@thebassclef/lite 1.9.7 → 1.9.9

package/dist/lite/.claude/skills/build/SKILL.md

@@ -330,14 +330,25 @@ Parse the validated goal's structure:
 ```bash
 # Already have BET_JSON, SPEC_PATH, DECOMP_PATH, UX_MIG_PATH from Phase 0
 # Read spec body for step enumeration. Per bassclef#367, spec MUST have
-# the exact heading `## Steps enumerated` (pinned in /spec SKILL.md
-# rules + templates/spec-template.md). /launch's Phase 9
-# emits this heading by contract. Specs that lack the section → exit 4.
+# the heading `## Steps enumerated` (pinned in /spec SKILL.md rules +
+# templates/spec-template.md). /launch's Phase 9 emits this heading by
+# contract. Specs that lack the section → exit 4.
+#
+# Finding #2 + #3 cure (#2036): the previous awk range
+# `/^## Steps enumerated/,/^## /` closed on its own start line because
+# `^## ` matches `^## Steps enumerated`. Flag-based extraction fixes it.
+# Grace window per ADR-040 D1 (through 2026-10-31): accept both the new
+# "Steps enumerated" / "### Step-N" and the historical "Workunits
+# enumerated" / "### WU-N" headings so legacy specs still build.
 SPEC_FILE="docs/specs/${SPEC_PATH}.md"
-WU_LIST=$(awk '/^## Steps enumerated/,/^## /' "$SPEC_FILE" | grep -E '^### WU-')
+WU_LIST=$(awk '
+  /^## (Steps|Workunits) enumerated/ { in_section=1; next }
+  /^## / { in_section=0 }
+  in_section
+' "$SPEC_FILE" | grep -E '^### (Step|WU)-')
 
-# Each WU should reference at least one story (US-NNN)
-WU_COUNT=$(echo "$WU_LIST" | grep -c '^### WU-' || echo 0)
+# Each step should reference at least one story (US-NNN)
+WU_COUNT=$(echo "$WU_LIST" | grep -cE '^### (Step|WU)-' || echo 0)
 ```
 
 Build structured object: `{ bet, spec_path, decomp_path, ux_migration_path, wus[] }`.
@@ -348,7 +359,8 @@ Verify each step traces to at least one story. Refuse if any step lacks
 story traceability.
 
 ```bash
-ORPHAN_WUS=$(echo "$WU_LIST" | grep -v 'US-' || true)
+# Keep only step headings; drop body lines before the US-NNN check.
+ORPHAN_WUS=$(echo "$WU_LIST" | grep -E '^### (Step|WU)-' | grep -v 'US-' || true)
 if [ -n "$ORPHAN_WUS" ]; then
   echo "/build: step enumeration lacks story traceability (bassclef#358 violation)" >&2
   echo "Orphan steps (no US-NNN ref):" >&2

package/dist/lite/.claude/skills/onboard-repo/SKILL.md

@@ -462,9 +462,28 @@ immediately without waiting for a sync cycle.
 
 ##### 1.2 Protect main from force-push and deletion
 
+**Heads up — GitHub free-tier adopters on PRIVATE repos:** the API call
+below returns HTTP 403 ("Upgrade to GitHub Pro or make this repository
+public") on free-tier accounts, because branch protection is a paid
+feature for private repos. Public repos get branch protection on every
+plan, free included. Pick a path below BEFORE running the call.
+
+Three ways to clear this step:
+
+1. **Make the repo public** — simplest; free plan includes branch
+   protection on public repos. Good fit when the code is open source
+   or ships to adopters anyway.
+2. **Upgrade the GitHub plan** — Pro / Team / Enterprise includes
+   branch protection on private repos.
+3. **Skip the API call** — rely on local safety (no `git push --force`
+   habits, PR review, pre-commit hooks). Mark the repo config so later
+   phases know branch protection is operator-managed, not substrate-
+   managed. See the fallback block below.
+
 ```bash
 DEFAULT_BRANCH=$(gh repo view "$REPO" --json defaultBranchRef -q '.defaultBranchRef.name')
 
+# Pro / public-repo path — run the API call.
 gh api "repos/$REPO/branches/$DEFAULT_BRANCH/protection" \
   --method PUT \
   --input - <<EOF
@@ -484,6 +503,28 @@ required here — agent-created PRs (bassclef-sync) need to merge
 without human intervention for the mobile-sync story. Add stricter
 rules per-repo in `.github/branch-protection.yml` if the repo warrants.
 
