@thebassclef/lite 1.1.1 → 1.2.0

package/dist/lite/.claude/settings.json

@@ -42,6 +42,11 @@
             "type": "command",
             "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-commit-gate.sh",
             "timeout": 15
+          },
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/pre-commit-identifier-leak-scrub.sh",
+            "timeout": 10
           }
         ]
       },
@@ -102,6 +107,11 @@
             "type": "command",
             "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/vocabulary-migration-check.sh",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/persona-name-scrub-check.sh",
+            "timeout": 10
           }
         ]
       }
@@ -156,6 +166,16 @@
             "type": "command",
             "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/longrun-prep-compounding-sequence-check.sh",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/longrun-prep-render-check.sh",
+            "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/skill-step-list-check.sh",
+            "timeout": 10
           }
         ]
       }

package/dist/lite/.claude/skills/agent-research-spawn/SKILL.md

@@ -0,0 +1,100 @@
+---
+tier: lite
+name: agent-research-spawn
+description: "Generate a bassclef-conformant pattern catalog entry by researching a named pattern against authoritative web sources. Used by /launch chain when the catalog has gaps. Also operator-callable for catalog growth."
+problem: "Pattern catalog entries take hours to research. Adopters copy patterns without knowing when they fit."
+value: "Generates a bassclef-conformant catalog entry for a named pattern. Cites authoritative sources."
+inputs: [Pattern name from GoF or Fowler or DDD]
+outputs: [Full catalog entry markdown, Source citations, Applicability notes]
+user_invocable: true
+disable_model_invocation: false
+---
+
+# /agent-research-spawn — Research a pattern, populate the catalog
+
+The primitive that lets bassclef's pattern catalogs grow. Takes a pattern name + target shelf path + optional context. Performs WebSearch + WebFetch against authoritative sources. Produces a catalog entry that conforms to `patterns/_template/catalog-entry.md`.
+
+INSTEAD of guessing or summarizing from training data: search for the pattern's source catalog (Smarter Patterns for UX-AI, Fowler/refactoring.guru/sourcemaking for code), fetch the bassclef page, structure the findings into the catalog template. Cite source URL explicitly.
+
+## When to invoke
+
+- **Operator dispatches**: `/agent-research-spawn "<pattern name>" patterns/<shelf>/<source-catalog>/` — when operator wants to add a specific pattern to the catalog
+- **Workflow fallback**: `/launch` chain detects catalog gap (luminary refers to "Cooper's Persona" but `patterns/ux-ai/cooper/persona.md` is missing) → spawn this skill to fill the gap
+- **Standalone**: operator browses an existing shelf, notices a missing entry that should exist, dispatches the skill
+
+## Procedure
+
+1. **Validate inputs.** Pattern name must be specific (not "patterns about AI"). Target shelf must exist or be createable; source-catalog directory under it must align with where this pattern's source lives.
+2. **Read existing entries on the same shelf.** Establish format conventions, related-pattern cross-refs that already exist, naming patterns. The new entry must compose with siblings.
+3. **WebSearch for the pattern's authoritative source.** Prefer bassclef catalogs:
+   - `ux-ai/smarterpatterns/` → smarterpatterns.com
+   - `code/gof/` → refactoring.guru, sourcemaking.com, gangofour.com mirrors
+   - `code/fowler/` → martinfowler.com, refactoring.com
+   - `code/eip/` → enterpriseintegrationpatterns.com
+   - `code/posa/` → POSA volume PDFs. When the operator has not provided a file path, the skill BLOCKs and asks for the path before continuing.
+4. **WebFetch the source page.** Extract: intent, structure, when-to-use, when-NOT-to-use, example, related patterns, trade-offs.
+5. **Structure findings into catalog template.** Use `patterns/_template/catalog-entry.md` exactly. Fill every required frontmatter field; fill every required body section. Plain language; cite source URL in `source_url` and in body's "Source" section.
+6. **Write the entry** at `patterns/<shelf>/<source-catalog>/<slug>.md`. Use `name`-derived kebab-case slug consistent with the shelf's existing entries.
+7. **Validate format**: required frontmatter present, required body sections present, source URL set, no Lorem ipsum, no XXX/FIXME.
+8. **Surface output**: path written, source URL cited, related-patterns identified for cross-shelf-link follow-ups.
