@thebassclef/lite 0.1.0 → 0.1.2

package/substrate/.claude/skills/onboard-repo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 tier: lite
 name: onboard-repo
-description: "Bootstrap bassclef framework in a new repo. Installs sync hook + scaffolds config + whereami + CLAUDE.md. Modes: default / --with-deploy-host / --with-secrets / --full / --greenfield-from-intent (cold-adopter magic demo from a paragraph — uses /launch --local)."
+description: "Bootstrap the bassclef framework in a new repo. Installs the sync hook. Scaffolds config, whereami, and CLAUDE.md. Modes: default, --with-deploy-host, --with-secrets, --full, --greenfield-from-intent (cold-adopter magic demo)."
 problem: "Setting up bassclef in a new repo takes an hour of trial. Missing directories and wrong hook wiring."
 value: "One command bootstraps everything \u2014 sync hook and config file and whereami scaffold."
 inputs: [Optional flags — --with-deploy-host or --with-secrets or --full]
@@ -279,7 +279,7 @@ this divider.
 Run each phase in order. Operator confirms before destructive or
 cross-repo actions. Each phase is independently re-runnable.
 
-#### Phase 0 — Refuse to run from main (bassclef#956 V0.5)
+#### Phase 0 — Refuse to run from main
 
 Substrate changes go through PRs, same as feature work. If `/onboard-repo`
 runs from `main`, every scaffold (`.claude/`, `CLAUDE.md`,
@@ -496,734 +496,168 @@ JSON
 Operator confirms — may want to add app-specific hooks (pre-build-gate,
 pre-commit-gate) if the repo has source code.
 
-##### 2.2.1 Wire turn-prose-kiss-check Stop hook (bassclef#1138 T5)
+##### 2.2.1 Wire all Phase 2.2 hooks (13 hooks in one pass)
 
-Symlink the bassclef Stop hook that scans the most recent assistant
-message for bassclef-internal jargon (the `/kiss words` BLOCK list
-from `standards/bassclef-internal-jargon.md`). When
-`prose_discipline.kiss_words_turn_prose` is `true` in
-`.claude/bassclef-configs.jsonc` (the adopter-default Phase 2.3.5
-writes), the hook fires after every assistant turn and surfaces
-findings; when `false`, the hook short-circuits silently.
+Phase 2.2 wires 13 bassclef hooks that gate adopter writes, commits, sessions, and role transitions. Read the whole table first. Then apply the canonical jq recipe. Then run the 3 verify blocks.
 
-Symlink the hook (bassclef lives one directory up per the
-`additionalDirectories` convention):
+**Lite adopter note** (bassclef#740 Task 1.2). 6 hooks ship at `tier: standard` and skip on lite. Resolve tier via `lib/tier-check.sh`. The table marks each standard-tier hook with `std`. The bassclef-lite tarball does not carry those 6.
 
-```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/turn-prose-kiss-check.sh" \
-       ".claude/hooks/turn-prose-kiss-check.sh"
-```
-
-Add the Stop hook block to `.claude/settings.json`. If the file already
-has a Stop block (for example, `session-end.sh`), append this hook
-alongside — both run, turn-prose-kiss-check first, session-end second:
-
-```jsonc
-{
-  "hooks": {
-    "Stop": [
-      {
-        "matcher": "",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/turn-prose-kiss-check.sh", "timeout": 10 }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Composition rule** — when an existing Stop hook is present, leave it
-in place and append this one. The turn-prose-kiss-check hook exits 0
-even when findings surface (default toggle: advisory), so a downstream
-session-end hook still runs. When the adopter opts in to strict mode
-(`prose_discipline.kiss_words_turn_prose: "strict"` in
-bassclef-configs.jsonc), the hook exits 2 and blocks the stop — that's
-the conscious-strict trade-off.
-
-**Conditional fire** — the hook reads
-`.claude/bassclef-configs.jsonc` `prose_discipline.kiss_words_turn_prose`
-at runtime and short-circuits when `false`. Adopters who never want the
-check can flip the toggle without unwiring the hook.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: hook is executable + reachable
-ls -l .claude/hooks/turn-prose-kiss-check.sh
-
-# Sanity: settings.json parses
-python3 -c "import json; json.load(open('.claude/settings.json'))"
-```
-
-**Composes with downstream Phase 2.x steps:**
-
-- Phase 2.3.5 writes `prose_discipline.kiss_words_turn_prose: true` to
-  `.claude/bassclef-configs.jsonc` as the adopter default — this hook
-  fires when that toggle is true.
-- Phase 2.5 (security scanning) is a separate hook wiring path; both
-  hooks can co-exist in the Stop block.
-
-Source: bassclef#1051 (hook origin), bassclef#1138 (this wiring step).
-
-##### 2.2.2 Wire substrate-clarity-gate PreToolUse hook (bassclef#1137 T4)
-
-Symlink the bassclef PreToolUse hook that BLOCKs writes to
-`.claude/skills/`, `.claude/rules/`, and `.claude/luminaries/` when
-they violate the clarity discipline bassclef applies to its own
-substrate — skill descriptions over 280 chars, rule + luminary
-"NEVER" without paired "INSTEAD:" block, jargon usage where plain
-language exists. Adopter writes to substrate paths trigger the same
-gate bassclef does.
-
-Symlink the hook + the bassclef baseline allowlist (the file that
-grandfathers pre-existing violators during a grace window):
+**Symlink all hooks in one pass:**
 
 ```bash
 mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/substrate-clarity-gate.sh" \
-       ".claude/hooks/substrate-clarity-gate.sh"
-ln -sf "../../../bassclef/.claude/hooks/substrate-clarity-allowlist.txt" \
-       ".claude/hooks/substrate-clarity-allowlist.txt"
-```
-
-Add the PreToolUse Edit|Write block to `.claude/settings.json`. If an
-`Edit|Write` matcher already exists from a prior phase, append this
-hook to its `hooks` array instead of duplicating the matcher entry:
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/substrate-clarity-gate.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Adopter allowlist convention** — the symlinked
-`substrate-clarity-allowlist.txt` carries bassclef's baseline
-grandfather list (pre-existing violators with a documented grace
-window). When the adopter has their own pre-existing substrate
-violations they want to grandfather during their own migration,
-they create a sibling file:
+cd .claude/hooks
+for h in turn-prose-kiss-check substrate-clarity-gate artifact-ingestion-gate \
+         pattern-annotation-validate pre-commit-gate state-validate \
+         destructive-command-guard multi-tenancy-check atomic-pr-check \
+         post-write-trace testing-tier-enforce role-entry-gate temperance-gate; do
+  ln -sf "../../../bassclef/.claude/hooks/${h}.sh" "${h}.sh"
+done
+# Two allowlist files paired with hooks that read them:
+ln -sf "../../../bassclef/.claude/hooks/substrate-clarity-allowlist.txt" substrate-clarity-allowlist.txt
+ln -sf "../../../bassclef/.claude/hooks/testing-tier-enforce-allowlist.txt" testing-tier-enforce-allowlist.txt
+cd -
+```
+
+**Hook table:**
+
+| # | Hook | Event | Matcher | Tier | Notes |
+|---|---|---|---|---|---|
+| 1 | turn-prose-kiss-check | Stop | (empty) | lite | Reads `prose_discipline.kiss_words_turn_prose` toggle from bassclef-configs; short-circuits when false; timeout 10s |
+| 2 | substrate-clarity-gate | PreToolUse | Edit\|Write | lite | Reads bassclef baseline allowlist + optional adopter-side `substrate-clarity-allowlist-adopter.txt` |
+| 3 | artifact-ingestion-gate | PreToolUse | Write | lite | Reads `artifact_ingestion.paths` from bassclef-configs; 13 default paths seeded by Phase 2.3.5 |
+| 4 | pattern-annotation-validate | PreToolUse | Edit\|Write\|MultiEdit | std | Reads `tech_stack.lang` for language scoping (Phase 2.3.6) |
+| 5 | pre-commit-gate | PreToolUse | Edit\|Write\|MultiEdit | lite | Runs first; composes testing-tier-enforce internally as one of its check steps |
+| 6 | state-validate | PreToolUse | Edit\|Write\|MultiEdit | lite | Runs after pre-commit-gate; heavier ajv-cli schema check |
+| 7 | destructive-command-guard | PreToolUse | Bash | std | Catches destructive verbs + force flags + amplifiers (rm -rf, FLUSHALL, prisma migrate reset) |
+| 8 | multi-tenancy-check | PreToolUse | Edit\|Write\|MultiEdit | std | Template — customize via `TENANT_MODELS` / `TENANT_CONTEXT_FN` / `TENANT_PARAMS_FN` env vars |
+| 9 | atomic-pr-check | PreToolUse | Bash | std | Fires on `git push` patterns; BLOCKs multi-step branches lacking `bundle: true` in goal frontmatter |
+| 10 | post-write-trace | PostToolUse | Write\|Edit | std | Append-only trace; no override (never blocks) |
+| 11 | testing-tier-enforce | (composed) | (via pre-commit-gate) | lite | Fires inside pre-commit-gate; no separate matcher entry; 60-day allowlist grace |
+| 12 | role-entry-gate | PreToolUse | Edit\|Write\|MultiEdit | std | MVP: source-code file extensions only; reads `state/markers/role/<role>/<session>.marker` |
+| 13 | temperance-gate | PreToolUse | Edit\|Write\|MultiEdit | lite | Fires on high-impact edits (.claude/, standards/, lib/state.sh, SKILL.md) when temperance marker missing |
+
+**Order matters within each matcher block.** Place `pre-commit-gate` before `state-validate` (cheap SDLC checks fire first; heavier schema check runs second). Place `role-entry-gate` and `temperance-gate` LAST — methodology gates fire after structural + format + state checks pass.
+
+**Canonical jq recipe — write settings.json in one pass.** The recipe uses JSON literal syntax so the `"matcher": "..."` and `"command": "..."` keys land verbatim in `.claude/settings.json` for grep-verifiability:
 
