@thebassclef/lite 1.0.4 → 1.1.0

package/dist/lite/standards/sdlc-gates/typescript.md

@@ -0,0 +1,57 @@
+---
+tier: lite
+description: Stack-specific instantiation of .claude/rules/sdlc-gates.md for TypeScript.
+---
+
+# SDLC Gates — TypeScript
+
+Stack-specific instantiation of `.claude/rules/sdlc-gates.md` for TypeScript. Composed under ARCH-T0 #1133 Path A.
+
+## When this sibling fires
+
+When adopter's `.claude/bassclef-configs.jsonc` has `tech_stack.lang: typescript`. The loader (future ticket) reads this sibling and applies the TypeScript-specific globs in addition to the universal gates in the parent rule.
+
+Until the loader ships, this sibling is discoverable via the cross-reference table in the parent rule. The universal gates fire methodologically regardless of stack.
+
+## TypeScript-specific globs
+
+```yaml
+globs:
+  - src/**/*.ts
+  - src/**/*.tsx
+  - scripts/**/*.ts
+```
+
+These globs scope hook + tooling firing to TypeScript source files. The pre-build temperance + diagnose gates fire on these path matchers; the post-build `/verify` gate runs against these files.
+
+## TypeScript-specific tech_stack_match
+
+```yaml
+tech_stack_match:
+  lang: typescript
+  backend: nodejs
+```
+
+For adopter configs that opt into the per-stack loader, this match field anchors the sibling to the right adopter declaration in `.claude/bassclef-configs.jsonc`.
+
+## TypeScript-specific verify hooks
+
+When the universal `/verify` gate fires post-build (per the parent rule), TypeScript-specific checks include:
+
+- `tsc --noEmit` for type-checking
+- `eslint` for static-analysis
+- `vitest run` for unit tests
+- (Optional, per adopter) `prettier --check` for formatting
+
+The adopter's `package.json` scripts wire these into the `/verify` invocation.
+
+## Composition with universal gates
+
+Apply the universal gates from `.claude/rules/sdlc-gates.md` first; the TypeScript-specific globs above add file-scoping detail. When the two conflict (e.g., a TypeScript-specific check contradicts the universal failure-chain rule), the universal principle wins; file a `/promote` ticket if you believe the convention should be amended.
+
+## Refs
+
+- Parent rule: `.claude/rules/sdlc-gates.md`
+- ARCH-T0 #1133 — operator-stack-leakage audit + remediation
+- bassclef#1311 — this sibling (sdlc-gates Path A WU-7 of bet 2026-06-20e)
+- bassclef#1309 — sister Path A (api-conventions WU-6)

package/dist/lite/standards/secrets-lifecycle.md

@@ -0,0 +1,210 @@
+---
+tier: lite
+description: substrate.secrets.md is the single declarative source for secrets/token lifecycle in any bassclef-substrate repo.
+---
+
+# Secrets Lifecycle
+
+`substrate.secrets.md` is the single declarative source for secrets/token
+lifecycle in any bassclef-substrate repo. Schema:
+`standards/state-spine/schemas/substrate-secrets.schema.json`.
+
+## Why this exists
+
+Before this standard: tokens silently expired mid-session. The operator
+hit a 401, then grepped historical chronicles to remember which token,
+where it lives, how to rotate it. Every consumer team reinvented the
+tracking — file in 1Password, sticky note, calendar reminder, none of
+the above.
+
+After this standard: every secret has a tracked expiry, a documented
+rotation procedure, and a session-start hook that surfaces the warning
+weeks before expiry. Friction removed; operational story declarative.
+
+## Why a separate file from `substrate.config.md`
+
+`substrate.config.md` holds external resource *references* (doc IDs,
+URLs, repo refs). `substrate.secrets.md` holds secret *lifecycle*
+(expiry, rotation, health checks). Two different concerns:
+
+- **Privacy posture**: secrets references are sensitive metadata
+  (storage location, expiry windows leak operational structure);
+  config references are public.