+
+## What NOT to do
+
+- **Don't summarize from training data without citation.** INSTEAD: WebSearch first; if no authoritative source surfaces, surface BLOCKED rather than fabricating an entry.
+- **Don't write entries for patterns that aren't in any source catalog.** If the named pattern is folk-knowledge (e.g., "the way we do things at bassclef"), that's a /promote candidate for the design/discoveries layer, not a catalog entry. INSTEAD: surface to operator, ask whether to log as a discovery.
+- **Don't invent related-patterns cross-refs.** INSTEAD: only link to entries that exist on disk OR to entries the source page explicitly references; gaps surfaced as "TODO: cross-link when sibling entry ships."
+- **Don't ship entries with `status: stub`** unless explicitly requested. The skill's job is research-to-live; stubs are an explicit lesser-output for time-boxed shaping.
+
+## Source-catalog conventions
+
+Each source catalog has its own slug/path conventions; the skill respects them:
+
+| Shelf | Source catalog | URL pattern | Example slug |
+|---|---|---|---|
+| ux-ai | smarterpatterns | smarterpatterns.com/patterns/<id>/<slug> | `algorithm-effectiveness-rating` |
+| code | gof | refactoring.guru/design-patterns/<slug> | `strategy`, `adapter` |
+| code | fowler | martinfowler.com/eaaCatalog/<slug>.html | `repository`, `unit-of-work` |
+| code | eip | enterpriseintegrationpatterns.com/patterns/messaging/<slug>.html | `message-channel`, `pipes-and-filters` |
+
+When a new shelf launches, the operator (or this skill on first invocation) declares the convention in a top-level `patterns/<shelf>/README.md`.
+
+## Acceptance
+
+- The skill scaffold loads via bassclef's harness (matches `.claude/skills/<name>/SKILL.md` shape)
+- Test fixtures (in `scripts/tests/agent-research-spawn.test.sh`) cover:
+  - Catalog template format validation
+  - Frontmatter required-fields check
+  - Body required-sections check
+  - Source-URL must be set on `ux-ai` and `code` shelves
+  - Slug-from-name normalization
+- First 5 invocations land entries on `patterns/ux-ai/smarterpatterns/` (this step's deliverables)
+
+## Composes with
+
+- `/refactor-input` (bassclef#475, future) — calls this skill when the brownfield input handler discovers a luminary or pattern gap
+- `/launch` Phase 1.5 (future) — when the chain selects a luminary whose pattern set has gaps, dispatch this skill before continuing
+- `/pattern-trace` (bassclef#478 Layer 3, future LR5) — reads catalog entries this skill produces
+
+## Distinct from
+
+- `/luminary` — browses existing luminary files; doesn't create new ones. This skill creates pattern catalog entries; luminary file creation is `/skill` work.
+- `/promote` — files bassclef-evolution tickets for substrate gaps. This skill fills the gap directly when the gap is "missing catalog entry"; for missing skills/standards, /promote is correct.
+
+## Sources read
+
+When this skill runs, it reads:
+
+- `patterns/_template/catalog-entry.md` — the format contract
+- `patterns/<shelf>/README.md` if it exists — shelf conventions
+- Existing sibling entries on the target shelf — for cross-ref patterns
+- The named pattern's authoritative web source — via WebSearch + WebFetch
+
+When this skill is documented (this file): all of the above plus bassclef#476 (parent ticket) and the catalog-template work that ships in the same PR.
+
+## Closes
+
+Filed in iteration-goal `2026-05-04d-catalog-substrate-roadmap-reconnect` (LR4) as WU-2's primary deliverable. Closes bassclef#476's primitive scope (full luminary imputation pipeline expansion deferred to LR5).
+
+## Output discipline
+
+Dispatch `/kiss words --rewrite` on your skill output before you return it. See `standards/skill-output-discipline.md` for the contract.

package/dist/lite/.claude/skills/architect-review/SKILL.md

@@ -0,0 +1,201 @@
+---
+tier: lite
+name: architect-review
+description: "Run a periodic system-level architecture review. Static pass, dynamic pass, plus a per-run coverage checklist. Fires from /longrun close, /build close, or on operator ask."
+problem: "System architecture drifts across releases. ADRs get bypassed. Static checks miss runtime rot."
+value: "A periodic architecture review that runs both static and dynamic passes. Names the drift with evidence."
