@massu/core 1.15.5 → 1.15.7

package/commands/massu-debug/references/common-shortcuts.md

@@ -1,5 +1,7 @@
 # Common Debugging Shortcuts
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 Quick diagnosis patterns for common error types.
 
 ---

package/commands/massu-debug/references/investigation-phases.md

@@ -1,5 +1,7 @@
 # Investigation Phases (0-7)
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 Full detail for each investigation phase in the massu-debug protocol.
 
 ---

package/commands/massu-debug/references/report-format.md

@@ -1,5 +1,7 @@
 # Debug Report Format
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 Templates for the debug report and session state update.
 
 ---

package/commands/massu-deploy.python-docker.md

@@ -4,6 +4,8 @@ description: "Deploy a containerized Python service via docker compose — force
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — Docker Compose
 
 Force-recreates the Docker container for a Python service using `docker compose`. Use this variant when your service is containerized and `massu.config.yaml` declares `config.python.service_label` matching the compose service name.

package/commands/massu-deploy.python-fly.md

@@ -4,6 +4,8 @@ description: "Deploy a Python service to Fly.io — flyctl deploy, status check,
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — Fly.io
 
 Deploys a Python service to Fly.io using `flyctl deploy`. Use this variant when your project targets Fly.io and has a `fly.toml` in the repository root. The app name comes from `fly.toml` (or `config.python.service_label` as a fallback).

package/commands/massu-deploy.python-launchd.md

@@ -4,6 +4,8 @@ description: "Deploy a Python service supervised by launchd (macOS) — restart
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — launchd (macOS)
 
 Restarts a Python service running under `launchd` on macOS. Use this variant when your `massu.config.yaml` declares `config.python.service_label` and your host is macOS.

package/commands/massu-deploy.python-systemd.md

@@ -4,6 +4,8 @@ description: "Deploy a Python service supervised by systemd (Linux) — restart
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Massu Deploy: Python Service — systemd (Linux)
 
 Restarts a Python service running under a `systemd --user` unit on Linux. Use this variant when your `massu.config.yaml` declares `config.python.service_label` and your host is Linux.

package/commands/massu-full-audit.md

@@ -1,3 +1,5 @@
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 name: massu-full-audit
 
 # Massu Full Audit

package/commands/massu-golden-path/references/approval-points.md

@@ -1,5 +1,7 @@
 # Approval Points
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 There are exactly 4 approval points (5 when using `--competitive` mode) where the golden path pauses for user input. Everything else runs automatically.

package/commands/massu-golden-path/references/phase-0-requirements.md

@@ -1,5 +1,7 @@
 # Phase 0: Requirements & Context Loading
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## 0.1 Session Context Loading

package/commands/massu-golden-path/references/phase-1-plan-creation.md

@@ -1,5 +1,7 @@
 # Phase 1: Plan Creation & Audit
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## Phase 1A: Research & Reality Check

package/commands/massu-golden-path/references/phase-2-implementation.md

@@ -1,5 +1,7 @@
 # Phase 2: Implementation
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## Competitive Mode Check

package/commands/massu-golden-path/references/phase-2.5-gap-analyzer.md

@@ -1,5 +1,7 @@
 # Phase 2.5: Gap & Enhancement Analyzer Loop
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-3-simplify.md

@@ -1,5 +1,7 @@
 # Phase 3: Simplification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-3.5-security-audit.md