 ```bash
-touch .claude/hooks/substrate-clarity-allowlist-adopter.txt
-```
-
-The hook reads BOTH files in series — bassclef's baseline first,
-then the adopter-side append. Entries in the adopter file follow
-the same one-path-per-line format as bassclef's baseline. The
-adopter file is git-tracked in the adopter repo (not symlinked
-into bassclef), so each adopter manages their own grandfather
-list independently.
-
-**Composition rule** — when an existing PreToolUse Edit|Write
-matcher block is present (for example, `artifact-ingestion-gate.sh`
-from Phase 2.x), append this hook's command entry to the same
-matcher's `hooks` array. The matcher entry must not be duplicated;
-the array of hooks under one matcher can hold multiple commands
-that fire in series.
-
-**Override path** — adopter can bypass per-call with
-`SKIP_SUBSTRATE_CLARITY=1 <command>` (logged via trace-helper per
-bassclef override idiom). The override is for migration scripts
-and emergency rescue; routine use should fix the violation, not
-bypass.
-
-**Verify the wiring:**
+# Assumes .claude/settings.json exists from Phase 2.2 (bare SessionStart entry).
+# Reads adopter tier and skips standard-tier hooks on lite.
+TIER=$(bash ../bassclef/lib/tier-check.sh 2>/dev/null || echo lite)
+
+# Lite tier — 7 hooks land in .claude/settings.json (rows 1,2,3,5,6,11,13).
+# Standard/ultra tier — all 13 hooks land in .claude/settings.json.
+jq --arg tier "$TIER" '
+  .hooks.Stop = ((.hooks.Stop // []) + [
+    { "matcher": "", "hooks": [
+      { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/turn-prose-kiss-check.sh", "timeout": 10 }
+    ]}
+  ]) |
+  .hooks.PreToolUse = ((.hooks.PreToolUse // []) + [
+    { "matcher": "Edit|Write|MultiEdit", "hooks": (
+      [
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/substrate-clarity-gate.sh" },
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-commit-gate.sh" },
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/state-validate.sh" },
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/temperance-gate.sh" }
+      ] +
+      (if $tier != "lite" then [
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pattern-annotation-validate.sh" },
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/multi-tenancy-check.sh" },
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/role-entry-gate.sh" }
+      ] else [] end)
+    )},
+    { "matcher": "Write", "hooks": [
+      { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/artifact-ingestion-gate.sh" }
+    ]}
+  ] + (if $tier != "lite" then [
+    { "matcher": "Bash", "hooks": [
+      { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/destructive-command-guard.sh" },
+      { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/atomic-pr-check.sh" }
+    ]}
+  ] else [] end)) |
+  (if $tier != "lite" then
+    .hooks.PostToolUse = ((.hooks.PostToolUse // []) + [
+      { "matcher": "Write|Edit", "hooks": [
+        { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/post-write-trace.sh" }
+      ]}
+    ])
+  else . end)
+' .claude/settings.json > .claude/settings.json.tmp \
+  && mv .claude/settings.json.tmp .claude/settings.json
+```
+
+**Alternate matcher notes.** The `"matcher": "Edit|Write"` shape (without MultiEdit) appears in older adopter settings.json — the widening to `"matcher": "Edit|Write|MultiEdit"` in this recipe covers MultiEdit for hooks that need it.
+
+**On re-run against existing settings.json** — jq's `+=` appends. Duplicate matcher entries are safe (Claude Code processes all in order), but the cleaner shape merges hooks under one matcher. To dedupe a re-run, strip existing entries with `jq 'del(...)'` before appending.
+
+**Verify block 1 — Stop event:**
 
 ```bash
-# Sanity: hook executable + reachable
-ls -l .claude/hooks/substrate-clarity-gate.sh
-ls -l .claude/hooks/substrate-clarity-allowlist.txt
-
-# Sanity: settings.json parses + has the matcher
 python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  print('substrate-clarity-gate wired' if any( \
-    'substrate-clarity-gate' in h.get('command','') \
-    for entry in d.get('hooks',{}).get('PreToolUse',[]) \
-    for h in entry.get('hooks',[])) else 'NOT wired')"
+  hooks=[h.get('command','') for entry in d.get('hooks',{}).get('Stop',[]) for h in entry.get('hooks',[])]; \
+  print('turn-prose-kiss-check wired' if any('turn-prose-kiss-check' in c for c in hooks) else 'NOT wired')"
 ```
 