+inputs: [Optional scope — full system or specific subsystem]
+outputs: [Static comprehension findings, Dynamic verification findings, Coverage report per run]
+user_invocable: true
+disable_model_invocation: false
+---
+
+# Architect Review
+
+Review the system for architecture health.
+
+<!-- FKGL-EXEMPT: this SKILL body is dense with substrate labels (CodeReviewer, /architect-review, /longrun, /build, MUST NOT, per-PR, per-architectural-period, /promote, tech_stack.kind, etc.). These labels are precision-critical vocabulary. Rewriting them out to hit grade 8-9 loses meaning. The technical procedure + comparison table + separation rules read at grade 10-13 by nature. Body reads at the ceiling by intent, not by drift. -->
+
+## When it fires
+
+- Auto-dispatch from /longrun closeout (per #1437 Step 2 wiring)
+- Auto-dispatch from /build close (same)
+- Manual on operator ask (`/architect-review`)
+- Fallback: after every 10 commits since the last review
+- Before any user-facing launch
+- After any critical security change (auth, middleware, tenant isolation)
+
+## Skip criteria (auto-dispatch only)
+
+Auto-dispatch skips when any hold. Manual runs ignore skip criteria.
+
+- Session shipped docs-only changes (no source code touched)
+- Session shipped a single-file quick-fix per `.claude/rules/quick-fix-criteria.md`
+- Session ran under 10 commits AND last review ran under 10 commits ago
+- Operator explicit-deferred at session close
+
+Silence is not deferral. Skip log the reason in the session log.
+
+## Distinct from Reviewer agent (per #1437)
+
+Two roles serve different scopes. Keep them apart.
+
+| Axis | CodeReviewer (agent) | /architect-review (skill) |
+|---|---|---|
+| Trigger | Per PR | Per architectural period |
+| Diff scope | One PR's changes | Whole codebase |
+| Stance | Adversarial — assumes Builder missed something | Comprehensive — surveys system state |
+| Model | Haiku (cheap-fast) | Whatever is loaded |
+| Cadence | Every PR in Construction to Transition | Auto-dispatch from /longrun + /build close + manual |
+| Output | Approve / request changes / block on PR | Report at `docs/architecture/reviews/YYYY-MM-DD.md` + follow-on tickets |
+
+**Overlap ban.** CodeReviewer MUST NOT run /architect-review inside a PR review. Per-PR review is tactical. Periodic review is strategic. Mixing them loses the per-PR focus AND floods system-level work at PR cadence.
+
+**Compose-with.** CodeReviewer reads OPEN /architect-review finding tickets when it reviews a PR. When a PR touches a surface a prior review flagged, CodeReviewer notes the overlap. Future /architect-review runs then sweep the still-open tickets.
+
+Sister edit at `.claude/agents/reviewer.md` line 32 — the wording moves from "Invoke /architect-review during PR evaluation" to "Reference open /architect-review findings during per-PR evaluation".
+
+## Anchor luminaries
+
+Primary — 5 lenses. Each run picks one dominant lens. Report frontmatter names the pick.
+
+- **@luminary frederick-brooks** — conceptual integrity across the system
+- **@luminary linus-torvalds** — adopter compatibility (we don't break adopters)
+- **@luminary michael-feathers** — characterization tests before recommending change to legacy code
+- **@luminary kent-beck** — TDD anchor; tests pin contracts
+- **@luminary saltzer-schroeder** — complete mediation of security surfaces
+
+Supporting lens set at `standards/architect-review-discipline.md` — hoare, hyrum-wright, ishikawa, deming, robert-c-martin, eric-evans, michael-nygard.
+
+The three verification-side lenses (feathers + beck + saltzer-schroeder) landed via goal 24c recommendation A1. Comprehension lenses alone missed the mechanism-fidelity class.
+
+## Procedure
+
+### 1. Read prior review
+
+Read the most recent report under `docs/architecture/reviews/` or `architecture/reviews/`. When the directory is missing, create it. When no prior report exists, note that as the baseline.
+
+### 2. Enumerate assessment areas from per-stack sibling
+
+Read `standards/architect-review-discipline/<stack>.md` where `<stack>` matches the adopter's `tech_stack.kind`. The sibling names the assessment areas + verification suite for the stack.
+
+When no sibling exists, use the universal areas (Step 3) and file `/promote bassclef-evolution` for the missing sibling per `.claude/rules/architect-review-discipline.md`.
