@sushanglewis/lincoln 1.6.3 → 1.8.0

package/framework/README.md

@@ -2,6 +2,8 @@
 
 > 中文 | [English](README.en.md)
 
+**TL;DR** — Lincoln is an AI-Native R&D workflow system that brings stage-driven discipline, human gates, and repeatable SOPs to Claude Code, Codex, and OpenCode — from requirements to shipped knowledge.
+
 Lincoln 是一个贯穿 **IDE、Agent Harness、代码托管、知识管理、技能、插件与自动化程序** 的 AI-Native 研发工作流体系。它以**阶段**为节奏、以**门控**为质量保障、以**可重复 SOP** 为骨架，把需求澄清、产品设计、原型、TDD 计划、OpenSpec 提案、任务拆分、研发实现和知识库沉淀串成一条可人机协作的流水线。
 
 - **全流程，而非单点工具**：每个阶段都有明确的角色、技能与产物约定——Agent 在恰当的节点介入，而不是替代人的判断。
@@ -10,9 +12,9 @@ Lincoln 是一个贯穿 **IDE、Agent Harness、代码托管、知识管理、
 
 ## 最新版本
 
-[![Release](https://img.shields.io/badge/release-v1.6.3-blue)](RELEASE.md)
+[![Release](https://img.shields.io/badge/release-v1.8.0-blue)](RELEASE.md)
 
-**v1.6.3** 已发布：Lincoln 切换为全局 npm 插件模型，通过 `npm install -g @sushanglewis/lincoln` 安装，项目侧使用 `.lincoln.yaml` 选择性激活。
+**v1.8.0** 已发布：新增 SecurityAnalyzer 安全门控、Trace 2.0 事件日志与会话摩擦学习/知识召回能力，clarify 阶段支持多维度相关者分析。
 
 查看完整发布说明：[RELEASE.md](RELEASE.md)
 
@@ -92,10 +94,28 @@ lincoln init-project
 
 ### 更新 Lincoln
 
+已安装过 Lincoln 的用户，一条命令即可升级——`lincoln update` 会自动拉取 npm 最新版本，并重新把框架同步到各 harness：
+
 ```bash
-lincoln update
+lincoln update            # 升级到最新版本并重新同步框架
+lincoln update --check    # 只检查是否有新版本，不安装
+```
+
+如果还是旧版安装（例如 bin 名是 `lincoln-install` 的时代），或更新时 npm 报 `EEXIST: file already exists`，说明有旧包残留的 bin 文件挡住了安装，先清理再重装：
+
+```bash
+npm uninstall -g lincoln lincoln-install              # 卸载旧包名（未安装会自动跳过）
+npm install -g @sushanglewis/lincoln@latest
+lincoln install --yes
 ```
 
+> **EEXIST / command not found 残留软链**：如果安装报 `EEXIST: file already exists`（bin 位置已被占用），而运行 `lincoln` 却是 `command not found`，说明 bin 位置是旧包遗留的悬空软链。用 `ls -la "$(npm prefix -g)/bin/lincoln"` 确认它指向已卸载的旧包路径，删除后重试安装：
+>
+> ```bash
+> rm "$(npm prefix -g)/bin/lincoln"
+> npm install -g @sushanglewis/lincoln@latest && lincoln install --yes
+> ```
+
 ### 从旧版 vendored 模式迁移
 
 如果你的项目之前是把 Lincoln 框架源码直接提交到仓库里的，可以用：
@@ -113,7 +133,11 @@ lincoln migrate-project --yes       # 确认迁移
 
 ### 阶段驱动的工作流引擎
 
-每个阶段定义在 `.claude/stages/<stage-id>.yaml`，内含角色、可调用的技能、门控条件与产物要求。`workflow-stage.yaml` 作为运行时状态，由 Lincoln 的阶段加载器驱动阶段校验、产物记录与 gate 推进。
+每个阶段定义在 `.claude/stages/<stage-id>.yaml`，内含角色、可调用的技能、门控条件与产物要求。`workflow-stage.yaml` 作为运行时状态，由 Lincoln 的阶段加载器驱动阶段校验、产物记录与 gate 推进。`--render-stage` 批量渲染可一次生成某阶段声明的所有缺失文档页面。
+
+### 产物追溯
+
+Lincoln 为需求、页面、字段、文档等产物分配 `feature/*`、`page/*`、`field/*`、`doc/*` 稳定 ID。下游阶段按 ID 追溯上游产物，避免路径猜测带来的漂移。需要追溯时，直接对 Agent 说「查一下 doc/需求-001」即可。
 