-Source: bassclef#382 (hook origin), bassclef#1137 (this wiring step), bassclef#1135 (T2 config default — separate concern).
-
-##### 2.2.3 Wire artifact-ingestion-gate PreToolUse hook (bassclef#1140 T7)
-
-Symlink the bassclef PreToolUse hook that BLOCKs writes to adopter
-substantive artifacts (specs, decompositions, prototypes, ADRs,
-proposals, iteration goals) when the artifact body lacks a
-`## Sources read` section. The discipline catches the
-"pattern-matched on generic X" failure mode that
-`.claude/rules/artifact-ingestion.md` was built to close — applied at
-adopter writes, not just at bassclef's own writes.
-
-Symlink the hook:
+**Verify block 2 — PreToolUse event (all matchers):**
 
 ```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/artifact-ingestion-gate.sh" \
-       ".claude/hooks/artifact-ingestion-gate.sh"
-```
-
-Add the PreToolUse Write block to `.claude/settings.json`. The hook
-matches on `Write` (not `Edit`) — edits to existing artifacts pass
-through; only new artifact writes trigger the gate. If a Write
-matcher already exists from a prior phase, append this hook to its
-`hooks` array:
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Write",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/artifact-ingestion-gate.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Adopter-default path matchers** — the hook reads
-`.claude/bassclef-configs.jsonc` `artifact_ingestion.paths` to
-decide which paths fire the gate. Phase 2.3.5 (bassclef-configs
-adopter-default seed) appends this block with the bassclef default
-list. Adopters edit the list per repo — adding paths their substrate
-considers substantive, or removing paths that do not apply:
-
-```jsonc
-"artifact_ingestion": {
-  "paths": [
-    "docs/specs/**/*.md",
-    "docs/decompositions/**/*.md",
-    "docs/prototypes/**/*.html",
-    "docs/proposals/**/*.md",
-    "docs/adrs/**/*.md",
-    "docs/use-cases/**/*.md",
-    "docs/user-stories/**/*.md",
-    "docs/ia-models/**/*.md",
-    "docs/interaction-design/**/*",
-    "docs/personas/**/*.md",
-    "docs/jtbd-tasks/**/*.md",
-    "docs/value-props/**/*.md",
-    "docs/iteration-bets/**/*.md"
-  ]
-}
-```
-
-When the `artifact_ingestion.paths` field is absent (older adopters
-predating this Phase), the hook falls back to its built-in default
-matcher list — the wiring stays safe and quiet.
-
-**Composition rule** — when an existing PreToolUse Write matcher is
-present (for example, from a sibling hook in another Phase 2.x step),
-append this hook's command entry to the same matcher's `hooks` array.
-The matcher entry must not be duplicated.
-
-**Override path** — adopter can bypass per-call with
-`SKIP_ARTIFACT_INGESTION=1 <command>` (logged via trace-helper). Use
-for migration scripts and emergency rescue.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: hook executable + reachable
-ls -l .claude/hooks/artifact-ingestion-gate.sh
-
-# Sanity: settings.json has the matcher
 python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  print('artifact-ingestion-gate wired' if any( \
-    'artifact-ingestion-gate' in h.get('command','') \
-    for entry in d.get('hooks',{}).get('PreToolUse',[]) \
-    for h in entry.get('hooks',[])) else 'NOT wired')"
+  cmds=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) for h in entry.get('hooks',[])]; \
+  hooks=['substrate-clarity-gate','artifact-ingestion-gate','pre-commit-gate','state-validate','temperance-gate','pattern-annotation-validate','destructive-command-guard','multi-tenancy-check','atomic-pr-check','role-entry-gate']; \
+  [print(f'{h}: {\"wired\" if any(h in c for c in cmds) else \"NOT wired\"}') for h in hooks]"
 ```
 
-Source: bassclef#116 (hook origin), bassclef#1140 (this wiring step).
-
-##### 2.2.4 Wire pattern-annotation-validate PreToolUse hook (bassclef#1139 T6)
-
-**Lite adopter note (bassclef#740 Task 1.2).** This hook ships at `tier: standard`. If your adopter tier is lite (resolved via `lib/tier-check.sh`), skip this Phase step and continue with 2.2.5. The bassclef-lite tarball does not carry this hook.
-
-Symlink the bassclef PreToolUse hook that validates `@pattern <catalog-path>` annotations in adopter source code. Layer 3 of bassclef#478 traceability — code that instantiates a named pattern from bassclef's catalog (`patterns/<shelf>/<source>/<slug>.md`) must mark itself with the annotation so forward (which code uses this pattern) and reverse (which patterns is this code using) lookups work across the adopter portfolio.
-
-Symlink the hook:
+**Verify block 3 — PostToolUse event:**
 
 ```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/pattern-annotation-validate.sh" \
-       ".claude/hooks/pattern-annotation-validate.sh"
-```
-
-Add the PreToolUse Edit|Write|MultiEdit block to `.claude/settings.json`. If an `Edit|Write` matcher already exists from a prior phase, append this hook to its `hooks` array (the bassclef settings.json convention is to widen matchers when adding new hooks that share a tool set):
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write|MultiEdit",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pattern-annotation-validate.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Rule propagation** — the `pattern-annotation` rule lives at bassclef's `.claude/rules/pattern-annotation.md` and loads into adopter agent context via the `additionalDirectories: ["../bassclef"]` entry Phase 2.2 wrote. No copy needed; bassclef's rule body is the source of truth.
-
-**Tech-stack-aware scoping** — the hook reads adopter's `.claude/bassclef-configs.jsonc` `tech_stack.lang` (Phase 2.3.6 writes) and fires only on source files matching the declared language: `.ts/.tsx` for `typescript`, `.py` for `python`, `.rb` for `ruby`, `.go` for `go`, `.rs` for `rust`. Non-source files silent. When `tech_stack.lang` is absent (older adopters or skip path), the hook fires on the union of language matchers (safe default).
-
-**Composition rule** — when an existing PreToolUse Edit|Write matcher block is present (substrate-clarity-gate from 2.2.2 uses `Edit|Write`), the matcher set widens to `Edit|Write|MultiEdit` to cover both hooks. Adopters can keep the matchers separate if they prefer narrower scoping per hook.
-
-**Override path** — `SKIP_PATTERN_ANNOTATION=1 <command>` (logged via trace-helper). Use for migration scripts when annotating retroactively is in flight.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: hook executable + reachable
-ls -l .claude/hooks/pattern-annotation-validate.sh
-
-# Sanity: rule loads via additionalDirectories
-test -f ../bassclef/.claude/rules/pattern-annotation.md && echo "rule reachable" || echo "rule NOT reachable"
-
-# Sanity: settings.json has the matcher
 python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  print('pattern-annotation-validate wired' if any( \
-    'pattern-annotation-validate' in h.get('command','') \
-    for entry in d.get('hooks',{}).get('PreToolUse',[]) \
-    for h in entry.get('hooks',[])) else 'NOT wired')"
+  cmds=[h.get('command','') for entry in d.get('hooks',{}).get('PostToolUse',[]) for h in entry.get('hooks',[])]; \
+  print('post-write-trace wired' if any('post-write-trace' in c for c in cmds) else 'NOT wired')"
 ```
 