+
+### 3. Static comprehension pass — check each assessment area
+
+Universal areas:
+
+- Component architecture — boundaries, cross-cutting concerns
+- Data flow — ingestion to processing to display
+- Auth + security — session, tenant isolation
+- Queue + workers — routing, failure modes
+- External dependencies — failure modes, cost
+- Error handling — silent failures, observability
+- Database — N+1, unbounded queries, missing indexes
+- Testing coverage — from Step 4 test-run actuals
+- Performance — page load, query efficiency
+- ADR fitness — are past decisions still valid?
+- CLAUDE.md fitness (see 3b)
+- SOLID + Clean Architecture per @luminary robert-c-martin
+- DDD per @luminary eric-evans
+- Stability patterns per @luminary michael-nygard
+
+**Characterization-test gate per @luminary michael-feathers.** Before recommending ANY refactor to legacy code (any module lacking tests), require that a characterization test pin current behavior first. Refactor recommendations without characterization tests ship as "edit and pray" per Feathers's anti-pattern. See `.claude/rules/testing-tier-config.md` for tier assignments.
+
+### 3b. CLAUDE.md audit
+
+- Stack section matches actual dependencies
+- Skills table lists every skill — none missing, none stale
+- Key Commands actually work
+- Key Files list reflects current codebase
+- Conventions match current practice
+- Session Protocol reflects current hooks
+- No bloat — remove anything derivable from the code itself
+
+### 4. Dynamic verification pass — per-stack sibling suite
+
+Invoke the verification suite named at `standards/architect-review-discipline/<stack>.md`. When the adopter has no sibling, run whatever verification is available and note the gap.
+
+Record: test files, passed, failed, total tests. Environment-dependent failures (missing codegen, no DB, no network) get their own section — instruct the operator to file a ticket for the environment gap when back in the native environment.
+
+Per `.claude/rules/architect-review-discipline.md`, this step MUST run. Static comprehension alone fails the two-method requirement.
+
+### 5. Per-run coverage checklist
+
+Every assessment area from Step 3 gets one of three marks:
+
+- `[x]` covered — findings recorded (or none)
+- `[~]` deferred — reason stated in one line
+- `[SKIP]` not applicable — reason stated in one line
+
+Silence is not deferral. An unmarked area is a compliance failure per `.claude/rules/architect-review-discipline.md` A4.
+
+### 6. Classify findings per severity
+
+Trivial / moderate / significant. Default when unclassified is MODERATE per Saltzer-Schroeder fail-safe defaults. Trivial requires explicit rationale.
+
+### 7. Write the report
+
+Path: `docs/architecture/reviews/YYYY-MM-DD.md` or `architecture/reviews/YYYY-MM-DD.md`.
+
+Required sections:
+
+- Frontmatter: `primary_lens`, date, prior review path, coverage checklist link
+- Verdict: READY / NOT READY
+- Critical blockers (must fix)
+- High / medium / low findings
+- Component map (Mermaid, when substantive)
+- Test coverage assessment (actuals from Step 4)
+- Environment-dependent failures (from Step 4)
+- ADR fitness check
+- CLAUDE.md fitness — what was stale, what was fixed
+- SOLID + DDD + Stability findings per anchors
+- Coverage checklist (per Step 5)
+- Recommendations by priority
+
+### 8. Create tickets for every moderate+ finding
+
+One ticket per moderate+ finding. Not optional. Each ticket carries:
+
+- Finding classification (moderate / significant)
+- Primary lens applied
+- Characterization-test requirement (per Step 3 gate) when the fix touches legacy code
+- Link back to the review report
+
+Trivial findings note in the report; no ticket.
+
+### 9. Commit
+
+Report + coverage marker + finding-ticket references ship in one commit. Commit body cites the coverage checklist marks + finding counts by severity.
+
+### 10. Return summary
+
+One-line summary to caller — verdict + finding counts + ticket count + coverage marks.
+
+Example: `NOT READY — 2 significant, 5 moderate, 3 trivial; 7 tickets filed; coverage 12/13 covered + 1 deferred (docs-only area)`.