 ### 预设 SOP 工作流模板
 
@@ -128,14 +152,14 @@ lincoln migrate-project --yes       # 确认迁移
 
 完整模板说明见 [`.claude/workflows/README.md`](.claude/workflows/README.md)。
 
-### Issue 工作包（HTML 门户）
+### Markdown-first Issue 工作包
 
 每个需求对应一个 GitHub issue 和一个 Lincoln feature 分支。工作包目录 `issue-<N>/` 包含：
 
 - `index.html` — 人读门户，聚合阶段状态、导航与产物
 - `workflow-stage.yaml` — 机器状态与 handoff 协议
 - `documents.yaml` — 产物索引与 human 确认状态
-- `pages/docs/` — 需求、PRD、设计、TDD 计划等 HTML 页面
+- `pages/docs/` — 需求、PRD、设计、TDD 计划等页面，叙事类文档采用 Markdown-first，可直接用 Markdown 章节和 `mermaid` 流程图编写，渲染时自动加载本地 `mermaid.min.js` 运行时
 - `pages/prototype/` — 可交互原型 HTML 页面
 - `handoffs/` — 阶段交接文档
 
@@ -154,6 +178,7 @@ Lincoln 是 AI-Native 工作流——**你不需要在终端输入任何命令**
 | 列出所有活跃分支 | 列出所有 issue 分支的阶段状态与等待对象 |
 | 运行 benchmark | 生成 Lincoln 会话基准评测报告 |
 | 启动 PM 研究工作流 | 进入 `pm-research` 研究链路 |
+| 查一下 doc/需求-001 | 调用 `lc-one-id` 按稳定 ID 追溯产物 |
 
 更多命令与用法见 [USAGE.md](USAGE.md)。
 
@@ -201,6 +226,18 @@ Lincoln 的 `.claude/` 是开放的系统提示层，欢迎基于同一套元模
 - [OpenSpec 文档](https://github.com/Fission-AI/openspec)
 - [Obsidian WikiLinks](https://help.obsidian.md/Linking+notes+and+files/Internal+links)
 
+## 版本记录
+
+| 版本 | 日期 | 关键能力 |
+|---|---|---|
+| v1.7.0 | 2026-09-05 | SecurityAnalyzer 安全门控；Trace 2.0 事件日志；摩擦学习/知识召回/Trace 浓缩/MR 挖掘；并行专家子代理委托；相关者分析模型 |
+| v1.6.3 | 2026-08-15 | Markdown-first issue-package 文档；`--render-stage` 批量渲染；Mermaid 图表本地渲染 |
+| v1.6.2 | 2026-08-12 | `lc-init-branch` 改读全局 Lincoln 模板 |
+| v1.6.1 | 2026-08-11 | `lc-one-id` 产物追溯 skill；portal 注解对齐 |
+| v1.6.0 | 2026-08-06 | 全局 npm 插件模型；`@sushanglewis/lincoln` CLI；release-on-merge 自动化 |
+
+完整发布说明见 [RELEASE.md](RELEASE.md)。
+
 ## License
 