-Source: bassclef#478 (parent traceability goal), bassclef#1139 (this wiring step), bassclef#1127 (tech_stack vocabulary the scoping reads).
-
-##### 2.2.5 Wire pre-commit-gate + state-validate PreToolUse hooks (bassclef#1136 T3)
-
-Symlink the two bassclef PreToolUse hooks that gate adopter writes.
-
-`pre-commit-gate.sh` runs the SDLC pre-build checks per `.claude/rules/sdlc-gates.md`. Those checks are temperance + diagnosis + scope drift.
-
-`state-validate.sh` validates state-spine entity writes against JSON Schema per `.claude/rules/state-schema-validation.md`.
-
-Together the hooks catch two failure classes before any source edit lands: skipped gates (silent SDLC bypass) and malformed state writes (silent schema drift).
-
-Symlink both hooks:
+**Rule propagation** — 8 rules load into the adopter session on their own via the `additionalDirectories: ["../bassclef"]` entry Phase 2.2 wrote. No per-rule symlink needed. Rules: `sdlc-gates.md`, `state-schema-validation.md`, `testing-tier-config.md`, `test-list-discipline.md`, `test-sufficiency.md`, `destructive-operations.md`, `pattern-annotation.md`, `pr-strategy.md`. Verify with:
 
 ```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/pre-commit-gate.sh" \
-       ".claude/hooks/pre-commit-gate.sh"
-ln -sf "../../../bassclef/.claude/hooks/state-validate.sh" \
-       ".claude/hooks/state-validate.sh"
-```
-
-Add the PreToolUse Edit|Write|MultiEdit block to `.claude/settings.json`. If an `Edit|Write` or `Edit|Write|MultiEdit` matcher already exists from a prior phase (substrate-clarity-gate from 2.2.2, pattern-annotation-validate from 2.2.4), append both hooks to its `hooks` array — the matcher set widens to `Edit|Write|MultiEdit` when MultiEdit is not already covered:
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write|MultiEdit",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-commit-gate.sh" },
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/state-validate.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Order matters** — `pre-commit-gate.sh` runs first (cheap SDLC checks), `state-validate.sh` runs second (heavier ajv-cli schema validation). The matcher block lists them in that order; a BLOCK from the first stops the chain before the second fires.
-
-**Rule propagation** — both rules (`sdlc-gates.md` + `state-schema-validation.md`) live at bassclef's `.claude/rules/` and load into adopter agent context via the `additionalDirectories: ["../bassclef"]` entry Phase 2.2 wrote. No copy needed; bassclef's rule body is the source of truth.
-
-**Composition rule** — when an existing PreToolUse Edit|Write matcher block is present from earlier Phase 2.x steps, append these two hooks to its `hooks` array (do not duplicate the matcher entry). Hook order within the array determines execution order; place `pre-commit-gate.sh` before `state-validate.sh` per the order rule above.
-
-**Override paths** — `SKIP_PRE_COMMIT_GATE=1 <command>` and `SKIP_STATE_VALIDATE=1 <command>` (both logged via trace-helper). Use only for one-shot migration scripts (state bootstrapping) or emergency rescue when the hook itself is broken.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: both hooks executable + reachable
-ls -l .claude/hooks/pre-commit-gate.sh .claude/hooks/state-validate.sh
-
-# Sanity: both rules reachable via additionalDirectories
-test -f ../bassclef/.claude/rules/sdlc-gates.md && echo "sdlc-gates reachable" || echo "sdlc-gates NOT reachable"
-test -f ../bassclef/.claude/rules/state-schema-validation.md && echo "state-schema-validation reachable" || echo "state-schema-validation NOT reachable"
-
-# Sanity: settings.json has both hooks wired in matcher block
-python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) for h in entry.get('hooks',[])]; \
-  print('pre-commit-gate wired' if any('pre-commit-gate' in c for c in hooks) else 'NOT wired'); \
-  print('state-validate wired' if any('state-validate' in c for c in hooks) else 'NOT wired')"
-```
-
-Source: bassclef#1136 (this wiring step — T3, iteration-2 BLOCKER). Sister rules: `.claude/rules/sdlc-gates.md` + `.claude/rules/state-schema-validation.md`.
-
-##### 2.2.6 Wire destructive-command-guard + multi-tenancy-check PreToolUse hooks (bassclef#1141 T8 — partial)
-
-**Lite adopter note (bassclef#740 Task 1.2).** Both hooks ship at `tier: standard`. Skip this step if your tier is lite. Resolve tier via `lib/tier-check.sh`. Continue with 2.2.7.
-
-Symlink two bassclef PreToolUse hooks that catch runtime-safety problems before they reach the operator's filesystem or database. `destructive-command-guard.sh` fires on Bash and detects destructive verbs + force flags + amplifiers (catches "prisma migrate reset", "rm -rf", "FLUSHALL" patterns). `multi-tenancy-check.sh` fires on Edit/Write of source files and warns when tenant-scoped patterns are missing (queries without tenant context).
-
-Bet 2026-06-18b scopes T8 to these two hooks; the ticket's other two (`operator-private-path-check.sh` + `type-check.sh`) are deferred to a follow-on per goal narrowing.
-
-Symlink both hooks:
-
-```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/destructive-command-guard.sh" \
-       ".claude/hooks/destructive-command-guard.sh"
-ln -sf "../../../bassclef/.claude/hooks/multi-tenancy-check.sh" \
-       ".claude/hooks/multi-tenancy-check.sh"
-```
-
-Add both PreToolUse blocks to `.claude/settings.json`. The matchers differ — `destructive-command-guard` watches Bash; `multi-tenancy-check` watches Edit|Write|MultiEdit. The Edit|Write|MultiEdit block likely already exists from Phase 2.2.2 / 2.2.3 / 2.2.4 / 2.2.5 — append `multi-tenancy-check` to its `hooks` array (do not duplicate the matcher entry). The Bash block is new for most adopters; create it if absent.
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/destructive-command-guard.sh" }
-        ]
-      },
-      {
-        "matcher": "Edit|Write|MultiEdit",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/multi-tenancy-check.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Customization** — `multi-tenancy-check.sh` is a template. Adopters with multi-tenant codebases override `TENANT_MODELS` + `TENANT_CONTEXT_FN` + `TENANT_PARAMS_FN` via env vars OR drop a custom `multi-tenancy-check.sh` in `.claude/hooks/` (which wins over the symlink). Single-tenant adopters can disable per-call with `SKIP_MULTI_TENANCY_CHECK=1`.
-
-**Rule propagation** — `.claude/rules/destructive-operations.md` loads into adopter agent context via the `additionalDirectories: ["../bassclef"]` entry Phase 2.2 wrote. No copy needed.
-
-**Composition rule** — Bash and Edit|Write|MultiEdit matchers stay separate; never collapse them. When other Phase 2.x steps add Bash hooks (Phase 2.2.7 ships atomic-pr-check on Bash; type-check on Bash if T8 follow-on ships), append to the Bash matcher's `hooks` array — do not duplicate the matcher entry.
-
-**Override paths** — `SKIP_DESTRUCTIVE_GUARD=1 <command>` (logged) and `SKIP_MULTI_TENANCY_CHECK=1 <command>` (logged). Both bypass logged via trace-helper. Use only for genuine cases (one-shot migrations, single-tenant repos where the check is noise).
-
-**Verify the wiring:**
-
-```bash
-# Sanity: both hooks executable + reachable
-ls -l .claude/hooks/destructive-command-guard.sh .claude/hooks/multi-tenancy-check.sh
-
-# Sanity: destructive-operations rule reachable via additionalDirectories
-test -f ../bassclef/.claude/rules/destructive-operations.md && echo "destructive-operations reachable" || echo "NOT reachable"
-
-# Sanity: settings.json has both hooks wired with correct matchers
-python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  bash_hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) if entry.get('matcher')=='Bash' for h in entry.get('hooks',[])]; \
-  edit_hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) if 'Edit' in entry.get('matcher','') for h in entry.get('hooks',[])]; \
-  print('destructive-command-guard wired (Bash)' if any('destructive-command-guard' in c for c in bash_hooks) else 'NOT wired (Bash)'); \
-  print('multi-tenancy-check wired (Edit|Write|MultiEdit)' if any('multi-tenancy-check' in c for c in edit_hooks) else 'NOT wired (Edit|Write|MultiEdit)')"
-```
-
-Source: bassclef#1141 (this wiring step — T8, runtime-safety chain). Sister rule: `.claude/rules/destructive-operations.md`. Follow-on: `operator-private-path-check.sh` + `type-check.sh` wires deferred from T8 goal scope.
-
-##### 2.2.7 Wire atomic-pr-check + post-write-trace workflow hooks (bassclef#1142 T9)
-
-**Lite adopter note (bassclef#740 Task 1.2).** Both hooks ship at `tier: standard`. Skip this step if your tier is lite. Resolve tier via `lib/tier-check.sh`. Continue with the next step.
-
-Symlink two bassclef workflow hooks. `atomic-pr-check.sh` fires on Bash calls matching `git push` patterns and BLOCKs multi-step branches that lack `bundle: true` in the iteration goal's frontmatter — closes the silent atomic-PR-discipline gap that `.claude/rules/pr-strategy.md` describes. `post-write-trace.sh` fires on PostToolUse Write/Edit and records traceability rows so the agent can audit what wrote what.
-
-Symlink both hooks:
-
-```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/atomic-pr-check.sh" \
-       ".claude/hooks/atomic-pr-check.sh"
-ln -sf "../../../bassclef/.claude/hooks/post-write-trace.sh" \
-       ".claude/hooks/post-write-trace.sh"
-```
-
-Add a PreToolUse Bash block + a PostToolUse Write|Edit block to `.claude/settings.json`. The Bash matcher likely already exists from Phase 2.2.6 (destructive-command-guard) — append `atomic-pr-check` to its `hooks` array. The PostToolUse block is new for most adopters.
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Bash",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/atomic-pr-check.sh" }
-        ]
-      }
-    ],
-    "PostToolUse": [
-      {
-        "matcher": "Write|Edit",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/post-write-trace.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Bet narrowing** — ticket #1142 (T9) also lists `post-skill-friction-check.sh`. The goal scopes this step to two hooks; the third deferred to a follow-on per goal shape.
-
-**Composition rule** — when the Bash matcher already exists (Phase 2.2.6 wires destructive-command-guard on the same matcher), append `atomic-pr-check` to its `hooks` array; do not duplicate the matcher entry. Hook order within the Bash array does not matter for these two — destructive-command-guard and atomic-pr-check check different signals (destructive verbs vs git-push patterns) and never conflict on the same command.
-
-**Rule propagation** — `.claude/rules/pr-strategy.md` (the methodology atomic-pr-check enforces) loads via `additionalDirectories`. No copy needed.
-
-**Override paths** — `SKIP_ATOMIC_PR_CHECK=1 <command>` (logged via trace-helper) bypasses the atomic-PR gate for genuine bundle cases that the goal's `bundle: true` flag did not capture. `post-write-trace.sh` has no override — the trace is append-only and never blocks.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: both hooks executable + reachable
-ls -l .claude/hooks/atomic-pr-check.sh .claude/hooks/post-write-trace.sh
-
-# Sanity: pr-strategy rule reachable via additionalDirectories
-test -f ../bassclef/.claude/rules/pr-strategy.md && echo "pr-strategy reachable" || echo "NOT reachable"
-
-# Sanity: settings.json has both hooks wired with correct matchers
-python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  bash_hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) if entry.get('matcher')=='Bash' for h in entry.get('hooks',[])]; \
-  post_hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PostToolUse',[]) if 'Write' in entry.get('matcher','') or 'Edit' in entry.get('matcher','') for h in entry.get('hooks',[])]; \
-  print('atomic-pr-check wired (PreToolUse Bash)' if any('atomic-pr-check' in c for c in bash_hooks) else 'NOT wired'); \
-  print('post-write-trace wired (PostToolUse Write|Edit)' if any('post-write-trace' in c for c in post_hooks) else 'NOT wired')"
-```
-
-Source: bassclef#1142 (this wiring step — T9, workflow chain). Sister rule: `.claude/rules/pr-strategy.md`. Follow-on: `post-skill-friction-check.sh` wire deferred from T9 goal scope.
-
-##### 2.2.8 Wire testing-tier-enforce + allowlist (bassclef#1143 T10)
-
-Symlink the bassclef testing-tier enforcer into adopter's `.claude/hooks/`. The hook covers Tier 0 through Tier 3. It does not register as its own PreToolUse entry. Instead it runs inside `pre-commit-gate.sh` from Phase 2.2.5. When an adopter edits a Tier 0 source file without touching its matching test file, `pre-commit-gate.sh` calls `testing-tier-enforce.sh`. The commit BLOCKs with a structured stderr message.
-
-Symlink both the hook and the allowlist baseline:
-
-```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/testing-tier-enforce.sh" \
-       ".claude/hooks/testing-tier-enforce.sh"
-ln -sf "../../../bassclef/.claude/hooks/testing-tier-enforce-allowlist.txt" \
-       ".claude/hooks/testing-tier-enforce-allowlist.txt"
+for r in sdlc-gates state-schema-validation testing-tier-config test-list-discipline \
+         test-sufficiency destructive-operations pattern-annotation pr-strategy; do
+  test -f ../bassclef/.claude/rules/${r}.md && echo "${r} reachable" || echo "${r} NOT reachable"
+done
 ```
 