+- **Audit lifecycle**: `last_rotated` + `expires_at` need date discipline;
+  config rarely changes.
+- **Read-time consumers**: `scripts/secrets-status.sh` parses secrets;
+  `substrate.config.md` is read by skills/hooks for resource lookup.
+
+Cross-reference: `substrate.config.md` carries a one-line pointer
+("secrets tracked in `substrate.secrets.md`"); `substrate.secrets.md`
+carries a one-line back-pointer.
+
+## File shape
+
+`substrate.secrets.md` uses Shape B (YAML frontmatter + markdown body):
+
+```markdown
+---
+schema_version: v0
+secrets:
+  - name: SLACK_WEBHOOK
+    purpose: posting to bassclef-activity channel
+    storage:
+      type: github_actions_secret
+      reference: SLACK_WEBHOOK
+    rotation_cadence: 1y
+    expires_at: 2026-09-15
+    rotation_procedure: docs/runbooks/rotate-slack-webhook.md
+    alert_threshold_days: 30
+    owner: operator
+    last_rotated: 2025-09-15
+    health_check_command: ""
+---
+
+# Secrets — <repo name>
+
+Lifecycle tracking for external integration credentials.
+See `standards/secrets-lifecycle.md`.
+
+[Optional human-readable notes per secret in body sections.]
+```
+
+## Field reference
+
+| Field | Required | Type | Notes |
+|-------|----------|------|-------|
+| `name` | yes | string | UPPER_SNAKE_CASE. Logical name (env-var convention). NEVER the value. |
+| `purpose` | yes | string | One-line: what does this secret allow? |
+| `storage.type` | yes | enum | `1password \| env \| file \| github_actions_secret \| aws_secrets_manager \| custom` |
+| `storage.reference` | yes | string | How to fetch the value at runtime (shape per type — see below). |
+| `rotation_cadence` | yes | duration \| enum | `1y`, `6mo`, `90d`, `30d` OR `manual` / `on-leak` / `never` |
+| `expires_at` | yes | date \| `never` | ISO 8601 (YYYY-MM-DD) OR `never` (lifetime credential) |
+| `rotation_procedure` | yes | path | Path to runbook (`docs/runbooks/rotate-<name>.md`). Empty string when cadence=`never`. |
+| `alert_threshold_days` | yes | integer \| `n/a` | Days-before-expiry to start surfacing BLOCKED. Use `n/a` for `never`. |
+| `owner` | yes | string | Who rotates. `operator` for solo; team/handle for multi-operator. |
+| `last_rotated` | yes | date \| `unknown` | ISO 8601 OR `unknown` if pre-tracking. |
+| `health_check_command` | no | string | Optional shell command verifying secret is live. Empty string skips. |
+
+## Storage type vocabulary (v0)
+
+Closed enum in v0; extensible via `custom` per consumer.
+
+| Type | Reference shape | Example |
+|------|----------------|---------|
+| `1password` | vault path | `vault://bassclef/anthropic-api-key` |
+| `env` | env var name | `CLOUDFLARE_API_TOKEN` |
+| `file` | absolute path | `~/.poa-gauth.json` |
+| `github_actions_secret` | secret name | `SLACK_WEBHOOK` |
+| `aws_secrets_manager` | ARN or secret id | `arn:aws:secretsmanager:us-east-1:...:secret:my-secret-AbCdEf` |
+| `custom` | free-form (document inline in body) | per-consumer |
+
+## Rotation cadence
+
+ISO 8601 duration OR controlled enum:
+
+- **Duration shorthand**: `1y`, `6mo`, `90d`, `30d`, `1w` (bassclef's friendly form)
+- **Full ISO 8601**: `P1Y`, `P6M`, `P90D` (also accepted)
+- **`manual`**: rotate when notified (e.g., compromise, vendor migration)
+- **`on-leak`**: rotate only on incident; otherwise lifetime
+- **`never`**: lifetime credential (rare; flag for review)
+
+## Expiry tracking
+
+`expires_at` is the hard date the credential becomes invalid. The
+session-start hook (`90-secrets-expiry.sh`) compares `expires_at` to
+today's date and surfaces BLOCKED when within `alert_threshold_days`.