 Lincoln 本体以 [MIT License](LICENSE) 发布，Copyright (c) 2026 苏尚lewis (sushanglewis)。

package/framework/RELEASE.md

@@ -1,3 +1,45 @@
+# Lincoln v1.8.0 Release Notes
+
+**Release date:** 2026-09-21
+
+## Highlights
+
+- **PM 阶段门户产物人类可读性改造 (#123 / LEW-72)** — issue-package `index.html` 在 PM 阶段的输出全面聚焦业务说明：主阅读路径只保留需求背景、用户角色、旅程、业务状态、业务流程、页面路由/元素/交互与可交互原型。
+- **门户归档层级** — `nav-group: 归档` 的页面在 `package-data.js` 中标记 `archived: true`，portal 左侧导航将归档组折叠置于末尾（点击展开）；`调研笔记` 从头条产物清单移除。
+- **决策归档页 decisions.html** — product-design-docs 阶段新增必备产物 `pages/docs/decisions.html`，以「日期/场景/选项/决定/理由/影响/状态」表格归档澄清与设计阶段的重要沟通记录与决策；`design_docs_complete` 校验器强制其存在及 design-review 的链接，`design-review` 不再承载决策摘要章节。
+- **技术调研归入归档** — `feasibility.html` 仍为必备产物，但必须以 `--nav-group "归档"` 渲染；三个 PM 阶段 prompt 新增硬规则：技术调研/方案对比只允许进入 feasibility（归档）或 handoff 契约，禁止进入 PRD、requirements、design-review、scenarios、feature-catalog 等主路径页面。
+- **每页意图与边界纪律** — clarify-requirements、draft-product-design、build-product-prototype 三个 prompt 统一要求：每个文档页以 `## 页面意图` 与 `## 边界` 开篇，遵循标准 Markdown 结构（单一 H1、H2 分章、优先表格与 Mermaid），跨页内容禁止复制、以链接引用单一事实来源。
+- **原型按角色×场景拆分** — build-product-prototype 要求先从 scenarios/page-map 产出「角色×场景矩阵」并写入 ui-spec.html 作为拆分契约；每个可达矩阵单元对应一个原型子页面，由 main shell 组织导航；每个原型页通过 annotations 标注适用角色、场景、页面状态（默认/空/加载/错误/成功）及该状态下可见可用的功能。
+
+## Migration Notes
+
+- 无破坏性变更：既有 issue-package 的页面与门户继续工作；新规则在下次渲染或重新生成 PM 阶段产物时生效。
+- 已有 package 如希望获得归档折叠导航，重新运行 `python scripts/lincoln_index.py --state-file <process_slug>/workflow-stage.yaml` 刷新 `package-data.js` 即可。
+
+---
+
+# Lincoln v1.7.0 Release Notes
+
+**Release date:** 2026-09-05
+
+## Highlights
+
+- **SecurityAnalyzer pre-tool-use 安全门控 (#115)** — 新增 `scripts/security_analyzer.py` 与 `.claude/policies/security.yaml`：对 Bash 副作用命令（`rm -rf`、强推、危险重定向等）做风险分类与策略匹配，命中时要求人类确认后才允许执行；包含路径规范化与命令分段解析的防绕过修复。
+- **Harness 分发能力翻转 (#115)** — hooks/skills 从默认关闭翻转为默认启用（opt-out）；新增 `.claude/harnesses/hooks.yaml` 与 `.claude/harnesses/mcp.yaml` 声明式配置，`lincoln_harness_adapter.py` 为 codex/opencode 生成对应产物，保持三 harness 无漂移。
+- **Trace 2.0 事件日志 (#115)** — Trace schema 升级到 2.0.0：阶段生命周期、gate 审批、产物记录、工作流完成等事件自动落盘到实例级 `.trace/`，支持 `node_id` 关联与后续审计分析。
+- **P1 学习能力四件套 (#115)** — 会话结束时 `lincoln_friction.py` 对会话摩擦打分（`friction.yaml` 策略）；会话开始时 `lincoln_recall.py` 按当前阶段召回相关知识；`lincoln_condenser.py` 对超长 trace 做浓缩摘要；`lincoln_mr_mine.py` 提供 GitHub PR/MR 模式挖掘 CLI。
+- **并行专家子代理委托 (#115)** — stage 定义新增 `agent.parallel_specialists`、`merge_strategy`（priority/vote/consensus）与 `output_schema`，`stage_loader` 在阶段准入时校验委托配置；新增 `lc-security-reviewer` 安全审查角色与设计评审反馈 JSON schema。
+- **framework-self-improvement 工作流 (#115)** — 注册 `phase-1-p0-design/implement`、`phase-2-p1-design/implement` 四个阶段，形成「调研 → 设计 → 实现 → 学习」的框架自我改进闭环，并接入 `lc-wf-framework-self-improvement` 命令。
+- **多维度相关者分析模型 (#114)** — `clarify` 阶段新增 `stakeholders.html` 必需产物，`clarify-requirements` prompt 增加相关者识别/影响力-态度分析步骤，PM 角色职责同步更新。
+
+## Migration Notes
+
+- 全局插件用户升级：直接运行 `lincoln update`（一键拉取 npm 最新版并重新同步框架到各 harness）；或手动 `npm update -g @sushanglewis/lincoln` 后重跑 `lincoln install --yes`。若旧版 bin 名残留导致安装报 `EEXIST`，先 `npm uninstall -g lincoln lincoln-install` 并删除悬空软链（详见 README「更新 Lincoln」一节）。
+- 安全门控默认生效且为人类确认制（confirm_required），不是自动阻断；策略可在项目 `.claude/policies/security.yaml` 中按需调整。
+- 无破坏性变更：现有 issue 工作包、`.lincoln.yaml` 激活方式与阶段协议均保持兼容。
+
+---
+
 # Lincoln v1.6.3 Release Notes
 
 **Release date:** 2026-08-14

package/framework/SKILL.md

@@ -1,24 +1,33 @@
 ---
 name: Lincoln
-description: Lincoln AI-Native R&D workflow system — terminal installer and agent harness templates
+description: Lincoln AI-Native R&D workflow system — global npm plugin and agent harness templates
 ---
 
 # Lincoln
 
-After this skill is installed, launch the guided terminal installer to set up Lincoln in your project:
+After this skill is installed, set up Lincoln globally on your machine:
 
 ```bash
-npx lincoln-install
+npm install -g @sushanglewis/lincoln
+lincoln install --yes
 ```
 
-The installer will walk you through selecting an agent harness (Claude Code, Cursor, Codex, OpenCode, etc.), optional dependencies, and project configuration. For CI or scripting, use `--no-tui --format json` or `--yes --dry-run`.
+`npm install -g` installs the CLI and bundled framework payload. `lincoln install --yes` syncs hooks, agents, skills, scripts, and the full runtime framework to `~/.claude/`, `~/.codex/`, and `~/.opencode/`.
 