-The allowlist baseline grandfathers existing untested adopter source files for 60 days (the default grace window). Adopter operators can backfill tests as files are next touched, OR adjust the grace window per `testing-tier-config.md` § Allowlist.
-
-**Composition chain** — `pre-commit-gate.sh` (Phase 2.2.5) calls `testing-tier-enforce.sh` as one of its check steps. No new PreToolUse settings.json entry is needed; the hook fires whenever pre-commit-gate fires (PreToolUse Edit|Write|MultiEdit). This is the chained-composition pattern: Phase 2.2.5 wired the parent gate; Phase 2.2.8 plugs the tier-enforce check into the existing chain.
-
-**Goal-vs-implementation note** — the goal 2026-06-18b WU-4 acceptance describes `testing-tier-enforce.sh` as "PreToolUse Edit|Write" wiring. The actual wiring is via pre-commit-gate composition (no separate matcher entry). Documented per the actual implementation.
-
-**Rule propagation** — `.claude/rules/testing-tier-config.md` + `.claude/rules/test-list-discipline.md` + `.claude/rules/test-sufficiency.md` load via `additionalDirectories`. No copy needed.
+**Composed hook: testing-tier-enforce** — Row 11 fires inside `.claude/hooks/pre-commit-gate.sh` as one of its check steps (no separate matcher entry in `.claude/settings.json`). The symlink at `.claude/hooks/testing-tier-enforce.sh` + the allowlist at `.claude/hooks/testing-tier-enforce-allowlist.txt` are enough; the enforcer runs whenever pre-commit-gate fires (PreToolUse Edit|Write|MultiEdit). Grace window: 60 days on the allowlist baseline. When an adopter edits a Tier 0 source file without touching its matching test file, pre-commit-gate calls `.claude/hooks/testing-tier-enforce.sh` and the commit BLOCKs with a structured stderr message.
 
-**Override path** — `SKIP_TESTING_TIER_ENFORCE=1 <command>` (logged via trace-helper). Use only for one-shot migration scripts that bootstrap test files into the spine.
-
-**Verify the wiring:**
+Sanity check that the hook is reachable and composed into pre-commit-gate:
 
 ```bash
-# Sanity: hook + allowlist reachable
 ls -l .claude/hooks/testing-tier-enforce.sh .claude/hooks/testing-tier-enforce-allowlist.txt
-
-# Sanity: pre-commit-gate composes testing-tier-enforce
 grep -q "testing-tier-enforce.sh" .claude/hooks/pre-commit-gate.sh \
   && echo "tier-enforce composed in pre-commit-gate" \
-  || echo "NOT composed (pre-commit-gate may be stale; resync bassclef)"
-
-# Sanity: testing-tier-config rule reachable
-test -f ../bassclef/.claude/rules/testing-tier-config.md && echo "tier-config rule reachable" || echo "NOT reachable"
-```
-
-The `testing.path_matchers` seed (per-tech-stack defaults) lands in Phase 2.3.7 below — that is the step the goal flagged for operator-eyes design choices.
-
-Source: bassclef#1143 (this wiring step — T10, iteration-2 BLOCKER). Sister rules: `.claude/rules/testing-tier-config.md` + `.claude/rules/test-list-discipline.md` + `.claude/rules/test-sufficiency.md`. Pairs with Phase 2.2.5 (pre-commit-gate parent chain).
-
-##### 2.2.9 Verify test-discipline rules propagate to the adopter session (bassclef#1144 T11)
-
-The two test-discipline rules propagate to the adopter session on their own. Those rules are `.claude/rules/test-list-discipline.md` (Beck's test list as planning artifact) and `.claude/rules/test-sufficiency.md` (10-criterion rubric per Myers + Hoare).
-
-The `additionalDirectories: ["../bassclef"]` entry that Phase 2.2 wrote does the work. It tells Claude Code to load every file under bassclef's `.claude/rules/` into the adopter's session context at session-start.
-
-No copy needed. No per-rule symlink needed.
-
-This step is the explicit verification — without it, the install is silent and the adopter does not know the rules are live.
-
-Verify the rules are reachable + loaded:
-
-```bash
-# Sanity: both rule files reachable via additionalDirectories
-test -f ../bassclef/.claude/rules/test-list-discipline.md \
-  && echo "test-list-discipline reachable" \
-  || echo "test-list-discipline NOT reachable"
-test -f ../bassclef/.claude/rules/test-sufficiency.md \
-  && echo "test-sufficiency reachable" \
-  || echo "test-sufficiency NOT reachable"
-
-# Sanity: settings.json carries the additionalDirectories entry
-python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  dirs=d.get('permissions',{}).get('additionalDirectories',[]); \
-  print('bassclef loaded via additionalDirectories' if '../bassclef' in dirs else 'NOT loaded — check Phase 2.2 wiring')"
+  || echo "NOT composed (pre-commit-gate may be stale; re-run bassclef-sync)"
 ```
 