+
+When `expires_at: never` the entry is never alerted; `alert_threshold_days`
+must be `n/a` and `rotation_procedure` may be empty.
+
+After rotation: update both `last_rotated` (to today) AND `expires_at`
+(to the new expiry). The runbook should remind the operator.
+
+## Health checks
+
+`health_check_command` is optional. When set, it's a shell command that
+returns exit code 0 when the secret is live. Used by `secrets-status.sh
+--health-check`. Should reference the env var (not hardcoded value):
+
+```yaml
+health_check_command: "curl -s -H 'x-api-key: $ANTHROPIC_API_KEY' https://api.anthropic.com/v1/models | jq -e '.data'"
+```
+
+For `manual` / `on-leak` / `never` cadences, health checks are still
+useful (verify the credential hasn't been revoked).
+
+## Hard rules
+
+1. **NO secret VALUES.** Only references, expiry dates, rotation procedures,
+   and health-check commands. Values stay in their authoritative storage
+   (1Password / GitHub Actions Secrets / .env / AWS Secrets Manager).
+2. **NO commits of `.env` files**. Use `storage.type=env` with the
+   reference being the env var name; the value lives in a gitignored
+   `.env` consumed at runtime.
+3. **`substrate.secrets.md` is git-tracked.** Its content is
+   non-sensitive metadata. If your storage references leak operational
+   structure (e.g., AWS account IDs you'd rather not publish), use
+   `custom` type with a private reference shape.
+4. **Rotation updates BOTH `last_rotated` AND `expires_at`.** The runbook
+   reminds the operator.
+5. **`alert_threshold_days` matches risk profile.** Webhooks: 30 days.
+   API keys with manual rotation: longer. OAuth refresh tokens: shorter
+   if vendor revokes proactively.
+6. **`~/.config/bassclef/secrets.env` lines MUST use `export VAR=value`
+   format.** When the env adapter writes to that file, plain `VAR=value`
+   sets a shell variable only — bash subprocesses (including every
+   bassclef hook + helper) don't inherit it. `export VAR=value` enters
+   the environment proper and is inherited by every subprocess the
+   shell launches. The env adapter (`scripts/adapters/secrets/env.sh`)
+   enforces this format on writes; `/secrets-bootstrap --repair`
+   retroactively fixes legacy files that lack the prefix
+   (bassclef#976).
+
+## Tooling
+
+| Tool | Purpose |
+|------|---------|
+| `scripts/secrets-status.sh` | Parses `substrate.secrets.md`, prints traffic-light status table, optional `--health-check` flag |
+| `scripts/secrets-bootstrap.sh --repair` | Adds missing `export ` prefix to assignment lines in `~/.config/bassclef/secrets.env`. Creates dated backup. Required when subprocess inheritance breaks (bassclef#976) |
+| `.claude/hooks/session-reflection.d/90-secrets-expiry.sh` | Session-start BLOCKED surface for any secret within `alert_threshold_days` |
+| `templates/secret-rotation-template.md` | Runbook template for new secret rotation procedures |
+
+## Override paths
+
+- **`SKIP_SECRETS_EXPIRY_CHECK=1`**: bypass the session-start hook for
+  one command. Logged to stderr per bassclef idiom.
+- **No `substrate.secrets.md`**: hook is silent (graceful in repos
+  without secrets).