-To update an existing Lincoln project to the latest release while preserving your user data, run:
+You can also target specific harnesses:
 
 ```bash
-npx lincoln-update
+lincoln install --yes --harnesses claude-code,opencode
+```
+
+To update an existing Lincoln installation while preserving your user data, run:
+
+```bash
+lincoln update
 ```
 
 Use `--dry-run` to preview changes or `--no-tui --format json` for scripted updates.
 
 For the agent-mediated setup flow, ask your Agent to run `/lc-setup` instead.
+
+> **Deprecated**: the old `npx lincoln-install` / `npx lincoln-update` wrappers are still present but no longer recommended. If your project previously used the vendored framework model, run `lincoln migrate-project --yes` to switch to the global plugin model.

package/framework/manifest.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.6.3",
-  "generatedAt": "2026-08-15T07:56:15.597Z",
+  "version": "1.8.0",
+  "generatedAt": "2026-09-21T07:48:29.386Z",
   "files": [
     {
       "path": ".claude-plugin/hooks.json",
@@ -8,11 +8,11 @@
     },
     {
       "path": ".claude-plugin/marketplace.json",
-      "sha256": "ca2c4d46391a9f74e7b516169ee0c4dc2053e39b166604b4765bf5301dc8d9fb"
+      "sha256": "cf0092d2868b4ce74a40684502c25d9f273ed8c9aa660deddc10fdac115fbd68"
     },
     {
       "path": ".claude-plugin/plugin.json",
-      "sha256": "63d7a6191340cd49f78cddb78585849b88870e5969b8d5c4d830d81adaa4ba30"
+      "sha256": "0b61bbcc7e9bae4b76838f5609868280c96be663080421a151d6a803c86aabf4"
     },
     {
       "path": ".claude/agents/architect.md",
@@ -56,7 +56,7 @@
     },
     {
       "path": ".claude/agents/pm.md",
-      "sha256": "82502490bae859380f1ed99da890f18a061a4560f31cf22fdf128fb1942536f2"
+      "sha256": "75e9481a9bb0b87fd051416f1680f748ddd62e61209c29697acb589fbbb11fa1"
     },
     {
       "path": ".claude/agents/qa.md",
@@ -70,37 +70,45 @@
       "path": ".claude/agents/researcher.md",
       "sha256": "11a9f3b232c84a4d5d13b42a2ade3beaafe04b708a53836b54226b49e79a9eaa"
     },
+    {
+      "path": ".claude/agents/security-reviewer.md",
+      "sha256": "7bd26aa4ef4ce4a49d81b339799ac9028a29bcdb661d220ac0967b38b307c7d3"
+    },
     {
       "path": ".claude/harnesses/claude-code.yaml",
       "sha256": "4822f694dfe0a8e0edbb3dc552e5799f62e75ec104bc54bd7aea457445ef9516"
     },
     {
       "path": ".claude/harnesses/codex.yaml",
-      "sha256": "cf4834565c709ada29466ea3830d01ef892d2f6c1094fe8590b75e7c9c1c0abf"
+      "sha256": "e62313a312ad0684235b9d392d8160784f266419a40848cbf608f8250d2ea7d3"
     },
     {
       "path": ".claude/harnesses/command-map.yaml",
-      "sha256": "c3cc07e5d4932c78ae074850d01e7c359a2a81694b3cef081c41aa268328b355"
+      "sha256": "f9f0ec19138399f98fb0064c0abf7490e7c0d1f1b933cef76468281c18cc4837"
     },
     {
       "path": ".claude/harnesses/opencode.yaml",
-      "sha256": "cea58942904b217cdbcb60f03d2083378d2fdaff3ec93f6562901c92cc7aea42"
+      "sha256": "c6c87806ca5a650fbb4163823e13c7a19342275814c2d675070fb7bbc1271edf"
     },
     {
       "path": ".claude/harnesses/scenarios.yaml",
       "sha256": "5964474167e47385bab0d821c62b147e3d574ab4acd99b0d45ae1bfb2dd82abf"
     },
+    {
+      "path": ".claude/hooks/hooks.yaml",
+      "sha256": "9905d44731e901651ea13c5a5ada9be6f9d72ddce07701d11773f13662bc68bb"
+    },
     {
       "path": ".claude/hooks/on-pr-event.sh",
       "sha256": "6fa72efc0e1d15e03b446ce57afbfacdc93e69ca480ba723f14aeb449a14c6d6"
     },
     {
       "path": ".claude/hooks/on-session-start.sh",
-      "sha256": "b499b2db7340b12251d5bf33b919acd611f256a48824c8b3c197f20db680f291"
+      "sha256": "f92b3314fb391a25a69cf077e244e1e35c7b4cd6e2abd1f0f3671de85f8ac69d"
     },
     {
       "path": ".claude/hooks/on-stop.sh",
-      "sha256": "559456624263d75bf38e8aebe78afc7b6e75452131231a0a4a2a59e92485db64"
+      "sha256": "0e22d235ec64474136106610fef631fbe316117bd5e3ee642a8cce7c1afa1224"
     },
     {
       "path": ".claude/hooks/post-tool-use.sh",
@@ -108,7 +116,19 @@
     },
     {