-**What this gives the adopter** — every adopter session that touches a test file gets the Beck test-list discipline (open with `# test-list:` block; mark `[x]` as each assertion ships; pending `[ ]` lines are honest in-flight signal) AND the 10-criterion sufficiency rubric (branch coverage / exit-code matrix / matcher coverage / override paths / stdin contract / external-binary handling / trap cleanup / stderr format / state-file interactions). Together they catch tests that pass but miss the intended assertion — the failure class eugene-supplements hit when 26 tests landed after source with zero asserted intent visible.
+**Override paths** — each hook honors a `SKIP_*` env var (logged via trace-helper per bassclef override idiom). Use only for one-shot migrations or emergency rescue:
 
-**Composition** — the rules pair with Phase 2.2.5 (`pre-commit-gate.sh` parent chain) + Phase 2.2.8 (`testing-tier-enforce.sh` Tier 0/1/2/3 mechanical enforcer). Methodology layer (rules) supplies the why; mechanical layer (hooks) fires at the moment of failure.
-
-**No override needed** — rules are read-only context; they neither block writes nor produce stderr. Adopters can choose to ignore the rules per session, but the agent's own self-check during artifact-write keeps them honest.
-
-Source: bassclef#1144 (this propagation step — T11, iteration-2 BLOCKER). Sister rules: `.claude/rules/test-list-discipline.md` + `.claude/rules/test-sufficiency.md`. Pairs with Phase 2.2.8 (the enforcer the rules guide).
-
-##### 2.2.10 Wire role-entry-gate PreToolUse hook (bassclef#1145 T13)
-
-**Lite adopter note (bassclef#740 Task 1.2).** This hook ships at `tier: standard`. Skip this step if your tier is lite. Resolve tier via `lib/tier-check.sh`.
-
-Symlink the bassclef PreToolUse hook that catches source-code edits when the matching agent role has not been entered for the current session. MVP scope: Builder role only (matches source files in common languages). Other roles (Architect, Reviewer, Designer) deferred to a follow-on per goal narrowing — the multi-role matching matrix deserves its own design pass.
-
-The hook reads `$CWD/state/markers/role/<role>/<session_id>.marker`. The marker is written by the agent once the role's persona has been loaded (sequential mode: Claude reads `~/.claude/agents/builder.md`, writes the marker, proceeds with the role's discipline loaded; orchestrator-gated mode: Orchestrator routes the dispatch to the Builder agent which writes its own marker before proceeding).
-
-Symlink the hook:
-
-```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/role-entry-gate.sh" \
-       ".claude/hooks/role-entry-gate.sh"
-```
-
-Add to the PreToolUse Edit|Write|MultiEdit matcher block in `.claude/settings.json`. The matcher likely exists from earlier Phase 2.x steps (substrate-clarity-gate from 2.2.2, pattern-annotation-validate from 2.2.4, the parent gate chain from 2.2.5) — append `role-entry-gate` to its `hooks` array; do not duplicate the matcher entry.
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write|MultiEdit",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/role-entry-gate.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**MVP scope** — the hook fires on source-code file extensions only (`.ts`, `.tsx`, `.js`, `.jsx`, `.py`, `.rb`, `.go`, `.rs`, `.java`, `.kt`, `.swift`, `.cs`, `.cpp`, `.c`, `.h`). Non-source paths pass through. Tightening per `tech_stack.lang` reading (so a Python adopter only fires on `.py`) is a follow-on; the safe default union catches the common cases.
-
-**Marker writing** — the agent writes the marker once it enters the role. Marker shape:
-
-```json
-{
-  "role": "builder",
-  "session_id": "<uuid from harness>",
-  "entered_at": "<ISO 8601 UTC>"
-}
-```
-
-A future `/role-entry` skill automates the marker write + persona load; until then, the agent writes the marker by hand after reading the persona file. The BLOCK message documents the exact one-liner.
-
-**Composition rule** — when the Edit|Write|MultiEdit matcher block already exists, append `role-entry-gate` to its `hooks` array. Order within the array: place `role-entry-gate` AFTER substrate-clarity-gate + artifact-ingestion-gate + pattern-annotation-validate + pre-commit-gate + state-validate + multi-tenancy-check, so structural / format / state validation fires first; role-discipline check fires last. Role-entry is the methodology gate, not the structural gate — it should not run before the cheap structural checks pass.
-
-**Override path** — `SKIP_ROLE_ENTRY=1 <command>` (logged via trace-helper). Use for one-shot scripts the operator runs without entering an agent role, OR when the adopter is on a workflow that does not map to bassclef's role taxonomy.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: hook executable + reachable
-ls -l .claude/hooks/role-entry-gate.sh
-
-# Sanity: agent personas reachable via additionalDirectories (the BLOCK message refers to them)
-test -f ~/.claude/agents/builder.md && echo "builder persona reachable" || echo "builder persona NOT reachable (user-level agents missing)"
-
-# Sanity: settings.json has the hook wired under the Edit matcher
-python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) if 'Edit' in entry.get('matcher','') for h in entry.get('hooks',[])]; \
-  print('role-entry-gate wired' if any('role-entry-gate' in c for c in hooks) else 'NOT wired')"
-```
-
-**Not yet wired in bassclef** — this hook ships to the adopter via `/onboard-repo` first. Bassclef's own settings.json adds the hook in a follow-on once the marker convention has run in the wild for a few sessions and the multi-role matching follow-on lands.
-
-Source: bassclef#1145 (this hook step — T13). Sister agent personas: `~/.claude/agents/builder.md` (MVP target) + `~/.claude/agents/architect.md` + `~/.claude/agents/reviewer.md` + `~/.claude/agents/designer.md` (follow-on coverage). Follow-on tickets: multi-role matching matrix + `/role-entry` skill + `state/markers/role/` schema authoring under `standards/state-spine.md`.
-
-##### 2.2.11 Wire temperance-gate PreToolUse hook (bassclef#1147 T15)
-
-Symlink the bassclef hook that fires the /temperance question at decision boundaries. MVP scope: one active trigger — "high-impact path edit". It catches edits to `.claude/`, `standards/`, `lib/state.sh`, and SKILL.md files when the session has no fresh temperance marker. Other triggers stay as stubs. Follow-on tickets will design them.
-
-<!-- FKGL-EXEMPT: source ticket enumeration -->
-Sources: `2026-06-18b` WU-7 goal (explain-mode entry, chain-anchor entry, non-stacked-branch first edit, post-compaction recovery); ticket #1147 (N consecutive edits, substrate proposal without catalog browse, diagnose-repro marker absence).
