@lovrozagar/grunt 0.3.9 → 0.3.11

package/.agents/agents/implementer.md

@@ -14,10 +14,10 @@ inheritMcp: false
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
-Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
+Implement specified solution. User prompt may be the spec; `.tmp/plans` not required for small/defined writes. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
-Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
+Write-allowlist = paths listed in the spec/plan/prompt only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.agents/agents/orchestrator.md

@@ -15,7 +15,7 @@ Always-do:
 
 | signal | next |
 |---|---|
-| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| create/change product files | small/simple or prompt-is-spec → implementer; large/complex + no spec → thinker then implementer. Never parent Write/Bash/Skill |
 | plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
@@ -35,7 +35,7 @@ Always-do:
 
 You do not talk. First token = spawn. Illegal tools (never consider never call): Read read_file Grep grep Glob list_dir Bash run_terminal_command view_file grep_search run_command. Not in toolkit. Hook deny = backstop not UX. Next=spawn not retry. Only /solo (stamp grunt-off-{sid} this session) escapes spawn workflow. /explain=voice+post-child recap never parent Read. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
-grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
+grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution or prompt-is-spec. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. Grok: `get_command_or_subagent_output` `timeout_ms=60000` every peek. Else GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.
 Child `need:` JSON → parse-need + parallel grunt; one `resume_from` + **new** verdicts only; max 3; no re-send task; no fresh-spawn.

package/.agents/skills/commit/SKILL.md

@@ -2,9 +2,9 @@
 name: commit
 description: >
   Inspect the diff and commit with a Conventional Commits subject line. Use for
-  /commit, "commit this", "commit these changes". Never pushes.
+  /commit, "commit this", "commit these changes". Never git push.
 ---
-Inspect `git status` + `git diff` (staged and unstaged) before the message. Never push.
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
 
 Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
 
@@ -16,6 +16,6 @@ Subject: imperative lowercase no trailing period.
 
 NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
 
-Never `git push`.
+Never git push. Never `git push`. This skill never pushes.
 
 Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.agents/skills/commit-and-push/SKILL.md

@@ -1,15 +1,9 @@
 ---
 name: commit-and-push
 description: >
-  Commit like /commit, then push to the current branch's upstream. Use for
-  /commit-and-push, "commit and push", "commit this and push".
+  Commit and push. Use for /commit-and-push, "commit and push", "commit this and
+  push". Must push.
 ---
-Run commit skill rules first (`.rulesync/skills/commit/SKILL.md`). Then push.
-
-If on default branch, create/switch to a feature branch first — never push default directly.
-
-Push upstream; if no upstream `git push -u origin <current-branch>`.
-
-Never force-push.
+Use `.rulesync/skills/commit-push/SKILL.md`. Must push. Do not load /commit.
 
 Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.agents/skills/commit-push/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: commit-push
+description: >
+  Commit with a Conventional Commits subject, then push. Use for /commit-push,
+  "commit and push", "commit this and push". Must push. Never force-push.
+---
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
+
+Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
+
+Message = Conventional Commits **subject only**: `type(scope): subject` (scope optional).
+
+Types: feat fix docs style refactor perf test build ci chore revert.
+
+Subject: imperative lowercase no trailing period.
+
+NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
+
+Must `git push`. Do not load /commit. Ignore never-push.
+
+## Branch
+
+Current: `git rev-parse --abbrev-ref HEAD`
+
+Default: `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` (strip `origin/`). If that fails: ask. Never invent default.
+
+Recent (frozen flags; do not change):
+
+```
+git reflog -n 30
+git for-each-ref --count=8 --sort=-committerdate --format='%(refname:short) %(committerdate:unix)' refs/heads
+```
+
+Recent = unique existing non-default names from those two outputs whose `committerdate` unix is ≤7d (`now - 604800`). Never invent branch names. Unknown/ambiguous names → drop them, do not guess.
+
+| state | action |
+| current ≠ default | push current |
+| default AND 0 recent | push default |
+| default AND exactly 1 recent exists | `git checkout` that name; push it |
+| else | ask; do not push yet |
+
+No upstream (`git rev-parse --abbrev-ref @{upstream}` fails): `git push -u origin <branch>`. Else `git push`.
+
+Never force-push. Never `--force`, `-f`, `--force-with-lease`, `+<branch>`.
+
+Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.agents/skills/commit-push-deploy/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: commit-push-deploy
+description: >
+  Commit, push, then deploy only if allowlisted infra already exists. Use for
+  /commit-push-deploy, "commit push deploy", "deploy this". Must push. Never
+  force-push. Never invent infra.
+---
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
+
+Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
+
+Message = Conventional Commits **subject only**: `type(scope): subject` (scope optional).
+
+Types: feat fix docs style refactor perf test build ci chore revert.
+
+Subject: imperative lowercase no trailing period.
+
+NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
+
+Must `git push`. Do not load /commit. Ignore never-push.
+
+## Branch
+
+Current: `git rev-parse --abbrev-ref HEAD`
+
+Default: `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` (strip `origin/`). If that fails: ask. Never invent default.
+
+Recent (frozen flags; do not change):
+
+```
+git reflog -n 30
+git for-each-ref --count=8 --sort=-committerdate --format='%(refname:short) %(committerdate:unix)' refs/heads
+```
+
+Recent = unique existing non-default names from those two outputs whose `committerdate` unix is ≤7d (`now - 604800`). Never invent branch names. Unknown/ambiguous names → drop them, do not guess.
+
+| state | action |
+| current ≠ default | push current |
+| default AND 0 recent | push default |
+| default AND exactly 1 recent exists | `git checkout` that name; push it |
+| else | ask; do not push yet |
+
+No upstream (`git rev-parse --abbrev-ref @{upstream}` fails): `git push -u origin <branch>`. Else `git push`.
+
+Never force-push. Never `--force`, `-f`, `--force-with-lease`, `+<branch>`.
+
+## Deploy
+
+After push. Detect **existing** repo-root (or listed) paths only — never create them:
+
+`fly.toml` `vercel.json` `netlify.toml` `wrangler.toml` `wrangler.jsonc` `railway.toml` `railway.json` `render.yaml` `render.yml` `app.yaml` `Dockerfile` `docker-compose.yml` `docker-compose.yaml` `samconfig.toml` `serverless.yml` `serverless.yaml` `Pulumi.yaml` `terraform/` `.do/app.yaml`
+
+This repo (`package.json` `name` `@lovrozagar/grunt`): skip deploy. Stop after push.
+
+No allowlist hit: skip. Never invent infra, hosts, workflows, or config.
+
+Hit: run only a deploy command already documented in-repo (scripts/CI/README). Do not guess a provider. Do not add files.
+
+Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.agents/skills/commit-push-release/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: commit-push-release
+description: >
+  Commit, push, bump package.json, tag vX.Y.Z, push the tag. CI publishes. Use
+  for /commit-push-release, "commit push release", "release". Must push. Never
+  force-push. No npm/gh publish.
+---
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
+
+Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
+
+Message = Conventional Commits **subject only**: `type(scope): subject` (scope optional).
+
+Types: feat fix docs style refactor perf test build ci chore revert.
+
+Subject: imperative lowercase no trailing period.
+
+NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
+
+Must `git push`. Do not load /commit. Ignore never-push.
+
+## Branch
+
+Current: `git rev-parse --abbrev-ref HEAD`
+
+Default: `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` (strip `origin/`). If that fails: ask. Never invent default.
+
+Recent (frozen flags; do not change):
+
+```
+git reflog -n 30
+git for-each-ref --count=8 --sort=-committerdate --format='%(refname:short) %(committerdate:unix)' refs/heads
+```
+
+Recent = unique existing non-default names from those two outputs whose `committerdate` unix is ≤7d (`now - 604800`). Never invent branch names. Unknown/ambiguous names → drop them, do not guess.
+
+| state | action |
+| current ≠ default | push current |
+| default AND 0 recent | push default |
+| default AND exactly 1 recent exists | `git checkout` that name; push it |
+| else | ask; do not push yet |
+
+No upstream (`git rev-parse --abbrev-ref @{upstream}` fails): `git push -u origin <branch>`. Else `git push`.
+
+Never force-push. Never `--force`, `-f`, `--force-with-lease`, `+<branch>`.
+
+## Release
+
+Ask if off default, or patch/minor/major is unclear. Do not guess semver. Do not tag until answered.
+
+On default + clear bump:
+
+1. Set `package.json` `version` to `X.Y.Z` (keep lockfile in sync if it records version).
+2. Commit the bump with the same subject rules (`chore(release): vX.Y.Z` unless the user gave a subject).
+3. Push the branch per **Branch**.
+4. `git tag vX.Y.Z` then `git push origin vX.Y.Z`.
+
+Do not `npm publish`. Do not `npm pack` as publish. Do not `gh release create`. CI publishes from the tag.
+
+Retag only if asked. Unprompted: never `git tag -f`, never delete a tag, never force-push a tag. If asked to retag: move that tag only; still never force-push a branch.
+
+Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.claude/agents/implementer.md