       "path": ".claude/hooks/pre-tool-use.sh",
-      "sha256": "3814aaad9f3cf1af9d0bf76ffb640c19b796b03394de49f3b8c0d9d2c4226f6c"
+      "sha256": "51b29d7213486e9c7c24caebed34c82bbaee60c8a47a99537bf595a98519aa64"
+    },
+    {
+      "path": ".claude/mcp/mcp.yaml",
+      "sha256": "cabc65ab04e63bbff50d1afaa78f659f9208f40e4b8406ad4e648e87593d7f66"
+    },
+    {
+      "path": ".claude/policies/friction.yaml",
+      "sha256": "146af77dbfcdbe4c56aef082f770c8169d91b7574f78189326d965457403d6e8"
+    },
+    {
+      "path": ".claude/policies/security.yaml",
+      "sha256": "bd71fd2dd313e033d9248a0697f2b70cc5c6787b39cddb331c39c17f7fdc31cf"
     },
     {
       "path": ".claude/schemas/agent-definition.schema.json",
@@ -118,13 +138,17 @@
       "path": ".claude/schemas/benchmark-report.schema.json",
       "sha256": "20f841c9df884d75ad98342091cecc21c6f595f1f888c1ecf6e81f6c928ff8a0"
     },
+    {
+      "path": ".claude/schemas/design-review-feedback.json",
+      "sha256": "9cc405a54567e75ad7044ba92e26a83dda7b8e50248a6d519f6341115f55fe85"
+    },
     {
       "path": ".claude/schemas/pm-to-ux-handoff.schema.yaml",
       "sha256": "e721e86b5112ed5674267ba6a1fa2734c5bd5512a625dc7c7e7a5b9a545ec02e"
     },
     {
       "path": ".claude/schemas/stage-definition.schema.json",
-      "sha256": "f7a0ca9d84a16a28b7e6131e1d88b993cdad20bfe0701c91685fa01568151351"
+      "sha256": "5746190d5de63f7481bc161d4c6a301a43b776886b99ffb0c099609bb5422a05"
     },
     {
       "path": ".claude/schemas/workflow-stage.schema.json",
@@ -144,15 +168,15 @@
     },
     {
       "path": ".claude/skills/build-product-prototype/prompts/main.md",
-      "sha256": "de20a3aa5ea85747069668834d39e9a255ca8c5d7d3752264d7393e9c9185d5a"
+      "sha256": "390589f01598b749d8c85e5ecab425ea70b428cb3fe91484b91136168e0b4a82"
     },
     {
       "path": ".claude/skills/clarify-requirements/SKILL.md",
-      "sha256": "b1d79314ffa4a11b2072fac2da8483232f9d243eb23be00b2d8072b75f3d2916"
+      "sha256": "19810b312a6d4c4f6823936be1c66490b951fd4490a70aa4ac0962985f949bf1"
     },
     {
       "path": ".claude/skills/clarify-requirements/prompts/main.md",
-      "sha256": "8674c8ed0e3b345485e84b36d936109bcd4c95e0f8fe818845f6828bb4f0abfb"
+      "sha256": "5431aa1a268058d397d1a0acbf79d50b8c87e42ab3ae7f329e0e810e2e519f7b"
     },
     {
       "path": ".claude/skills/dependencies.yaml",
@@ -160,11 +184,11 @@
     },
     {
       "path": ".claude/skills/draft-product-design/SKILL.md",
-      "sha256": "4fc3bd6cd45f06a3182415064b110ef4a641704a63c5640409acba401d0b2a00"
+      "sha256": "8fc7e2de16c0e82657ce253ccd0cb1b8f21dd6cb648436f5c689f4118e7b678f"
     },
     {
       "path": ".claude/skills/draft-product-design/prompts/main.md",
-      "sha256": "0ac5aac8da4a965135d36936baabb14fef852f65cc9d66da7b71de105fb1cf61"
+      "sha256": "22d3a9635ab3937206eb1bb686728e5d5135b9b1de27ca76d6976180ab97b8ab"
     },
     {
       "path": ".claude/skills/lc-analyze-frameworks/SKILL.md",
@@ -320,7 +344,7 @@
     },
     {
       "path": ".claude/skills/lc-workflow/validators/validate.py",
-      "sha256": "785120fca36af77f71ac3819a9ad7a457aa6febdf6e79d487e6d80163bca5aa6"
+      "sha256": "2ef99c40e29de06761005ac58f9e47a32955a104a18987d4b8059507f179bdbf"
     },
     {
       "path": ".claude/skills/plan-tdd-development/SKILL.md",
@@ -376,7 +400,7 @@
     },
     {
       "path": ".claude/stages/clarify.yaml",
-      "sha256": "05e02ab354631cd982de039cd971b38d3ebe5f79a3ab119120495aa50a4bd9d1"
+      "sha256": "14d3ddb85431fb1800fff8794a6c6aeec378cc8e88bf458f7b593409b8380b1c"
     },
     {
       "path": ".claude/stages/explore-opensource.yaml",
@@ -430,9 +454,25 @@
       "path": ".claude/stages/lc-storytelling.yaml",
       "sha256": "3e7dd171db1074b322fb002e0882dd86f448450adb02f3ae6b084d531f9f9cc7"
     },
+    {
+      "path": ".claude/stages/phase-1-p0-design.yaml",
+      "sha256": "bbb434e64906b50a72560ecfa2b5a59b1432a02d7a024ebdf08095de89a55b32"
+    },
+    {
+      "path": ".claude/stages/phase-1-p0-implement.yaml",