-<!-- /FKGL-EXEMPT -->
-
-The hook pairs with `pre-commit-gate.sh` from Phase 2.2.5. That hook handles the first edit on a branch that stands alone. This hook adds one more check. It catches edits to high-impact paths that the other hook misses.
-
-Symlink the hook:
-
-```bash
-mkdir -p .claude/hooks
-ln -sf "../../../bassclef/.claude/hooks/temperance-gate.sh" \
-       ".claude/hooks/temperance-gate.sh"
-```
-
-Add to the PreToolUse Edit|Write|MultiEdit matcher block in `.claude/settings.json`. The matcher likely already exists; append `temperance-gate` to its `hooks` array. Order: place `temperance-gate` AFTER structural checks (substrate-clarity-gate, artifact-ingestion-gate, pattern-annotation-validate, pre-commit-gate, state-validate, multi-tenancy-check) and AFTER role-entry-gate. Methodology gate fires last; structural + role checks fire first.
-
-```jsonc
-{
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write|MultiEdit",
-        "hooks": [
-          { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/temperance-gate.sh" }
-        ]
-      }
-    ]
-  }
-}
-```
-
-**Marker convention** — the hook reads `$CWD/state/markers/temperance/<session_id>.marker` (session-scoped) AND falls back to any existing marker under `state/markers/temperance/` (loose branch-scoped check; tighter matching-branch check is a follow-on). The temperance marker is written by the agent (or by `/temperance` skill invocation) once the right-thing / right-way questions have been answered.
-
-**Marker shape:**
-
-```json
-{
-  "session_id": "<uuid from harness>",
-  "entered_at": "<ISO 8601 UTC>",
-  "question_answered": "yes"
-}
-```
-
-**Override path** — `SKIP_TEMPERANCE_GATE=1 <command>` (logged via trace-helper). Use sparingly; the trigger is the point of the discipline.
-
-**Verify the wiring:**
-
-```bash
-# Sanity: hook executable + reachable
-ls -l .claude/hooks/temperance-gate.sh
-
-# Sanity: temperance skill reachable via additionalDirectories
-test -f ../bassclef/.claude/skills/temperance/SKILL.md && echo "temperance skill reachable" || echo "NOT reachable"
-
-# Sanity: settings.json has the hook wired under the Edit matcher
-python3 -c "import json; d=json.load(open('.claude/settings.json')); \
-  hooks=[h.get('command','') for entry in d.get('hooks',{}).get('PreToolUse',[]) if 'Edit' in entry.get('matcher','') for h in entry.get('hooks',[])]; \
-  print('temperance-gate wired' if any('temperance-gate' in c for c in hooks) else 'NOT wired')"
-```
-
-**Not yet wired in bassclef** — adopters first; bassclef's own settings.json adds the hook in a follow-on once the MVP trigger has run in the wild for a few sessions and the trigger-taxonomy follow-on lands.
-
-Source: bassclef#1147 (this hook step — T15). Sister skill: `.claude/skills/temperance/SKILL.md` (the methodology this gate enforces mechanically). Follow-on tickets: explain-mode + chain-anchor + post-compaction + non-stacked first edit + N consecutive edits + substrate proposal + diagnose-repro triggers + `standards/temperance-discipline.md` documenting the full trigger taxonomy.
+| Hook | Override |
+|---|---|
+| turn-prose-kiss-check | (toggle via `prose_discipline.kiss_words_turn_prose: false` in bassclef-configs) |
+| substrate-clarity-gate | `SKIP_SUBSTRATE_CLARITY=1` |
+| artifact-ingestion-gate | `SKIP_ARTIFACT_INGESTION=1` |
+| pattern-annotation-validate | `SKIP_PATTERN_ANNOTATION=1` |
+| pre-commit-gate | `SKIP_PRE_COMMIT_GATE=1` |
+| state-validate | `SKIP_STATE_VALIDATE=1` |
+| destructive-command-guard | `SKIP_DESTRUCTIVE_GUARD=1` |
+| multi-tenancy-check | `SKIP_MULTI_TENANCY_CHECK=1` |
+| atomic-pr-check | `SKIP_ATOMIC_PR_CHECK=1` |
+| post-write-trace | (none — append-only trace never blocks) |
+| testing-tier-enforce | `SKIP_TESTING_TIER_ENFORCE=1` |
+| role-entry-gate | `SKIP_ROLE_ENTRY=1` |
+| temperance-gate | `SKIP_TEMPERANCE_GATE=1` |
+
+**Not yet wired in bassclef** — `role-entry-gate` and `temperance-gate` ship to adopters first. Bassclef's own settings.json adds them in a follow-on after the marker convention runs in the wild for a few sessions and the multi-role + trigger-taxonomy follow-ons land.
+
+Source: bassclef#1136 T3 (pre-commit-gate + state-validate), bassclef#1137 T4 (substrate-clarity-gate), bassclef#1138 T5 (turn-prose-kiss-check), bassclef#1139 T6 (pattern-annotation-validate), bassclef#1140 T7 (artifact-ingestion-gate), bassclef#1141 T8 (destructive-command-guard + multi-tenancy-check), bassclef#1142 T9 (atomic-pr-check + post-write-trace), bassclef#1143 T10 (testing-tier-enforce), bassclef#1144 T11 (test-discipline rule propagation), bassclef#1145 T13 (role-entry-gate), bassclef#1147 T15 (temperance-gate). Follow-ons deferred: `operator-private-path-check`, `type-check`, `post-skill-friction-check`, `role-entry` skill, multi-role matcher matrix, `standards/temperance-discipline.md`.
 
 ##### 2.3 Create the project config file
 
@@ -1244,7 +678,7 @@ for:
 If operator says "defer", scaffold with placeholders and `TODO:` markers
 so next session surfaces them.
 
-##### 2.3.5 Write the bassclef-configs adopter-default seed (bassclef#1135 WU-4)
+##### 2.3.5 Write the bassclef-configs adopter-default seed
 
 Write `.claude/bassclef-configs.jsonc` with the adopter-default seed.
 Every downstream hook + skill reads from this file; without it, defaults
@@ -1336,7 +770,7 @@ Expect a single `valid` line. The file is now the single source of truth for ado
 
 If the adopter has a pre-existing `.claude/bassclef-configs.jsonc` from a prior SENTINEL_bassclef_version, prompt before overwriting; offer a `--merge` flow (operator-driven; not automated in V1).
 
-##### 2.3.6 Discover and write the tech_stack block (bassclef#1127 WU-2)
+##### 2.3.6 Discover and write the tech_stack block
 
 Stack-bound rules + standards in bassclef (`api-conventions.md`, `sdlc-gates.md`, `schema-management.md`, `new-dependency-check.md`, `frontend-stack.md`, `deployment-topology.md`) read `tech_stack:` from `.claude/bassclef-configs.jsonc` to route per-stack discipline. Without the block, non-matching adopters see false-fires (Prisma rules at SQLAlchemy adopters, Next.js API conventions at FastAPI adopters, etc.). This step writes the block so the bleed stops at install time.
 
@@ -1456,7 +890,7 @@ Expect `valid`. If the file fails to validate, revert the append, surface the sc
 - Phase 2.5 (security scanning) reads `tech_stack.lang` to seed the scanner adapter.
 - Future Phase 2.x for `hook_chain` reads stack signals to pick per-stack hook defaults.
 