+
+## Migration
+
+For repos adopting this standard:
+
+1. Copy `presence/install/substrate-secrets-template.md` to repo root
+   as `substrate.secrets.md`
+2. Populate one entry per tracked secret (start with the most painful —
+   typically the one that last expired)
+3. Add cross-reference in `substrate.config.md`
+4. Run `bash scripts/secrets-status.sh` to verify schema parses
+5. Commit; the session-start hook activates immediately
+
+## Out of scope (v1+)
+
+- Slack/email cron alerts (v0 surfaces at session start only)
+- AWS Secrets Manager / 1Password programmatic retrieval (v0 uses
+  per-secret `health_check_command`)
+- Storage-type validators (vs per-secret command) — would require
+  bassclef-side implementations per type
+- SOC 2 / ISO 27001 audit-trail integration — rotation log feeding
+  external audit systems
+
+## Composes with
+
+- `standards/substrate-config-schema.md` — sibling standard for
+  references (non-secret)
+- `.claude/rules/substrate-config-schema.md` — agent behavior rule;
+  references-only-by-name discipline applies to secrets too
+- `.claude/rules/manual-prod-approval.md` — sibling
+  infrastructure-rail pattern
+- `.claude/rules/context-engineering.md` — same just-in-time
+  context-surface discipline applied to operator runbook

package/dist/lite/standards/security-scanner-adapter.md

@@ -0,0 +1,145 @@
+---
+tier: lite
+description: "The adapter pattern that turns bassclef's per-language security defaults into adopter-runnable CI."
+---
+
+# Security Scanner Adapter Standard
+
+The adapter pattern that turns bassclef's per-language security defaults into adopter-runnable CI. This standard is the reference; per-stack reference workflows ship under `config/security-scanners/` (Phase Y-3); `/onboard-repo` writes the stack choice to `.claude/bassclef-configs.jsonc` (Phase Y-4).
+
+## Why this exists
+
+Adopter repos run bassclef's substrate as their development methodology. The substrate has security disciplines (`standards/code-safety-principles.md`, `.claude/rules/security.md`, `standards/bash-hook-safety.md`) but the disciplines need *scanners* to enforce them in adopter CI.
+
+Today's gap: every adopter chooses, installs, and configures their own security scanners. Bassclef has no opinion on which scanners fire for which language. New adopters who do not know the security tool landscape ship with no scanners; experienced adopters duplicate effort across repos.
+
+INSTEAD of per-adopter scanner choice from scratch: bassclef ships per-stack defaults. Adopters declare their stack at onboard time; bassclef wires the default scanners + ships a reference workflow they copy + customize.
+
+## Anchor
+
+`@luminary saltzer-schroeder` — the eight protection-mechanism principles. Scanners are the mechanical enforcement layer for the source-code disciplines.
+
+This standard composes with:
+
+- `standards/code-safety-principles.md` — language-agnostic principles the scanners check
+- `standards/bash-hook-safety.md` — bash-specific discipline; shellcheck is the scanner
+- `standards/bassclef-configs-schema.md` § Security scanning (Phase Y-2) — adopter config surface
+- `standards/deployment-topology.md` — sibling adapter pattern; same shape
+
+## The adapter shape
+
+```
+adopter declares stack → bassclef-configs reads stack → workflow template fires per-stack scanners → scanner output meets discipline gates
+```
+
+Same shape as the deploy-host adapter. Adopter declares the runtime; bassclef ships defaults; adopter customizes per-need.
+
+Three pieces:
+
+1. **Stack declaration** — `.claude/bassclef-configs.jsonc` `security_scanning.stack` field
+2. **Reference workflow** — `config/security-scanners/<stack>.yml` (template the adopter copies)
+3. **Per-stack defaults** — listed in this standard's matrix below
+
+## Stack reference matrix
+
+Six stack values. Six default scanner sets. Adopter copies the reference workflow + adjusts.