@@ -0,0 +1,110 @@
+# Phase 3.5: Deep Security Audit
+
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
+> Reference doc for `/massu-golden-path`. Return to main file for overview.
+
+```
+[GOLDEN PATH -- PHASE 3.5: DEEP SECURITY AUDIT]
+```
+
+## Purpose
+
+Run a full adversarial security audit loop against ALL files changed in this golden path run. This is a deep, iterative audit with parallel red-team agents that converges to zero findings. It runs AFTER simplification (Phase 3) so the audit targets the final, cleaned-up code -- and BEFORE pre-commit verification (Phase 4) so all security fixes are included in the verification gates.
+
+**This phase is NEVER skipped.** Security is non-negotiable regardless of change size, type, or scope.
+
+---
+
+## 3.5.1 Determine Audit Scope
+
+Collect ALL files changed during this golden path run:
+
+```bash
+git diff --name-only HEAD
+```
+
+If files were already committed in earlier phases, also include:
+```bash
+git diff --name-only main...HEAD
+```
+
+The audit scope is the union of all changed files. Do NOT narrow scope -- every changed file gets audited.
+
+**Output:**
+```
+SECURITY AUDIT SCOPE:
+  Files: [N]
+  [list of files]
+```
+
+---
+
+## 3.5.2 Execute Deep Security Audit
+
+Run the full security audit protocol against the scoped files:
+
+1. **Launch 2-4 parallel adversarial reviewer agents** adapted to the codebase area:
+   - Backend/API code: 4 agents (Injection, Network/Leakage, DoS/Resources, Red Team Bypass)
+   - Frontend code: 3 agents (XSS/Injection, Auth/Data Exposure, Input Validation/Logic)
+   - Infrastructure/config: 2 agents (Secrets/Config, Dependencies/Supply Chain)
+
+2. **Consolidate findings** -- deduplicate across agents, take higher severity on disagreements
+
+3. **Fix ALL findings** -- CRITICAL first, then HIGH, MEDIUM, LOW. INFO documented only.
+
+4. **Verify fixes** -- import checks, input validation tests, functionality preserved
+
+5. **Loop until zero findings** -- max 5 iterations, escalate to user if still failing after 5
+
+---
+
+## 3.5.3 Attack Vector Coverage
+
+Every audit iteration MUST verify the complete attack vector checklist:
+
+### Universal
+- Hardcoded secrets / API keys / credentials
+- Error messages leaking internal details
+- Dependency vulnerabilities
+- Input validation on ALL external boundaries
+
+### Backend / API
+- SQL injection, command injection, path traversal
+- SSRF, authentication bypass, authorization bypass
+- DoS via unbounded inputs, memory leaks, race conditions
+- Response validation, type confusion
+
+### Frontend
+- XSS, open redirects, sensitive data in client state
+- CSRF, client-side auth bypass
+
+### LLM / AI Specific
+- Prompt injection, model output trust
+- Tool argument injection, vision/multimodal injection
+
+---
+
+## 3.5.4 Completion Gate
+
+The phase completes ONLY when the audit loop achieves a clean pass with zero findings.
+
+```
+SECURITY_AUDIT_GATE: PASS
+  Iterations: [N]
+  Total findings fixed: [N]
+  Breakdown: [X] CRITICAL, [X] HIGH, [X] MEDIUM, [X] LOW fixed
+  Clean pass: Iteration [N]
+```
+
+**Do NOT proceed to Phase 4 until SECURITY_AUDIT_GATE = PASS.**
+
+---
+
+## Rules
+
+1. **NEVER skip this phase** -- not for small changes, not for docs, not for config
+2. **NEVER proceed with findings unfixed** -- zero means zero
+3. **ALL severity levels get fixed** -- CRITICAL through LOW
+4. **No commit prompt** -- unlike standalone security audit commands, do NOT offer to commit here (Phase 4 handles commits)
+5. **Findings feed Phase 4** -- security fixes are verified by Phase 4's type check, build, lint, and secrets gates automatically

package/commands/massu-golden-path/references/phase-4-commit.md

@@ -1,5 +1,7 @@
 # Phase 4: Pre-Commit Verification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-5-push.md

@@ -1,5 +1,7 @@
 # Phase 5: Push Verification & Push
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-5.5-production-verify.md

@@ -1,5 +1,7 @@
 # Phase 5.5: Production Verification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ```

package/commands/massu-golden-path/references/phase-6-completion.md

@@ -1,5 +1,7 @@
 # Phase 6: Completion
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path`. Return to main file for overview.
 
 ## 6.1 Final Report

package/commands/massu-golden-path/references/qa-evaluator-spec.md

@@ -1,5 +1,7 @@
 # QA Evaluator Specification
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path` Phase 2C. Return to `phase-2-implementation.md` for full Phase 2.
 
 ## Purpose

package/commands/massu-golden-path/references/sprint-contract-protocol.md

@@ -1,5 +1,7 @@
 # Sprint Contract Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-golden-path` Phase 2A.5. Return to `phase-2-implementation.md` for full Phase 2.
 
 ## What Is a Sprint Contract?

package/commands/massu-golden-path/references/vr-visual-calibration.md

@@ -1,5 +1,7 @@
 # VR-VISUAL Calibration Examples
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for VR-VISUAL 4-dimension weighted scoring.
 > Used by `scripts/ui-review.sh` and golden-path Phase 2.5 gap analysis.
 

package/commands/massu-golden-path.md

@@ -150,6 +150,35 @@ Read `references/phase-3-simplify.md` for full details.
 