+      "sha256": "07dd7b0c5a222b2ec45dfefc77d82703af8b135d89d68e6e13ad22356a4e7e63"
+    },
+    {
+      "path": ".claude/stages/phase-2-p1-design.yaml",
+      "sha256": "f96912b27df806f9c211665fce4615b5c3b57076b3c21a95d9cac90326f0e6de"
+    },
+    {
+      "path": ".claude/stages/phase-2-p1-implement.yaml",
+      "sha256": "a92d46dbeea087997f25b7dbe758072d09d3dd3892f1173acafb3231f774379b"
+    },
     {
       "path": ".claude/stages/product-design-docs.yaml",
-      "sha256": "10d59c8d14e1f930c550ee7caa57eb636cfd162c040d406f980f173c17738e31"
+      "sha256": "04829200479439864b95cd5ce34d86035a557e699d8a441ae09b55c1e89e7ddb"
     },
     {
       "path": ".claude/stages/product-prototype.yaml",
@@ -468,23 +508,27 @@
     },
     {
       "path": ".claude/workflows/bug-fix.yaml",
-      "sha256": "4988af45c32098a5d129bff29e27b3bd6c567f133916d58f05d09f6a50d1d431"
+      "sha256": "10ec84aefe852f9b36d5694cf1139107877df1cec7bf906c7b1f5e5174b0d2e4"
     },
     {
       "path": ".claude/workflows/design-spike.yaml",
-      "sha256": "55b90ad567755e2eb84c976a21a90eeb7a0905b7be838910ebb5a55bee975ed1"
+      "sha256": "bf19482918ee0356db06b606afccbd4fbe0289db1eeedc5ab81cf81a6b23ad04"
     },
     {
       "path": ".claude/workflows/existing-project-iteration.yaml",
-      "sha256": "027a27a493e1458549aaa66e2d8a139a86fe87d378f51b260f76a0ff7d159fea"
+      "sha256": "10d52c8e005a2ba98297fa6b961a54b2755d3e470b2feff765de7fa32e509830"
+    },
+    {
+      "path": ".claude/workflows/framework-self-improvement.yaml",
+      "sha256": "665fae12ff61e3283cc18bb08a565ffa90f11daeb3810f7fed2ebf024ef36063"
     },
     {
       "path": ".claude/workflows/interview-to-knowledge.yaml",
-      "sha256": "a511a3db4a27003e27296ed6ef672ae04da7054b039c13b56605079473159427"
+      "sha256": "ba7178a7459025e9fa003cc9b0f3318ec0dc7f0b0bda89114d69723028398d47"
     },
     {
       "path": ".claude/workflows/oss-first-design.yaml",
-      "sha256": "8dfb9010196dcf569539e1ec4f89d3ae7e437f1a8eb45791d2f47802dce715e2"
+      "sha256": "0ec0dcc91a5545acd1e50afe54f6935d7008ec70dfd33648a689fd3ac006d4c1"
     },
     {
       "path": ".claude/workflows/pm-research.yaml",
@@ -492,7 +536,7 @@
     },
     {
       "path": ".version-bump.json",
-      "sha256": "4aa5a297bac44b5e8f0028cc96f3534ddbdef3b4272fd3cf7a96bd67a96a82b1"
+      "sha256": "9851c2a06072eb165a7da81972950acacc7b68f0c1212df0cc309b2d2f6b277b"
     },
     {
       "path": "CLAUDE.md",
@@ -508,19 +552,19 @@
     },
     {
       "path": "README.en.md",
-      "sha256": "72ece68f3810a6dbc1f4f74cc62c9f13382d84ae38d812eb8c72f01004e620c9"
+      "sha256": "3b5dde4566bfd1cedb12719be9fe64cc3d01d60804338ca92062f4654c51b0d8"
     },
     {
       "path": "README.md",
-      "sha256": "6f6e6559fe4d57d8c9e0aeadf6f72033eccc3a6ff4cd0b1259e78c69274b05b3"
+      "sha256": "f2304e9da45c59fc62c4d396cd662a6996f98fc1b18d5ec65b499232d6247a9a"
     },
     {
       "path": "RELEASE.md",
-      "sha256": "f7148da3e458f91d315b2055aac358abfbd2755133de7441fcfcc3b336416fc2"
+      "sha256": "16b98c6cebeeb01386f3f0b177f07e82b60196dd6abbcad447600a86a18a1324"
     },
     {
       "path": "SKILL.md",
-      "sha256": "3a134d4993407e3ac4dad0703c10585523bb1d096db588fbc9aaecda0a5c7ba8"
+      "sha256": "d005dc4a955fa334d5993403460cf00bf561a24be5c450fd0611f3301a8fdfc6"
     },
     {
       "path": "USAGE.md",
@@ -548,7 +592,7 @@
     },
     {
       "path": "scripts/check-harness-drift.sh",
-      "sha256": "f27599d7923b027984b3ad4aa85db53dac7898d6281cad06e940f141de05f2fb"
+      "sha256": "81f85c506e72a7a7b56e31c01cb15c0cdbffec1c0ccd3222b9bdad1d9385ba36"
     },
     {
       "path": "scripts/check-main-merge-hygiene.py",
@@ -584,7 +628,7 @@
     },
     {
       "path": "scripts/lincoln-setup.py",
-      "sha256": "67b783f85bb9ef64ad49482a626067b872b2dffbd8303555e962e4e44df075e6"
+      "sha256": "eb9705f2b2c6936e71d916b59d6bcd06fda638e94cb3f2a5718b7edbb2554ba4"
     },
     {
       "path": "scripts/lincoln-status.py",
@@ -610,6 +654,10 @@
       "path": "scripts/lincoln_command_map.py",