+
+| Stack | Default scanners | What they catch |
+|---|---|---|
+| `node-typescript` | eslint-plugin-security + audit-ci + gitleaks | Source: XSS / SQL injection / unsafe regex / weak crypto. Deps: known CVEs. Secrets: leaked tokens. |
+| `python` | bandit + safety + gitleaks | Source: SQL injection / weak crypto / unsafe pickle / shell injection. Deps: known CVEs. Secrets: leaked tokens. |
+| `ruby` | brakeman + bundler-audit + gitleaks | Source: Rails-specific findings (mass-assignment / unsafe redirects / SQL injection). Deps: known CVEs. Secrets: leaked tokens. |
+| `java` | spotbugs-security + dependency-check + gitleaks | Source: deserialization / XXE / unsafe reflection. Deps: known CVEs (OWASP DC). Secrets: leaked tokens. |
+| `go` | gosec + govulncheck + gitleaks | Source: weak crypto / unsafe error handling / SQL injection. Deps: known CVEs. Secrets: leaked tokens. |
+| `custom` | adopter-supplied list | Adopter responsible for choice + coverage |
+
+`gitleaks` appears in every default set because secret detection is stack-agnostic.
+
+`custom` is for adopters with a stack not in the bassclef defaults OR with specific scanner requirements (e.g., commercial Snyk / Veracode / Checkmarx). The adapter pattern allows opt-out without losing the schema discipline.
+
+## Reference workflows
+
+Phase Y-3 ships the first two reference workflows: `config/security-scanners/node-typescript.yml` + `config/security-scanners/python.yml`. Ruby + Java + Go follow per adopter demand.
+
+Each reference workflow:
+
+- Triggers on PR + push to main (matches bassclef-pr-ci.yml pattern)
+- Installs scanners
+- Runs each scanner
+- Outputs findings as PR comments (advisory) AND as workflow status (potential BLOCK)
+- Uses `block_on_high_severity` field from bassclef-configs to decide BLOCK vs advisory
+
+Adopters copy the template to `.github/workflows/security-scan.yml` in their consumer repo + customize.
+
+## How the adopter configures
+
+`.claude/bassclef-configs.jsonc` `security_scanning` block (Phase Y-2):
+
+```jsonc
+{
+  "security_scanning": {
+    // Stack name from the matrix above OR "custom".
+    // null = OFF (no security scanning configured).
+    "stack": "node-typescript",
+
+    // Optional additional scanners (e.g., commercial tools).
+    // Names are advisory; adopter writes their own workflow steps.
+    "additional_scanners": [],
+
+    // Block CI on high-severity findings; advisory-only otherwise.
+    // Recommended: true for production-bound work; false for early
+    // exploratory adopters.
+    "block_on_high_severity": true
+  }
+}
+```
+
+`null` stack means the adopter has not yet configured scanners; `/onboard-repo` will prompt at the next session. After choice, the field stays static — adopter edits it manually OR re-runs `/onboard-repo --reconfigure-security`.
+
+## Stack auto-detection
+
+Phase Y-4 extends `/onboard-repo` with stack auto-detection. Heuristics:
+
+| Signal | Hint |
+|---|---|
+| `package.json` exists + `typescript` or `@types/*` in deps | node-typescript |
+| `package.json` exists + JavaScript only | node-typescript (with TS opt-out) |
+| `requirements.txt` OR `pyproject.toml` OR `setup.py` | python |
+| `Gemfile` OR `*.gemspec` | ruby |
+| `pom.xml` OR `build.gradle` OR `*.java` | java |
+| `go.mod` OR `*.go` | go |
+| Multiple signals OR none | prompt operator + offer `custom` |
+
+INSTEAD of asking the operator to remember the stack name: auto-detect from build files + confirm. The operator overrides if the detection is wrong.