@@ -17,10 +17,10 @@ effort: medium
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
-Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
+Implement specified solution. User prompt may be the spec; `.tmp/plans` not required for small/defined writes. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
-Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
+Write-allowlist = paths listed in the spec/plan/prompt only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.claude/agents/orchestrator.md

@@ -18,7 +18,7 @@ Always-do:
 
 | signal | next |
 |---|---|
-| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| create/change product files | small/simple or prompt-is-spec → implementer; large/complex + no spec → thinker then implementer. Never parent Write/Bash/Skill |
 | plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
@@ -38,7 +38,7 @@ Always-do:
 
 You do not talk. First token = spawn. Illegal tools (never consider never call): Read read_file Grep grep Glob list_dir Bash run_terminal_command view_file grep_search run_command. Not in toolkit. Hook deny = backstop not UX. Next=spawn not retry. Only /solo (stamp grunt-off-{sid} this session) escapes spawn workflow. /explain=voice+post-child recap never parent Read. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
-grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
+grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution or prompt-is-spec. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. Grok: `get_command_or_subagent_output` `timeout_ms=60000` every peek. Else GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.
 Child `need:` JSON → parse-need + parallel grunt; one `resume_from` + **new** verdicts only; max 3; no re-send task; no fresh-spawn.

package/.claude/skills/commit/SKILL.md

@@ -2,9 +2,9 @@
 name: commit
 description: >
   Inspect the diff and commit with a Conventional Commits subject line. Use for
-  /commit, "commit this", "commit these changes". Never pushes.
+  /commit, "commit this", "commit these changes". Never git push.
 ---
-Inspect `git status` + `git diff` (staged and unstaged) before the message. Never push.
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
 
 Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
 
@@ -16,6 +16,6 @@ Subject: imperative lowercase no trailing period.
 
 NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
 
-Never `git push`.
+Never git push. Never `git push`. This skill never pushes.
 
 Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.claude/skills/commit-and-push/SKILL.md

@@ -1,15 +1,9 @@
 ---
 name: commit-and-push
 description: >
-  Commit like /commit, then push to the current branch's upstream. Use for
-  /commit-and-push, "commit and push", "commit this and push".
+  Commit and push. Use for /commit-and-push, "commit and push", "commit this and
+  push". Must push.
 ---
-Run commit skill rules first (`.rulesync/skills/commit/SKILL.md`). Then push.
-
-If on default branch, create/switch to a feature branch first — never push default directly.
-
-Push upstream; if no upstream `git push -u origin <current-branch>`.
-
-Never force-push.
+Use `.rulesync/skills/commit-push/SKILL.md`. Must push. Do not load /commit.
 
 Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.claude/skills/commit-push/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: commit-push
+description: >
+  Commit with a Conventional Commits subject, then push. Use for /commit-push,
+  "commit and push", "commit this and push". Must push. Never force-push.
+---
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
+
+Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
+
+Message = Conventional Commits **subject only**: `type(scope): subject` (scope optional).
+
+Types: feat fix docs style refactor perf test build ci chore revert.
+
+Subject: imperative lowercase no trailing period.
+
+NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
+
+Must `git push`. Do not load /commit. Ignore never-push.
+
+## Branch
+
+Current: `git rev-parse --abbrev-ref HEAD`
+
+Default: `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` (strip `origin/`). If that fails: ask. Never invent default.
+
+Recent (frozen flags; do not change):
+
+```
+git reflog -n 30
+git for-each-ref --count=8 --sort=-committerdate --format='%(refname:short) %(committerdate:unix)' refs/heads
+```
+
+Recent = unique existing non-default names from those two outputs whose `committerdate` unix is ≤7d (`now - 604800`). Never invent branch names. Unknown/ambiguous names → drop them, do not guess.
+
+| state | action |
+| current ≠ default | push current |
+| default AND 0 recent | push default |
+| default AND exactly 1 recent exists | `git checkout` that name; push it |
+| else | ask; do not push yet |
+
+No upstream (`git rev-parse --abbrev-ref @{upstream}` fails): `git push -u origin <branch>`. Else `git push`.
+
+Never force-push. Never `--force`, `-f`, `--force-with-lease`, `+<branch>`.
+
+Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.claude/skills/commit-push-deploy/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: commit-push-deploy
+description: >
+  Commit, push, then deploy only if allowlisted infra already exists. Use for
+  /commit-push-deploy, "commit push deploy", "deploy this". Must push. Never
+  force-push. Never invent infra.
+---
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
+
+Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
+
+Message = Conventional Commits **subject only**: `type(scope): subject` (scope optional).
+
+Types: feat fix docs style refactor perf test build ci chore revert.
+
+Subject: imperative lowercase no trailing period.
+
+NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
+
+Must `git push`. Do not load /commit. Ignore never-push.
+
+## Branch
+
+Current: `git rev-parse --abbrev-ref HEAD`
+
+Default: `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` (strip `origin/`). If that fails: ask. Never invent default.
+
+Recent (frozen flags; do not change):
+
+```
+git reflog -n 30
+git for-each-ref --count=8 --sort=-committerdate --format='%(refname:short) %(committerdate:unix)' refs/heads
+```
+
+Recent = unique existing non-default names from those two outputs whose `committerdate` unix is ≤7d (`now - 604800`). Never invent branch names. Unknown/ambiguous names → drop them, do not guess.
+
+| state | action |
+| current ≠ default | push current |
+| default AND 0 recent | push default |
+| default AND exactly 1 recent exists | `git checkout` that name; push it |
+| else | ask; do not push yet |
+
+No upstream (`git rev-parse --abbrev-ref @{upstream}` fails): `git push -u origin <branch>`. Else `git push`.
+
+Never force-push. Never `--force`, `-f`, `--force-with-lease`, `+<branch>`.
+
+## Deploy
+
+After push. Detect **existing** repo-root (or listed) paths only — never create them:
+
+`fly.toml` `vercel.json` `netlify.toml` `wrangler.toml` `wrangler.jsonc` `railway.toml` `railway.json` `render.yaml` `render.yml` `app.yaml` `Dockerfile` `docker-compose.yml` `docker-compose.yaml` `samconfig.toml` `serverless.yml` `serverless.yaml` `Pulumi.yaml` `terraform/` `.do/app.yaml`
+
+This repo (`package.json` `name` `@lovrozagar/grunt`): skip deploy. Stop after push.
+
+No allowlist hit: skip. Never invent infra, hosts, workflows, or config.
+
+Hit: run only a deploy command already documented in-repo (scripts/CI/README). Do not guess a provider. Do not add files.
+
+Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.claude/skills/commit-push-release/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: commit-push-release
+description: >
+  Commit, push, bump package.json, tag vX.Y.Z, push the tag. CI publishes. Use
+  for /commit-push-release, "commit push release", "release". Must push. Never
+  force-push. No npm/gh publish.
+---
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
+
+Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
+
+Message = Conventional Commits **subject only**: `type(scope): subject` (scope optional).
+
+Types: feat fix docs style refactor perf test build ci chore revert.
+
+Subject: imperative lowercase no trailing period.
+
+NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
+
+Must `git push`. Do not load /commit. Ignore never-push.
+
+## Branch
+
+Current: `git rev-parse --abbrev-ref HEAD`
+
+Default: `git symbolic-ref --quiet --short refs/remotes/origin/HEAD` (strip `origin/`). If that fails: ask. Never invent default.
+
+Recent (frozen flags; do not change):
+
+```
+git reflog -n 30
+git for-each-ref --count=8 --sort=-committerdate --format='%(refname:short) %(committerdate:unix)' refs/heads
+```
+
+Recent = unique existing non-default names from those two outputs whose `committerdate` unix is ≤7d (`now - 604800`). Never invent branch names. Unknown/ambiguous names → drop them, do not guess.
+
+| state | action |
+| current ≠ default | push current |
+| default AND 0 recent | push default |
+| default AND exactly 1 recent exists | `git checkout` that name; push it |
+| else | ask; do not push yet |
+
+No upstream (`git rev-parse --abbrev-ref @{upstream}` fails): `git push -u origin <branch>`. Else `git push`.
+
+Never force-push. Never `--force`, `-f`, `--force-with-lease`, `+<branch>`.
+
+## Release
+
+Ask if off default, or patch/minor/major is unclear. Do not guess semver. Do not tag until answered.
+
+On default + clear bump:
+
+1. Set `package.json` `version` to `X.Y.Z` (keep lockfile in sync if it records version).
+2. Commit the bump with the same subject rules (`chore(release): vX.Y.Z` unless the user gave a subject).
+3. Push the branch per **Branch**.
+4. `git tag vX.Y.Z` then `git push origin vX.Y.Z`.
+
+Do not `npm publish`. Do not `npm pack` as publish. Do not `gh release create`. CI publishes from the tag.
+
+Retag only if asked. Unprompted: never `git tag -f`, never delete a tag, never force-push a tag. If asked to retag: move that tag only; still never force-push a branch.
+
+Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.codex/agents/implementer.toml