+
+## Write scope (per Saltzer-Schroeder least privilege)
+
+/architect-review writes to three surfaces only:
+
+- `docs/architecture/reviews/YYYY-MM-DD.md` or `architecture/reviews/YYYY-MM-DD.md` — the report
+- `gh issue create` — finding tickets (Step 8)
+- `state/markers/architect-review/YYYY-MM-DD.marker` — coverage audit trail
+
+Everything else is read-only. When a skill dispatched under /architect-review needs to write elsewhere, escalate to operator — do not silently expand write scope.
+
+## Output discipline
+
+Dispatch `/kiss words --rewrite` on the summary output before returning. See `standards/skill-output-discipline.md` for the contract.
+
+## Refs
+
+- `.claude/rules/architect-review-discipline.md` — two-method requirement + coverage-checklist enforcement
+- `.claude/rules/testing-tier-config.md` — tier assignments for characterization-test gate
+- `.claude/agents/reviewer.md` — sister agent; line 32 amended per this SKILL's separation section
+- `architecture/audits/2026-06-27-audit-method-blind-spot.md` — recursive Act phase motivating verification-side lens
+- `architecture/consultations/2026-08-30-architect-review-clarity.md` — 5 HIGH cures applied here
+- ADR-035 substrate-as-system — the tenet this SKILL operationalizes
+- sunj-labs/bassclef-upstream#1437 — parent ticket
+
+<!-- /FKGL-EXEMPT -->

package/dist/lite/.claude/skills/auto-fix/SKILL.md

@@ -0,0 +1,297 @@
+---
+tier: lite
+name: auto-fix
+description: "Autonomous fix lane for narrow non-trivial bugs. Orchestrator drives full /diagnose then a Builder writes the fix, then /verify runs, then a PR opens. Operator merges. Refuses auth, middleware, schema, security, tenant, or prod-infra."
+problem: "Narrow bugs get patched with quick edits. Root cause gets skipped. Regressions come back."
+value: "Autonomous fix lane for non-trivial narrow bugs. Runs full /diagnose before writing any fix."
+inputs: [A failing test or error log or bug ticket]
+outputs: [/diagnose evidence, Fix commit, Verify report]
+user_invocable: true
+disable_model_invocation: false
+---
+
+# /auto-fix — Autonomous Fix Lane
+
+Bassclef's answer to "I trust the agent on this code area and want
+the full diagnosis ceremony without writing it myself."
+
+Full /diagnose runs. Builder writes the fix. /verify runs. PR opens.
+Operator reviews + merges. Governance preserved; ceremony cost carried
+by the agent instead of the operator.
+
+## Entry criteria (ALL must hold)
+
+1. **Narrow scope** — defect expressible as one concern. "The scraper
+   times out on large payloads" is narrow. "The API is slow" is not.
+2. **Named code area** — operator can name a file, module, or route
+   where the defect lives. Agent verifies by reading that area first.
+3. **NOT in blast-radius floor** — hard floor (see below). Anything
+   in the floor forces manual /diagnose or /quick-fix (for trivial cases).
+4. **Builder agent available** — `.claude/agents/Builder.md` exists
+   and is configured. If Builder is unreachable, degrade to operator-
+   in-loop /diagnose.
+5. **Clear acceptance criteria** — one sentence stating how you'll
+   know the fix worked. This is non-optional. Without it, /verify
+   has nothing to measure against.
+
+Any failure → escalate to full /diagnose (operator writes) or
+/quick-fix (if trivial).
+
+## Blast-radius floor (HARD — no override)
+
+These paths ALWAYS force manual lane, regardless of other criteria:
+
+- **Auth**: `src/lib/auth/**`, `src/app/api/auth/**`,
+  `src/middleware.ts` where auth logic lives
+- **Schema**: `prisma/schema.prisma`, `prisma/migrations/**`
+- **Security**: `src/lib/security/**`, crypto/signing/token-handling code
+- **Tenant**: any tenant-scoped query or tenant-context resolution
+- **Middleware**: any file matching `middleware.ts` (auth or not —
+  middleware has system-wide effect)
+- **Production infrastructure**: `.github/workflows/deploy*.yml`,
+  production env var configuration, CDN/DNS config
+
+Rationale: autonomous fixes in these areas produce silent failures
+that affect every user, every request, or the entire deploy pipeline.
+The blast radius justifies always asking a human.
+
+There is NO `SKIP_BLAST_RADIUS` override for /auto-fix. If you need
+to fix these areas autonomously, the right answer is to widen the
+blast-radius discussion (ADR), not bypass the floor.