+
+## What this adapter does NOT do
+
+- Does not install scanners on the adopter machine — only generates the CI workflow that installs them per-run
+- Does not maintain the scanner lists (adopters update reference workflows when new tool versions ship)
+- Does not unify scanner output formats — each scanner outputs its native format; the workflow presents per-scanner sections
+- Does not configure scanner-specific rules — adopters edit the reference workflow for per-org tuning
+- Does not replace SAST / DAST commercial tools — the defaults are open-source baselines; adopters add commercial tools via `additional_scanners`
+
+## When this adapter fires
+
+| Surface | Action |
+|---|---|
+| New adopter onboarding | `/onboard-repo` auto-detects stack + asks for confirmation + writes config |
+| Existing adopter without security_scanning block | `/onboard-repo --reconfigure-security` (Phase Y-4) |
+| Per PR in adopter repo | Adopter's copy of reference workflow fires |
+| Reference workflow update in bassclef | Adopter notices via bassclef-sync; opts in to refresh their workflow |
+
+## Refs
+
+- `standards/code-safety-principles.md` — language-agnostic principles the scanners check
+- `standards/bash-hook-safety.md` — bash-specific discipline (shellcheck is the bash scanner)
+- `standards/bassclef-configs-schema.md` § Security scanning (Phase Y-2; this PR's sibling)
+- `standards/deployment-topology.md` — sibling adapter pattern
+- `.claude/skills/onboard-repo/SKILL.md` (Phase Y-4) — onboarding integration
+- `@luminary saltzer-schroeder` — anchor; mechanical enforcement of protection principles
+- bassclef#1058 — failure-as-evidence for why adopters need substrate-supplied defaults
+- docs/iteration-bets/2026-06-17a-secure-coding-foundations-longrun.md — Phase Y-1
+
+## Retirement
+
+This standard retires when scanner choice converges (one bassclef scanner per stack) OR when a different security-enforcement model replaces per-stack scanner-based CI (e.g., universal SAST API). The adapter shape persists; the matrix entries evolve.

package/dist/lite/standards/session-board.md

@@ -0,0 +1,256 @@
+---
+tier: lite
+description: The session-board is a session-level coordinator artifact for multi-bet longrun sessions.
+---
+
+# Session-Board Standard
+
+The session-board is a session-level coordinator artifact for **multi-bet
+longrun sessions**. It tracks state across N bets simultaneously so a
+mid-session pickup is resumption from a known state, not reconstruction
+from `gh pr list` plus N stack manifests plus operator memory.
+
+## When required
+
+A session-board MUST exist when **either** holds:
+
+1. **Multi-bet** — ≥2 active iteration goals in the session
+2. **Multi-phase** — ≥2 phases of a single bet active in the same session
+   (rare, but possible when a bet's phase gate clears mid-session and the
+   operator rolls into the next phase without ending the session)
+
+Singleton-bet single-phase sessions do NOT require a session-board. The
+existing primitives are sufficient:
+
+- `docs/whereami.md` — current state snapshot
+- `docs/iteration-bets/<slug>.md` — scope contract
+- `docs/branch-stacks/<slug>.md` (or `docs/stacks/<slug>-stack.md`) —
+  per-bet stack manifest
+
+The session-board adds overhead. If you don't need it, don't write it.
+
+## Why this artifact exists
+
+For multi-bet sessions, today's primitives leave a coordinator gap. If
+an overnight session dies on branch 9 of 17 across 3 bets, the next
+session reconstructs state from `gh pr list` + reading 3 stack manifests +
+trying to remember which bet was active when context was lost.
+
+That's "rebuild map from artifacts" — exactly the failure mode
+`docs/whereami.md` was created to prevent at the project level. The
+session-board is the same prevention at the session level.
+
+The plural `active_sessions:` registry in whereami (proposed in pipeline
+bet Phase A WS-2) is the **index**; the session-board is the **per-session
+detail** the index points to.
+
+## Location
+
+`docs/sessions/<YYYY-MM-DD>-<slug>.md` — one file per session.