@@ -7,10 +7,10 @@ approval_policy = "never"
 developer_instructions = '''
 Voice: `.rulesync/reference/output.md` — must follow.
 
-Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
+Implement specified solution. User prompt may be the spec; `.tmp/plans` not required for small/defined writes. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
-Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
+Write-allowlist = paths listed in the spec/plan/prompt only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.codex/agents/orchestrator.toml

@@ -12,7 +12,7 @@ Always-do:
 
 | signal | next |
 |---|---|
-| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| create/change product files | small/simple or prompt-is-spec → implementer; large/complex + no spec → thinker then implementer. Never parent Write/Bash/Skill |
 | plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
@@ -32,7 +32,7 @@ Always-do:
 
 You do not talk. First token = spawn. Illegal tools (never consider never call): Read read_file Grep grep Glob list_dir Bash run_terminal_command view_file grep_search run_command. Not in toolkit. Hook deny = backstop not UX. Next=spawn not retry. Only /solo (stamp grunt-off-{sid} this session) escapes spawn workflow. /explain=voice+post-child recap never parent Read. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
-grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
+grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution or prompt-is-spec. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. Grok: `get_command_or_subagent_output` `timeout_ms=60000` every peek. Else GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.
 Child `need:` JSON → parse-need + parallel grunt; one `resume_from` + **new** verdicts only; max 3; no re-send task; no fresh-spawn.

package/.grok/agents/implementer.md

@@ -9,10 +9,10 @@ tools: read_file, grep, list_dir, write, search_replace, run_terminal_command, w
 ---
 Voice: `.rulesync/reference/output.md` — must follow.
 
-Implement specified solution. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
+Implement specified solution. User prompt may be the spec; `.tmp/plans` not required for small/defined writes. Never spawn. Never run for simple tool usage (grunt agent). Never plan (thinker agent).
 After write: validate+sim (mandatory). Fix hard failures. Return findings. Never skip validation
 Read/Grep/list_dir only if needed for edit. Prefer: implement the spec; dump via `need:`.
-Write-allowlist = paths listed in the spec/plan only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
+Write-allowlist = paths listed in the spec/plan/prompt only. No unsolicited README/docs/examples. Missing path → blocker/`need:`; do not invent. Checkbox-flip the plan file.
 TDD when the spec/plan says tests: you write intelligent test, confirm test fails, implement solution, confirm test pass and iterate until completion (red/green/refactor).
 Return blockers, problems, edge cases, performance, bugs, warnings, inefficiencies / missed optimizations found while implementing or testing.
 

package/.grok/agents/orchestrator.md

@@ -14,7 +14,7 @@ Always-do:
 
 | signal | next |
 |---|---|
-| create/change product files | spawn implementer (thinker then implementer if no spec). Never parent Write/Bash/Skill |
+| create/change product files | small/simple or prompt-is-spec → implementer; large/complex + no spec → thinker then implementer. Never parent Write/Bash/Skill |
 | plan/spec ready + file writes remain | persist plan if needed; spawn implementer; do not recap-stop |
 | tools/facts/git/test/mechanical write | spawn grunt |
 | world fact | spawn grunt `job:web` |
@@ -34,7 +34,7 @@ Always-do:
 