 ---
 
+## PHASE 3.5: DEEP SECURITY AUDIT
+
+Read `references/phase-3.5-security-audit.md` for full details.
+
+**Summary**: A full adversarial security audit loop against EVERY file changed in this run —
+parallel red-team agents, iterating until the audit converges to ZERO findings. It runs AFTER
+simplification (so it audits the final, cleaned-up code) and BEFORE pre-commit verification (so
+every security fix is caught by the Phase 4 gates).
+
+**THIS PHASE IS NEVER SKIPPED.** Security is non-negotiable regardless of the size, type, or scope
+of the change. Do not narrow the audit scope: every changed file gets audited.
+
+> **This phase SHIPPED in v0.6.1 and had vanished by v1.0.0.** It exists in no commit in this
+> repository's history — the only surviving copy on the machine was in a consumer repo that had
+> committed its installed commands back in April. So for every version from v1.0.0 to v1.15.5,
+> every user's golden path ran with **no security audit phase at all**, and nothing anywhere said
+> so.
+>
+> It was found by accident, on 2026-07-14, when a `git status` showed the file being deleted from
+> that consumer during a reinstall. **The reference-link guard could never have found it:** that
+> guard asks "does every reference file have a link?", and a file that has been deleted outright
+> has no link to be missing. A check that only sees *broken* things is blind to *absent* ones —
+> which is the same failure as a scanner that reports CLEAN because it scanned zero files.
+>
+> Restored and wired 2026-07-14. Guarded by `golden-path-quality-subsystems-wired.test.ts`, which
+> asserts the file EXISTS, is LINKED, and is INVOKED — a conjunction no deletion can satisfy.
+
+---
+
 ## PHASE 4: PRE-COMMIT VERIFICATION
 
 Read `references/phase-4-commit.md` for full details.
@@ -216,6 +245,7 @@ This skill is a folder. The following files are available for reference:
 | `references/vr-visual-calibration.md` | Score 5/3/1 calibration examples for VR-VISUAL weighted dimensions | Calibrating VR-VISUAL scoring in Phase 2.5 |
 | `references/phase-2.5-gap-analyzer.md` | Gap/enhancement analysis loop, 7 categories (incl. sprint-contract compliance), fix-and-repass until zero | After implementation, before simplification |
 | `references/phase-3-simplify.md` | Pattern scanner fast gate, dead code detection, parallel semantic review agents | Running simplification after implementation |
+| `references/phase-3.5-security-audit.md` | Adversarial red-team security audit loop over every changed file, iterating to ZERO findings | Phase 3.5 — after simplification, before pre-commit. NEVER skipped |
 | `references/phase-4-commit.md` | Auto-verification gates, quality scoring, commit format | Preparing a commit |
 | `references/phase-5-push.md` | Pre-flight, 4-tier push verification, regression detection | Preparing to push to remote |
 | `references/phase-5.5-production-verify.md` | Deployment landed, runtime logs clean, feature exercised against production with real data | Phase 5.5 — after push, before calling it done |

package/commands/massu-guide.md

@@ -3,6 +3,8 @@ name: massu-guide
 description: "When a new user or contributor asks 'how does this work', 'give me a tour', 'onboarding', or needs an interactive walkthrough of the codebase"
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*)
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-guide
 
 # Massu Guide: Codebase Onboarding Walkthrough

package/commands/massu-hooks.md

@@ -1,3 +1,5 @@
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 name: massu-hooks
 
 # Massu Hooks: Profile & Status Dashboard

package/commands/massu-learning-audit.md

@@ -4,6 +4,8 @@ description: "When user says 'learning audit', 'check auto-learning', 'memory co
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*), ToolSearch(mcp__massu-codegraph__*)
 disable-model-invocation: true
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-learning-audit
 