+
+The slug describes the session's shape, not its content. Examples:
+- `2026-04-26-longrun.md` — multi-bet longrun
+- `2026-05-03-overnight-pipeline-phase-b.md` — single-bet multi-phase overnight
+
+## Schema
+
+### Frontmatter
+
+```yaml
+---
+session_id: <YYYY-MM-DD>-<slug>
+session_started: <ISO-8601 UTC>
+session_ended: <ISO-8601 UTC OR null while in-flight>
+session_outcome: <short string OR null while in-flight>
+mode: <gating>-<execution>   # e.g. orchestrator-gated-sequential
+operator: <github-username>
+trigger: <one-line reason this session needed a board>
+active_bets:
+  - slug: <bet-slug-without-extension>
+    phase_in_flight: <phase identifier OR "single" for non-phased bets>
+    appetite_turns: <integer>
+    stack_manifest: <path to stack manifest>
+session_turn_budget: <integer — sum of bet appetites + buffer>
+session_warning_threshold: <integer — typically 75% of budget>
+---
+```
+
+### Body sections (all required)
+
+**`# Session board — <slug>`** — top-level heading
+
+**`## Sources read`** — every artifact the session-board reader reads
+during pickup (per `.claude/rules/artifact-ingestion.md`). At minimum:
+each bet, each stack manifest, the survival kit (per
+`.claude/rules/context-management.md`), and any /promote issues filed in
+this session.
+
+**`## Active bets — quick reference`** — table summarizing the goal.,
+their phase, turn budget, and independence relationships:
+
+```markdown
+| Bet | Phase | Turns | Independence |
+|---|---|---|---|
+| <bet> | <phase> | <n> | <how-disjoint-from-others> |
+```
+
+Plus a **scope-disjointness** declaration: list which file paths each
+bet touches. If two bets touch the same paths, they are NOT
+parallel-safe and the session board MUST note the sequencing rule.
+
+**`## Per-WS status`** — table of every workstream across every bet:
+
+```markdown
+| Bet | WS | Branch | Status | PR | Notes |
+|---|---|---|---|---|---|
+| <bet> | <ws-id> | <branch-name> | todo \| in-flight \| pr-open \| merged \| rejected | <#NN OR —> | <one-line> |
+```
+
+This is the **work breakdown across all bets** — the artifact a
+post-compaction or next-session pickup reads first to know what's done
+and what's next.
+
+**`## Compaction anchors`** — checkpoints that drive context-management
+decisions:
+
+- **Last compaction**: ISO-8601 timestamp OR "none yet"
+- **Last `/temperance` firing**: timestamp + scope (kickoff / scope-decision / etc.)
+- **Last phase completed**: bet + phase identifier OR "none"
+- **Survival kit declared**: bullet list of files to re-read after
+  compaction. MUST include this session-board file itself.
+
+**`## Session-level /temperance — anchored at kickoff`** — the
+right-thing / right-way / scope-drift-trigger answers from the kickoff
+firing. Any subsequent `/temperance` re-firings during the session are
+appended in the operator decision log below.
+
+**`## Phase-boundary checkpoints scheduled`** — table of when the
+session will checkpoint:
+
+```markdown
+| When | Action |
+|---|---|
+| <trigger condition> | <what fires: re-temperance / update board / /sprint / etc.> |
+```
+
+**`## Operator decision log`** — chronological record of mid-session
+pivots, scope changes, re-anchors, scope-drift triggers. Each entry is
+ISO-timestamped and one-or-two-sentence:
+
+```markdown
+- <ISO-ts> — <decision summary>
+```
+
+This is the audit trail when the next session asks "why did the operator
+pivot from WS-3 to WS-7 mid-session?"
+
+**`## Closeout audit checklist`** — final checks at session end. Owned
+by `/longrun closeout` when that skill exists; until then, manually run.
+
+**`## Out of scope this session`** — explicit deferrals, with the rule:
+"if any of these activate, fire `/longrun checkpoint --now` and
+re-anchor."
+
+## Lifecycle
+
+| Stage | Trigger | Action |
+|---|---|---|
+| Create | `/longrun prep` (or manual scaffold from template) at session start | Write file with frontmatter + populated bets/WSes |
+| Update | Each WS status change (todo → in-flight → pr-open → merged) | Edit the matching row in `## Per-WS status` |
+| Update | Each compaction event | Append to `## Compaction anchors` |
+| Update | Each operator pivot / scope decision | Append to `## Operator decision log` |
+| Close | `/longrun closeout` at session end | Set `session_ended` + `session_outcome` in frontmatter; run closeout audit checklist |
+
+The board is **append-mostly** — old entries are not edited or
+backfilled. The only mutations are status table cells and frontmatter
+close fields. This preserves audit trail.
