence is enough when that is the whole answer.
+
+Skip that shape when they asked for a raw artifact to copy, or a format already defines the reply. `/su`, plan files, commit subjects, and grunt-job stdout keep their own shape. `/explain` keeps this shape and may lengthen the middle. Grunt children do not talk to the user. In a plan or a spawn prompt, write the class, not only the named items.
 
 Completed work uses past verbs and paths. If more work remains, say what. Ask in English when a choice is real. `/auto` asks on blockers; `/ask` asks after each step.