+
+## When to use
+
+- API route bug in a specific endpoint
+- Scraper logic defect in a named scraper
+- Background worker processing a specific queue with wrong behavior
+- Data transformation bug in a pure function
+- CLI command with a wrong flag interpretation
+- UI component with a specific interaction bug (non-auth, non-admin)
+
+## When NOT to use
+
+- Anything in blast-radius floor (see above)
+- Defects spanning multiple concerns (fix-this-and-that)
+- Defects that might require interface changes or new abstractions
+  (use /decompose + normal Construction)
+- Intermittent failures with unknown repro — these belong in full
+  operator-led /diagnose
+
+## Usage
+
+```
+/auto-fix [issue-ref]                → with issue context
+/auto-fix for "description" in <path> → freeform scope + path
+```
+
+## Procedure
+
+### Step 1: Entry-criteria self-check
+
+State explicitly which criteria hold:
+
+```
+## /auto-fix entry check
+- Narrow scope? ✅ / ❌
+- Named code area? ✅ / ❌ (path: ...)
+- NOT in blast-radius floor? ✅ / ❌ (if ❌, ABORT)
+- Builder agent available? ✅ / ❌
+- Clear acceptance criteria? ✅ / ❌ (statement: ...)
+
+If any ❌ → escalate; if all ✅ → proceed
+```
+
+If blast-radius floor fires, STOP immediately and escalate to manual
+lane. Do NOT proceed; do NOT negotiate.
+
+### Step 2: Full /diagnose ceremony
+
+Orchestrator invokes /diagnose with the full Steps 0-4 procedure:
+
+- Step 0: Reproduce (establish repro command/URL; no skip in /auto-fix)
+- Step 1: Gather evidence (logs, recent commits, health)
+- Step 2: Is / Is Not (+ Resolution Chain if layered system)
+- Step 3: Five Whys
+- Step 4: Hypothesis + falsifiable test
+
+Output lands in the session conversation; no new file produced.
+Reason: /diagnose output is input to Step 3; making it an artifact
+is premature unless the fix is non-trivial enough to warrant a
+decomposition (that path uses /decompose, not /auto-fix).
+
+### Step 3: Orchestrator dispatches Builder
+
+Orchestrator routes to Builder agent with:
+
+- Issue reference (if any)
+- Full /diagnose output (repro + is/is not + five whys + hypothesis)
+- Acceptance criteria (from entry check)
+- Blast-radius floor reminder (Builder double-checks before writing)
+- Scope lock: one file + its tests, or one named function + caller
+  updates. Anything broader requires escalation.
+
+Builder MUST:
+
+- Confirm blast-radius floor compliance before first edit
+- Run /temperance before first edit (standard gate)
+- Write the minimum fix matching the hypothesis
+- Write/update tests matching the acceptance criteria
+- Run /verify after the edit
+- Produce commit with `[auto-fix]` footer
+
+Builder MUST NOT:
+
+- Broaden scope beyond the one concern (no "while I'm here, let me
+  also fix X")
+- Introduce new interfaces, abstractions, or decorators (that's
+  /decompose territory)
+- Touch blast-radius floor paths (immediate abort)
+- Skip /verify
+- Auto-merge the PR
+
+### Step 4: /verify (change-type-matched)
+
+Standard /verify runs per the skill. Full production build, full test
+suite for the change type. Markers written to both `/tmp` and
+`state/markers/verify/`.
+
+If /verify fails, /auto-fix STOPS. Builder does not retry silently —
+the failure is surfaced, a human decides next step. Auto-retry is
+the path to silently shipping wrong fixes that happen to pass some
+checks but not others.
+
+### Step 5: PR open with audit marker
+
+PR title: `fix: [description] (#NNN)`
+PR body includes:
+
+- Summary of diagnosis (repro + cause + fix)
+- Acceptance criteria verification
+- /verify output summary
+- `[auto-fix]` marker in body
+
+Commit footer:
+
+```
+[auto-fix] — diagnosed via full /diagnose; Builder-written; /verify
+passed. Orchestrator-dispatched.
+
+Closes #NNN
+```
+
+Auditing ratio of /auto-fix usage parallels /quick-fix:
+
+```bash
+git log --all --oneline --since='30 days ago' --grep='\[auto-fix\]' | wc -l
+```
+
+Target ratio relative to all fix branches: ≤25%. Higher ratio = either
+Builder is being used where manual judgment was needed, or the mix
+of defects is systematically narrow (suggesting upstream architectural
+issue).