+
+## Composition with existing primitives
+
+- **`docs/whereami.md`** — project-state snapshot (load-bearing per
+  `.claude/rules/whereami-load-bearing.md`). Session-board adds
+  session-level detail; whereami stays the project-level index. After
+  the pipeline bet's WS-2 ships, whereami's `active_sessions:` registry
+  will point at session-boards by file path.
+- **`docs/iteration-bets/<slug>.md`** — scope contract per bet. The
+  session-board references each active bet's path; never duplicates the
+  bet's content.
+- **`docs/branch-stacks/<slug>.md`** (or `docs/stacks/<slug>-stack.md`)
+   — per-bet stack manifest. Session-board references each manifest
+  path; the WS table aggregates across bets but each WS row points to
+  the per-bet manifest as authority.
+- **`chronicle/<date>-<slug>.md`** — retrospective narrative. Orthogonal
+  to the session-board (chronicle is what-happened; session-board is
+  what's-happening-now). At session close, the chronicle MAY cite the
+  session-board as evidence; the chronicle does NOT replace it.
+
+## Relationship to `/longrun` skill
+
+The `/longrun` skill (separate /promote, bassclef#274) consumes this
+standard. Specifically:
+
+- **`/longrun prep`** — writes the initial session-board from the
+  template
+- **`/longrun checkpoint`** — updates `## Per-WS status` + appends to
+  `## Operator decision log`
+- **`/longrun closeout`** — runs the audit checklist + sets close
+  frontmatter fields
+
+Until `/longrun` ships (after Phase A0 of the pipeline bet), session
+boards are written and updated manually using the template.
+
+## Anti-patterns
+
+**Don't write a session-board for a singleton-bet session.** It adds
+overhead without coordination value. Singleton-bet pickup uses
+whereami + bet + stack manifest; that's sufficient.
+
+**Don't duplicate bet content into the session-board.** If you find
+yourself copying a bet's scope or risk register into the session-board,
+stop — reference the goal path instead. The session-board is index +
+status, not content.
+
+**Don't silently retire or merge bets without updating the board.** The
+status table is the source of truth for "what's alive." If a WS is
+merged but the table still says `pr-open`, next-session pickup will be
+confused.
+
+**Don't backfill `## Operator decision log` after the fact.** The log is
+append-only and timestamped. If a decision was missed at the time it
+was made, append a current-time entry noting "retrospective: <summary>"
+rather than fabricating a prior timestamp.
+
+## Enforcement
+
+Methodology-level today. The `/longrun` skill, when shipped, will
+enforce session-board presence on `/longrun prep` for any session
+declaring multi-goal scope. Until then, agent self-checks at session
+start: "Am I about to manage ≥2 bets simultaneously? If yes, write a
+session-board before starting work."
+
+## Override
+
+Singleton-bet or single-phase sessions skip this artifact entirely. No
+override needed — the trigger condition (multi-bet OR multi-phase) is
+the only entry. If neither holds, the session-board is not the right
+tool.
+
+## Retirement condition
+
+If multi-bet longrun sessions are abandoned as a pattern (operator
+prefers strict one-bet-per-session discipline), this standard retires
+along with the `/longrun` skill. Until then, this standard is
+load-bearing for any session that triggers the conditions above.
+
+## Relationship to other standards/rules
+
+- `standards/branch-stacking.md` — per-bet stack manifest pattern; this
+  standard adds the session-level layer above it
+- `.claude/rules/whereami-load-bearing.md` — project-level state
+  artifact; this standard is the session-level peer
+- `.claude/rules/artifact-ingestion.md` — the `## Sources read` block
+  pattern this standard's body uses
+- `.claude/rules/context-management.md` — survival kit declaration in
+  `## Compaction anchors` is the post-compaction re-read list
+- bassclef#274 — `/longrun` skill (consumes this standard)
+- bassclef#273 — promotion issue this standard closes