 # Massu Learning Audit: Auto-Learning Effectiveness Validation

package/commands/massu-loop/references/auto-learning.md

@@ -1,5 +1,7 @@
 # Auto-Learning Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## POST-BUILD REFLECTION + MANDATORY MEMORY PERSIST (CR-38)

package/commands/massu-loop/references/checkpoint-audit.md

@@ -1,5 +1,7 @@
 # Checkpoint Audit Protocol
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## CHECKPOINT AUDIT (Phase Boundaries)

package/commands/massu-loop/references/guardrails.md

@@ -1,5 +1,7 @@
 # The 10 Accountability Safeguards
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## THE 10 ACCOUNTABILITY SAFEGUARDS

package/commands/massu-loop/references/iteration-structure.md

@@ -1,5 +1,7 @@
 # Iteration Structure
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## ITERATION STRUCTURE

package/commands/massu-loop/references/loop-controller.md

@@ -1,5 +1,7 @@
 # Loop Controller
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## MANDATORY LOOP CONTROLLER (EXECUTE THIS - DO NOT SKIP)

package/commands/massu-loop/references/plan-extraction.md

@@ -1,5 +1,7 @@
 # Plan Item Extraction
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## PLAN ITEM EXTRACTION PROTOCOL (MANDATORY - STEP 0)

package/commands/massu-loop/references/vr-plan-spec.md

@@ -1,5 +1,7 @@
 # VR-PLAN Verification Details
 
+> **Verification laws apply.** Read `.claude/commands/_verification-laws.md` — CR-64 (a gate must prove it can fail), CR-65 (broken and empty may never render identically), and: an audit that does not run commands is not an audit.
+
 > Reference doc for `/massu-loop`. Return to main file for overview.
 
 ## VR-PLAN: VERIFICATION PLANNING STEP

package/commands/massu-parity.md

@@ -3,6 +3,8 @@ name: massu-parity
 description: Generic feature parity check between two systems or components
 allowed-tools: Bash(*), Read(*), Grep(*), Glob(*), Write(*), Task(*)
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-parity
 
 # Massu Parity: Feature Parity Check

package/commands/massu-push.md

@@ -3,6 +3,8 @@ name: massu-push
 description: "When user says 'push', 'push to remote', 'deploy', or wants to push committed changes to the remote repository"
 allowed-tools: Bash(*), Read(*), Edit(*), Write(*), Grep(*), Glob(*)
 ---
+
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
 name: massu-push
 
 # Massu Push: Verify, Push, Monitor CI

package/commands/massu-scaffold-hook.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new Claude Code hook — scaffolds the
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New Hook
 
 Creates a complete Claude Code hook following the 3-tier profile system.

package/commands/massu-scaffold-page.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new page, screen, or view — asks whi
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New Page / View
 
 This default template is **framework-agnostic**. It asks the user (or, when invoked by an agent, infers from `massu.config.yaml`) which target to scaffold, then dispatches to one of the embedded patterns below.

package/commands/massu-scaffold-page.swift.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new view, screen, or page in a SwiftUI
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New SwiftUI View
 
 Creates a SwiftUI View + `@MainActor` ViewModel + Decodable response model. Suitable for iOS, visionOS, or any cross-platform SwiftUI target.

package/commands/massu-scaffold-router.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new tRPC router, API endpoint, or back
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New tRPC Router
 
 Creates a complete tRPC router following all project database and auth patterns.

package/commands/massu-scaffold-router.python-django.md

@@ -4,6 +4,8 @@ description: "Django-specific scaffold for {{paths.python_source | default("djan
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New Django View
 
 Creates Django views in `{{paths.python_source | default("django_app")}}` following the project's conventions. Covers function-based views (FBV), class-based views (CBV), and the corresponding `urls.py` registration. Auth guard uses `{{detected.python.auth_dep | default("login_required")}}`.

package/commands/massu-scaffold-router.python-fastapi.md

@@ -4,6 +4,8 @@ description: "FastAPI-specific scaffold for {{paths.python_source | default("app
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New FastAPI Router
 
 Creates a complete FastAPI router following the project's existing conventions in `{{paths.python_source | default("app")}}/routers/`. Auth dependency sourced from the massu introspector's `detected.python.auth_dep` (falls back to `get_current_user` if not detected).

package/commands/massu-scaffold-router.python.md

@@ -4,6 +4,8 @@ description: "When user wants to create a new FastAPI router, API endpoint, or b
 allowed-tools: Bash(*), Read(*), Write(*), Edit(*), Grep(*), Glob(*)
 ---
 
+> **Shared rules apply.** Read `.claude/commands/_shared-preamble.md` before proceeding — including **THE VERIFICATION LAWS** (CR-64: a gate must prove it can fail; CR-65: broken and empty may never render identically; an audit that does not run commands is not an audit).
+
 # Scaffold New FastAPI Router
 
 Creates a complete FastAPI router following the project's existing conventions in `${paths.python_source}/routers/` (or wherever your project's `paths.python_source` resolves).