+**Free-tier private-repo fallback (path 3 above).** If the API
+returned 403 and the operator picked "skip and manage locally":
+
+```bash
+# Record the choice so later audits know main is not API-protected.
+mkdir -p .claude
+cat >> .claude/onboard-notes.md <<'NOTE'
+## Branch protection — operator-managed
+
+GitHub free-tier does not include branch protection on private repos.
+This repo relies on:
+- Local discipline: no `git push --force` to main.
+- PR review before merge.
+- Pre-commit hooks shipped by bassclef.
+
+Revisit if the repo moves to public, or the plan upgrades to Pro+.
+NOTE
+```
+
+The adopter can revisit this step after switching to public OR
+upgrading the plan.
+
 ##### 1.3 Add the production approval gate (if this repo deploys to prod)
 
 If the repo will deploy to production, per `manual-prod-approval.md`:

package/dist/lite/.claude/skills/release-notes/SKILL.md

@@ -108,6 +108,30 @@ Rules for external notes:
 - No feature names that aren't visible to users
 - Test: could someone who's never seen the codebase understand this?
 
+### 3.5. Run `/ogilvy-writing-audit` on each body
+
+Before saving the drafted bodies to disk, run `/ogilvy-writing-audit`
+on each one. The skill scans against Ogilvy + Roman-Raphaelson's
+rules (see `standards/ogilvy-writing-rules.md`) and returns
+severity-tagged findings.
+
+```bash
+/ogilvy-writing-audit docs/release-notes/YYYY-MM-DD-internal.md
+/ogilvy-writing-audit docs/release-notes/YYYY-MM-DD-external.md
+```
+
+Fix every 🔴 and 🟡 finding before step 4. When a 🟡 ships without
+a fix, cite the audit in the commit body and name why.
+
+Why this step. Release notes land in reader surfaces that must read
+clean — the GitHub Release artifact plus the Google Doc the team
+reviews. Jargon and grade-13 prose creep in without a mechanical
+check. PR #408 ran this discipline by hand across 8 entries, and
+PR #412 formalizes it so every future entry inherits the floor.
+
+Cross-ref: `.claude/rules/session-artifacts.md` §Release notes names
+this step as the discipline anchor.
+
 ### 4. Save locally
 
 ```

package/dist/lite/bassclef-version.json

@@ -1,7 +1,7 @@
 {
-  "version": "v1.6.4",
-  "marker_tag": "release-2026-09-28-21212e17",
-  "release_date": "2026-09-28T01:33:41Z",
-  "release_sha": "21212e17",
-  "release_tag": "release-2026-09-28-21212e17"
+  "version": "v1.6.6",
+  "marker_tag": "release-2026-10-03-89ceaa15",
+  "release_date": "2026-10-03T10:51:10Z",
+  "release_sha": "89ceaa15",
+  "release_tag": "release-2026-10-03-89ceaa15"
 }

package/dist/lite/gitignore

@@ -31,6 +31,14 @@ state/luminary-implementations/
 .claude/hooks/logs/
 .claude/hooks/*.trace
 
+# SDLC traces (operator-private; runtime artifacts carry operator paths)
+# Per #2036 Finding #1 (adopter report 2026-10-02) — auto-save was
+# committing /Users/<name>/ paths to adopter git every fire. Shipping this
+# line stops future adopter installs from leaking. Existing installs run
+# `git rm --cached -r docs/sdlc-traces/` one time to untrack files
+# already in history.
+docs/sdlc-traces/
+
 # Build output
 dist/
 

package/dist/lite/lib/deferred-actions.sh

@@ -72,9 +72,9 @@ _da_resolve_path() {
 da_get_field() {
   local id="$1"
   local field="$2"
-  local path
-  path="$(_da_resolve_path "$id")"
-  [[ -f "$path" ]] || { echo "not-found: $path" >&2; return 1; }
+  local p
+  p="$(_da_resolve_path "$id")"
+  [[ -f "$p" ]] || { echo "not-found: $p" >&2; return 1; }
   # Read frontmatter only (between two `---` lines)
   awk -v f="$field" '
     BEGIN { in_fm = 0; seen_open = 0 }
@@ -89,7 +89,7 @@ da_get_field() {
       print
       exit
     }
-  ' "$path"
+  ' "$p"
 }
 
 da_resolve() {

package/dist/lite/lib/fixture-builder.sh

@@ -82,16 +82,16 @@ fixture_cleanup() {
   if [ "${SKIP_FIXTURE_BUILDER:-0}" = "1" ]; then
     return 0
   fi
-  local path="${1:?fixture_cleanup requires path}"
-  if [ ! -e "$path" ]; then
+  local p="${1:?fixture_cleanup requires path}"
+  if [ ! -e "$p" ]; then
     # Idempotent — nothing to do
     return 0
   fi
-  if [ ! -f "$path/$_FIXTURE_SENTINEL" ]; then
-    echo "fixture_cleanup: refusing to remove path without sentinel: $path" >&2
+  if [ ! -f "$p/$_FIXTURE_SENTINEL" ]; then
+    echo "fixture_cleanup: refusing to remove path without sentinel: $p" >&2
     return 1
   fi
-  rm -rf "$path"
+  rm -rf "$p"
   return 0
 }
 
@@ -105,10 +105,10 @@ fixture_cleanup_all() {
     return 0
   fi