       "sha256": "c15cdeb303cd1aaa00527296bf7bab5e7b1b786ca4d292ee3b018e475a5a16a4"
     },
+    {
+      "path": "scripts/lincoln_condenser.py",
+      "sha256": "024a269863e6368de3879b31298421af22f5768d8be0e70f4c597b43382e1e28"
+    },
     {
       "path": "scripts/lincoln_dependency_manager.py",
       "sha256": "0b3ec944a2eb6c5f6e9c9dc975d4a6c297696f66b3291b3c73598611e50fc83e"
@@ -618,9 +666,13 @@
       "path": "scripts/lincoln_documents.py",
       "sha256": "0b0db078625daeff96423bca98b981464f5ecf68bf2ecce2370b1e8133daf968"
     },
+    {
+      "path": "scripts/lincoln_friction.py",
+      "sha256": "9ee0ec5218358f61dcd0bf9e0b7eb9525070d99c2fc5a979764927d6aea381d5"
+    },
     {
       "path": "scripts/lincoln_harness_adapter.py",
-      "sha256": "77d3339fb2519f7d058e75b657f3464fe0cb64854e925f337508a1b3348faeef"
+      "sha256": "a3a1453264f3fa4cc2aa97441ea29e1f411dcb10034715e534d40caaef0e7db7"
     },
     {
       "path": "scripts/lincoln_id.py",
@@ -628,7 +680,11 @@
     },
     {
       "path": "scripts/lincoln_index.py",
-      "sha256": "5119c6f5211f5facfb9f66f61b07728a2b30c3b7596f2db3e5de8a97fb5ec84d"
+      "sha256": "8b237e80673dd96e6aa6fba6cf65f6c9bb4e09777ef17ed7bf1eaa2dce0c10ff"
+    },
+    {
+      "path": "scripts/lincoln_mr_mine.py",
+      "sha256": "240d36d736e2391f88be571a9fad44c43c19038c66f946959b7d2a8a185c6b5a"
     },
     {
       "path": "scripts/lincoln_paths.py",
@@ -638,6 +694,10 @@
       "path": "scripts/lincoln_prd.py",
       "sha256": "6b9f1fe120ac1d4b07c4f3aeea18ac49c1f46a56da6b6541ca82ce8a15f80b47"
     },
+    {
+      "path": "scripts/lincoln_recall.py",
+      "sha256": "af8c81522d5352923ae88bc710cddb15a63742d9a654fdc958d9c14e60fe4532"
+    },
     {
       "path": "scripts/lincoln_render.py",
       "sha256": "0750b3cdcd77a0679e4dda626eebc0ab2bea90072d844e7979ac1c1365fa0800"
@@ -660,7 +720,7 @@
     },
     {
       "path": "scripts/lincoln_trace.py",
-      "sha256": "6c544548a6b0cce97d597503d4b4f11da33a3fcf16afc899f7e4c4e7192fe82c"
+      "sha256": "2bd5a87c4c5895b00e578fa15c8e408e285c0cd2024c7c718bd637952dd54b42"
     },
     {
       "path": "scripts/lincoln_workflow.py",
@@ -678,9 +738,13 @@
       "path": "scripts/run-infrastructure-tests.py",
       "sha256": "d2140224c7b07ae06d329f3e857733297a590878f67e4fe7f6b9d2d3db6e9375"
     },
+    {
+      "path": "scripts/security_analyzer.py",
+      "sha256": "b09e1ee3c543063cdbf1876ffca43c91d9c45a3a485550c919d87f2596ea47fa"
+    },
     {
       "path": "scripts/stage_loader.py",
-      "sha256": "9694ddc32f53d0eae5eabc55ed15ec5ddb5a2a5b813bcf2ea6c67f772d3e5f3f"
+      "sha256": "d089f2238b3a2c23d950f4c255e60070ef6c3c0eca6ed46de7f94fd19fa130c5"
     },
     {
       "path": "scripts/static-check.sh",
@@ -720,7 +784,7 @@
     },
     {
       "path": "tools/lincoln-installer/package.json",
-      "sha256": "3ec226b6929bdcc71e8da673d1570b2484ca6d720a4bb424f9aa4d646243da85"
+      "sha256": "ab465eaf6fcebc0874be431e59e106f201b0475f58502f5f94cd2ee4ba524f0d"
     },
     {
       "path": "tools/lincoln-installer/src/cli.tsx",
@@ -1002,21 +1066,13 @@
       "path": "tools/lincoln/README.md",
       "sha256": "08e007598a46902ad4205f580b9af7a47973bab5d2bc543d0d39fe84d94baf04"
     },
-    {
-      "path": "tools/lincoln/dist/main.js",
-      "sha256": "27be36130341edba0c37782ab41d31331b5d9894454d2c7f45efe23d37e01fb5"
-    },
-    {
-      "path": "tools/lincoln/dist/main.js.map",
-      "sha256": "db7ba1724affeb15db717442d92e1e0ee5525a2423f57d7b69840ce6aaad78cd"
-    },
     {
       "path": "tools/lincoln/package-lock.json",
-      "sha256": "3ecae1e1e256eaf5ac2d0607124c1fcdc8a32dd64759eaa667c6359df9cce1b4"
+      "sha256": "49268bd2522c8d60d7918acafd254e438de808e81705ad089069af0ae9100cc8"
     },
     {
       "path": "tools/lincoln/package.json",
-      "sha256": "42942e1ac7259b3062228a8acc60c3dff835be6ad15a828b92d9b8c6760f46ef"
+      "sha256": "da3bdc8409e65cbab814ba5ea0eb2f85532fc498c1ad5f2f5922bb0a32230b46"
     },
     {
       "path": "tools/lincoln/src/cli.tsx",