 You do not talk. First token = spawn. Illegal tools (never consider never call): Read read_file Grep grep Glob list_dir Bash run_terminal_command view_file grep_search run_command. Not in toolkit. Hook deny = backstop not UX. Next=spawn not retry. Only /solo (stamp grunt-off-{sid} this session) escapes spawn workflow. /explain=voice+post-child recap never parent Read. No try-then-spawn. No parent probe. No skip-spawn. No trivia/cheap. User-visible = legal tag + **one-line** echo only. Siblings still run: `[grunt]:` echo. Facts/search/trees → grunt, never thinker.
 Spawn only `grunt` | `implementer` | `thinker`. Omit `model`. Isolation `none` unless asked. Never spawn `orchestrator`. Children never spawn.
-grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution (not the spec). thinker ← plan/deep reason/spec.
+grunt ← tools. World fact → grunt `job: web`. Never memory. implementer ← specified solution or prompt-is-spec. thinker ← plan/deep reason.
 Child prompt first sentence only: `You are {agent} subagent.` Then task + abs paths + verdicts only.
 Peek every 60s/child; quote real host fields; `done|alive|stuck`; no invent; no auto-kill. Grok: `get_command_or_subagent_output` `timeout_ms=60000` every peek. Else GAP: block on spawn return = `done`. Stuck/blocked: quote host fields only.
 Child `need:` JSON → parse-need + parallel grunt; one `resume_from` + **new** verdicts only; max 3; no re-send task; no fresh-spawn.

package/.grok/hooks/orchestrate-parent.js

@@ -34,9 +34,9 @@ import { logTelemetry, ORCHESTRATOR_LOGS_DIR } from "../../scripts/telemetry.mjs
 export const DENY_REASON =
   "First action=spawn implementer|grunt|thinker. Deny expected. Only /solo this session escapes.";
 export const STOP_REASONS = [
-  "Spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
-  "Still spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
-  "Last spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else no spec → thinker. Else recap `[orchestrator]:` one-line.",
+  "Spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else large/complex + no spec → thinker. Else small/simple/defined → implementer. Else recap `[orchestrator]:` one-line.",
+  "Still spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else large/complex + no spec → thinker. Else small/simple/defined → implementer. Else recap `[orchestrator]:` one-line.",
+  "Last spawn: ⚠/validate/sim findings or writes remain or parent just tried to Write → spawn implementer. Else facts → grunt. Else large/complex + no spec → thinker. Else small/simple/defined → implementer. Else recap `[orchestrator]:` one-line.",
 ];
 const TRANSCRIPT_TAIL_BYTES = 512 * 1024;
 const PARENT_TOOLS = new Set([

package/.grok/skills/commit/SKILL.md

@@ -2,9 +2,9 @@
 name: commit
 description: >
   Inspect the diff and commit with a Conventional Commits subject line. Use for
-  /commit, "commit this", "commit these changes". Never pushes.
+  /commit, "commit this", "commit these changes". Never git push.
 ---
-Inspect `git status` + `git diff` (staged and unstaged) before the message. Never push.
+Inspect `git status` + `git diff` (staged and unstaged) before the message.
 
 Stage only user intent. Never blind `git add -A` / `git add .`. Split unrelated concerns into multiple commits.
 
@@ -16,6 +16,6 @@ Subject: imperative lowercase no trailing period.
 
 NO body. NO footer. NO `Co-Authored-By`. NO `Generated with`. NO 🤖. NO trailers. No AI attribution. Work belongs to the human.
 
-Never `git push`.
+Never git push. Never `git push`. This skill never pushes.
 
 Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.

package/.grok/skills/commit-and-push/SKILL.md

@@ -1,15 +1,9 @@
 ---
 name: commit-and-push
 description: >
-  Commit like /commit, then push to the current branch's upstream. Use for
-  /commit-and-push, "commit and push", "commit this and push".
+  Commit and push. Use for /commit-and-push, "commit and push", "commit this and
+  push". Must push.
 ---
-Run commit skill rules first (`.rulesync/skills/commit/SKILL.md`). Then push.
-
-If on default branch, create/switch to a feature branch first — never push default directly.
-
-Push upstream; if no upstream `git push -u origin <current-branch>`.
-
-Never force-push.
+Use `.rulesync/skills/commit-push/SKILL.md`. Must push. Do not load /commit.
 
 Protocol: `.rulesync/reference/cascade.md`. Do not paste cascade.