-##### 2.3.7 Seed testing.path_matchers per declared tech_stack (bassclef#1143 T10)
+##### 2.3.7 Seed testing.path_matchers per declared tech_stack
 
 Phase 2.3.5 wrote the `testing` block with `global_floor: 1` + empty `path_matchers`. Phase 2.3.6 just discovered + wrote `tech_stack`. This step reads `tech_stack.lang` and seeds `testing.path_matchers` with sensible per-stack defaults so the Tier 0 / Tier 1 enforcer (Phase 2.2.8) fires on the right paths from day one.
 
@@ -1532,7 +966,7 @@ Expect a single `valid` line. The `testing.path_matchers` items must validate ag
 
 Source: bassclef#1143 (this seed step — T10, iteration-2 BLOCKER). Sister rule: `.claude/rules/testing-tier-config.md`. Pairs with Phase 2.2.8 (the enforcer that reads this seed).
 
-##### 2.3.8 Surface the wiki_sync toggle (bassclef#1265 — Phase 1 stub)
+##### 2.3.8 Surface the wiki_sync toggle
 
 The `wiki_sync` block in `.claude/bassclef-configs.jsonc` controls whether the adopter's repo gets the bassclef-docs-sync workflow vendored from `presence/install/bassclef-docs-sync.template.yml`. This step surfaces the toggle so adopters see the option exists.
 
@@ -1561,7 +995,7 @@ The Phase 1 stub keeps this step minimal so the goal stays bounded. Adopters who
 
 Source: bassclef#1265 (this surfacing step — wiki-sync mechanism adopter inheritance). Sister bet: `docs/iteration-bets/2026-06-20b-cold-adopter-mechanism-inheritance.md` WU-2.
 
-##### 2.3.9 Write the onboard-repo state marker (bassclef-upstream#664)
+##### 2.3.9 Write the onboard-repo state marker
 
 Write `.claude/state/onboard-repo.state.json` after Phase 2.3 has
 populated the config file(s). The marker captures which mode was used,
@@ -1593,7 +1027,7 @@ pin all behavior including re-run history append.
 Source: bassclef-upstream#664 (state marker for onboard-repo). Part of goal
 `docs/iteration-bets/2026-07-08a-configs-ui-iteration-1.md` WU-4.
 
-##### 2.3.10 Wire the cron installer for auto-save (bassclef-upstream#941)
+##### 2.3.10 Wire the cron installer for auto-save
 
 Goal 27b (PR #937) shipped `presence/install/schedule-auto-save.cron.sh` at
 `tier: lite`. The installer writes a cron entry that fires
@@ -1651,7 +1085,7 @@ fires (Cloud Env / mobile / fresh sandboxes / CI). Schema codified at
 `standards/bassclef-source-config.md`; validation hook at
 `.claude/hooks/bassclef-source-config-validate.sh`.
 
-Before writing the file, prompt the adopter explicitly (per bassclef#939):
+Before writing the file, prompt the adopter explicitly:
 
 ```
 Bassclef can auto-pull the latest skills, rules, and agents into this
@@ -1765,7 +1199,7 @@ PY
 Note: the Python merge re-serializes the file without comments. Operators
 keep the schema-doc reference (`standards/bassclef-configs-schema.md`)
 as the bassclef comment-bearing source; the on-disk file is the values.
-A follow-on (bassclef#1135 V2) may add a comment-preserving JSONC writer.
+A follow-on may add a comment-preserving JSONC writer.
 
 INSTEAD of asking the operator to know the scanner names: the standard supplies the per-stack defaults; the operator confirms the stack choice only.
 
@@ -1819,7 +1253,7 @@ orientation into every session. The orientation names the gates, the
 luminaries, the tier ladder, and the rules the agent should not break.
 
 The orientation file lands in the adopter repo as a symlink into bassclef.
-The sync template Section 3d-bis writes the symlink (per bassclef-upstream#925).
+The sync template Section 3d-bis writes the symlink.
 Without this symlink, the import resolves only through `additionalDirectories`.
 If that path breaks — rename, delete, corporate laptop with no sibling — the
 import silently no-ops. The symlink closes that gap.
@@ -1864,7 +1298,7 @@ cp ~/src/sunj-labs/bassclef/templates/whereami-template.md \
 Operator fills in phase + iteration section. If repo is fresh,
 `phase: Inception` with `iteration_bet: none — new repo` is fine.
 
-#### Phase 3.5 — Optional: provision the deploy host + bootstrap secrets (bassclef#522)
+#### Phase 3.5 — Optional: provision the deploy host + bootstrap secrets
 
 **Working directory: target repo.**
 
@@ -1884,7 +1318,7 @@ still supported).
 | `/onboard-repo --full` | All of the above — substrate scaffolded + Amplify host provisioned + secrets audited in one dispatch. Recommended for new sunj-labs repos. |
 | `/onboard-repo --greenfield-from-intent "<intent>"` | Cold-adopter demo path. Skips Path A entirely and runs Path B — empty directory in, full artifact chain on disk plus localhost gallery URL out. No GitHub repo gets created. No vendor accounts needed. Uses the LLM your Claude Code session provides. For the extended path (deploy mocks to a configured subdomain plus chain to `/build` plus `/launch-preview`), finish Path A first to wire vendor bindings, then dispatch `/launch --voice-input` without `--local`. See `docs/iteration-bets/2026-05-12-phase-v-hey-alexa-mvd.md` and bassclef#923 / PR #924 for the local-mode building block. |
 
-##### Tier gate (bassclef#740 Task 1.2)
+##### Tier gate
 
 Three of the flags above dispatch skills that ship at `tier: standard`.
 Lite adopters running the bassclef-lite tarball do not carry
@@ -1918,8 +1352,8 @@ graceful degrade.
 ##### Interactive prompt (when no flag)
 
 After Phase 3 completes, agent surfaces follow-on prompts. Prompts are
-gated on artifact existence (bassclef#961) and the deploy-host prompt
-uses honest platform framing (bassclef#962):
+gated on artifact existence and the deploy-host prompt
+uses honest platform framing:
 
 ```bash
 # Check for substrate.secrets.md (bassclef#961) — silently skip the
@@ -1991,7 +1425,7 @@ onboarding_secrets_skipped: true       # set when operator answers 'skip'
 `n` (decline-this-time) does NOT persist — re-runs re-prompt because the
 operator didn't say skip-permanently.
 
-`Y` sets the per-platform provisioning indicator (e.g., `amplify_app_id`) on success. Chain pre-flight Check 6 (bassclef#523) reads that indicator when /launch dispatches. Without it, /launch BLOCKs with three-path remediation. The two flags pair well. `--with-deploy-host` pre-empts the BLOCK. The default flow lets the BLOCK surface the missing setup.
+`Y` sets the per-platform provisioning indicator (e.g., `amplify_app_id`) on success. Chain pre-flight Check 6 reads that indicator when /launch dispatches. Without it, /launch BLOCKs with three-path remediation. The two flags pair well. `--with-deploy-host` pre-empts the BLOCK. The default flow lets the BLOCK surface the missing setup.
 
 ##### Composes with
 
@@ -2002,7 +1436,7 @@ operator didn't say skip-permanently.
 | `/bind-subdomain <subdomain>` | Separate dispatch — not chained from /onboard-repo (subdomain choice is repo-specific; no good default). Run after deploy host provisioned. |
 | `/launch` | First substantive dispatch after onboarding completes. Chain pre-flight Check 6 verifies the provisioning indicator before variant generation runs. |
 
-#### Phase 3.6 — Closing handoff (bassclef#964)
+#### Phase 3.6 — Closing handoff
 
 After Phase 3 (and Phase 3.5 if any flag fired), Path A surfaces a
 closing handoff. Two templates — adopter-mode and operator-mode —