package/framework/scripts/check-harness-drift.sh

@@ -20,7 +20,7 @@ TMP="$(mktemp -d)"
 trap 'rm -rf "$TMP"' EXIT
 mkdir -p "$TMP/project" "$TMP/home"
 
-for HARNESS in codex opencode; do
+for HARNESS in claude-code codex opencode; do
     echo "==> Harness smoke generation: $HARNESS"
     if ! "$PYTHON" scripts/lincoln_harness_adapter.py \
         --harness "$HARNESS" --root "$ROOT" \
@@ -31,7 +31,17 @@ for HARNESS in codex opencode; do
     fi
 
     # Drift comparison only when artifacts were generated into the project.
+    # Claude Code uses .claude/ directly; its --check validates source files.
     case "$HARNESS" in
+        claude-code)
+            echo "==> Source consistency check: $HARNESS"
+            if ! "$PYTHON" scripts/lincoln_harness_adapter.py \
+                --harness "$HARNESS" --root "$ROOT" \
+                --project-dir "$ROOT" --home-dir "$HOME" --check; then
+                FAIL=1
+            fi
+            continue
+            ;;
         opencode) MARKER="$ROOT/.opencode" ;;
         codex)
             if [ -e "$ROOT/.codex-plugin" ]; then

package/framework/scripts/lincoln-setup.py

@@ -583,6 +583,20 @@ def _add_common_args(p: argparse.ArgumentParser) -> None:
     )
 
 
+
+def _load_dotenv(root: Path) -> None:
+    """Load environment variables from project root .env if python-dotenv is available."""
+    env_file = root / ".env"
+    if not env_file.exists():
+        return
+    try:
+        from dotenv import load_dotenv
+
+        load_dotenv(dotenv_path=env_file, override=False, verbose=False)
+    except ImportError:
+        # python-dotenv is optional; callers can export vars manually.
+        pass
+
 def main(args: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(
         prog="lc-setup",
@@ -632,6 +646,9 @@ def main(args: list[str] | None = None) -> int:
 
     parsed = parser.parse_args(args)
 
+    # Make .env variables available to install commands and harness adapters.
+    _load_dotenv(Path(parsed.root).resolve())
+
     handlers = {
         "check": run_check,
         "install-skills": run_install_skills,