+
+### Step 6: Operator reviews + merges
+
+Operator reviews PR:
+
+- Does the diagnosis match the observed defect?
+- Does the fix address the root cause (Five Whys endpoint), not just
+  the symptom?
+- Does /verify evidence confirm the acceptance criteria?
+- Any blast-radius concern the agent missed?
+
+Operator merges. Never auto-merge — the merge step is always human.
+
+## Output format
+
+```markdown
+## /auto-fix — [short description]
+
+### Sources read
+- [issue ref, repo files, relevant docs]
+
+### Entry-criteria check
+- Narrow scope? ✅ — [scope statement]
+- Named code area? ✅ — [path]
+- NOT in blast-radius floor? ✅ — [confirmed path is outside floor]
+- Builder agent available? ✅
+- Clear acceptance criteria? ✅ — [acceptance statement]
+
+### Full diagnosis (/diagnose output)
+[Step 0 Reproduce, Step 1 Evidence, Step 2 Is/Is Not, Step 3 Five
+Whys, Step 4 Hypothesis + Test]
+
+### Builder dispatch
+[Brief: what Builder was given, what scope lock applies]
+
+### Fix
+[Applied via Builder — one-file or tight-scope change]
+
+### Verify evidence
+[/verify output summary]
+
+### PR
+[#NNN — ready for operator review]
+
+### [auto-fix] audit footer
+Confirmed; diagnosed via full /diagnose; Builder-written;
+/verify passed.
+```
+
+## Rules
+
+- Blast-radius floor is a HARD floor. No override in /auto-fix.
+- Full /diagnose is MANDATORY. No compression (that's /quick-fix).
+- Builder writes, Orchestrator dispatches, Operator merges. No
+  auto-merge.
+- /verify is MANDATORY. Failure stops the workflow; no silent retry.
+- Scope lock: one concern, one file (or tight equivalent). Anything
+  broader requires /decompose and normal Construction.
+- `[auto-fix]` audit footer is MANDATORY. Enables ratio audit.
+
+## Relationship to other skills
+
+| Skill | Relationship |
+|-------|-------------|
+| `/diagnose` | /auto-fix invokes full /diagnose as Step 2 — no compression |
+| `/quick-fix` | Sibling (compressed, operator-in-loop); /auto-fix is full-ceremony autonomous |
+| `/verify` | /auto-fix invokes /verify as Step 4 — mandatory |
+| `/decompose` | If the fix reveals cross-cutting concern, halt /auto-fix and go through /decompose first |
+| `/temperance` | Builder fires /temperance before first edit, per standard gate |
+
+## Common pitfalls
+
+- **Scope creep inside Builder** — "while I'm here, let me also fix X."
+  Explicitly prohibited. Scope lock is load-bearing.
+- **Silent blast-radius violation** — agent notices the target path
+  touches middleware but writes the fix anyway "because it seemed
+  narrow." Floor is HARD. Abort, don't negotiate.
+- **Auto-merge temptation** — /verify passed, PR opened, "why not
+  merge?" Operator merge is the final gate. Skip it and you've built
+  a bypass around the hardest guardrail.
+- **Skipping /diagnose** — "the cause is obvious from the repro." If
+  it's that obvious, /quick-fix is the right tool. /auto-fix always
+  runs full /diagnose.
+
+## Why this skill exists
+
+Today bassclef operators have two fix lanes:
+
+- Full /diagnose + operator writes the fix (expensive for non-trivial
+  narrow bugs where the operator trusts the agent)
+- Drop to Claude Code `/bugfix` (opaque; no bassclef governance;
+  the agent can do whatever it wants)
+
+Neither is right for "narrow, non-trivial, operator trusts the agent
+on this area." That case needs full ceremony + autonomous execution
++ hard blast-radius floors. That's /auto-fix.
+
+The `[auto-fix]` audit marker plus the hard floor means the skill
+cannot drift into handling the cases it shouldn't — the floor is
+mechanical, the ratio is observable.
+
+Closes bassclef #152. Part of fix-workflow family 2026-04-16d.
+
+## Output discipline
+
+Dispatch `/kiss words --rewrite` on your skill output before you return it. See `standards/skill-output-discipline.md` for the contract.