   local IFS=$'\n'
-  local path
-  for path in $_FIXTURE_REGISTRY; do
-    [ -n "$path" ] || continue
-    fixture_cleanup "$path" 2>/dev/null || true
+  local p
+  for p in $_FIXTURE_REGISTRY; do
+    [ -n "$p" ] || continue
+    fixture_cleanup "$p" 2>/dev/null || true
   done
   _FIXTURE_REGISTRY=""
 }

package/dist/lite/lib/identifier-leak-check.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# tier: lite
+# Operator-identifier leak check for staged git content.
+#
+# Shared across:
+#   - .claude/hooks/save-state.sh (inline before `git commit`;
+#     bypasses pre-commit-gate.sh because save-state runs git
+#     directly, not through the agent's PreToolUse path)
+#   - future: .claude/hooks/pre-commit-gate.sh CCF-3 (unification
+#     deferred to a follow-on; shape intentionally matches CCF-3
+#     today so the two can merge without semantic drift)
+#
+# Rejects staged content carrying absolute operator paths matching
+# /Users/<name>/ or /home/<name>/. Mirrors pre-commit-gate.sh:50-53
+# exemptions so policy docs that quote the pattern don't trip.
+#
+# Per #2036 Finding #1 (adopter report 2026-10-02).
+# Per @luminary nygard — stability pattern (circuit breaker on commit).
+# Per @luminary hoare — precondition contract before `git commit`.
+
+# check_staged_for_leaks — scan git-staged content for operator paths.
+#
+# Returns 0 when staged content is clean OR when every leaking file
+# sits in an exempt path (policy docs, rules, luminaries).
+# Returns 1 when staged content outside exempt paths carries a leak.
+# On exit 1, every leaking file is named on stderr with line number
+# and the matched pattern.
+check_staged_for_leaks() {
+  # Staged non-exempt files. Match pre-commit-gate.sh:46-53 exemption shape
+  # so the two gates agree on which paths carry policy docs legitimately
+  # quoting operator paths.
+  local staged
+  staged=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | \
+    grep -vE '^\.claude/(rules|hooks|skills|luminaries|agents)/' | \
+    grep -vE '^standards/' | \
+    grep -vE '^architecture/' | \
+    grep -vE '^design/' | \
+    grep -vE '^docs/standards/' | \
+    grep -vE '^docs/rules/' | \
+    grep -vE '^chronicle/' | \
+    grep -vE '^strategy/' | \
+    grep -vE '^scripts/tests/' || true)
+
+  [ -z "$staged" ] && return 0
+
+  local leaked=""
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    [ ! -f "$f" ] && continue
+    local matches
+    matches=$(grep -nE '/Users/[A-Za-z0-9_.-]+|/home/[A-Za-z0-9_.-]+' "$f" 2>/dev/null || true)
+    if [ -n "$matches" ]; then
+      leaked="${leaked}
+  ${f}:
+${matches}
+"
+    fi
+  done <<< "$staged"
+
+  if [ -n "$leaked" ]; then
+    {
+      echo ""
+      echo "============================================"
+      echo "BLOCKED: operator path in staged content (#2036 Finding #1)"
+      echo "============================================"
+      echo "$leaked"
+      echo ""
+      echo "Operator-specific paths (/Users/<name>, /home/<name>) must NOT"
+      echo "ship in adopter git. Common cause: docs/sdlc-traces/*.log"
+      echo "carrying absolute paths from PreToolUse hook callers."
+      echo ""
+      echo "Fixes:"
+      echo "  1. Delete the staged file if it's a trace log auto-generated"
+      echo "     (gitignored going forward per #2036 Finding #1 cure)"
+      echo "  2. Rewrite the path as repo-relative"
+      echo "  3. Move policy docs under docs/standards/ or docs/rules/ (exempt)"
+      echo ""
+      echo "Policy: standards/two-layer-config.md (bassclef#740)"
+      echo "============================================"
+    } >&2
+    return 1
+  fi
+
+  return 0
+}

package/dist/lite/lib/preview-state.sh

@@ -49,14 +49,14 @@ ps_exists() {
 
 ps_create() {
   local slug="$1"
-  local path
-  path="$(ps_path "$slug")"
-  mkdir -p "$(dirname "$path")"
-  if [[ -f "$path" ]]; then
-    echo "ps_create: already exists: $path" >&2
+  local p
+  p="$(ps_path "$slug")"
+  mkdir -p "$(dirname "$p")"
+  if [[ -f "$p" ]]; then
+    echo "ps_create: already exists: $p" >&2
     return 1
   fi
-  cat > "$path" <<EOF
+  cat > "$p" <<EOF
 slug: ${slug}
 created: $(date -u +'%Y-%m-%dT%H:%M:%S+0000')
 current_tier: pending
@@ -73,16 +73,16 @@ EOF
 ps_get() {
   local slug="$1"
   local field="$2"
-  local path
-  path="$(ps_path "$slug")"
-  [[ -f "$path" ]] || { echo "ps_get: not-found: $path" >&2; return 1; }
+  local p
+  p="$(ps_path "$slug")"
+  [[ -f "$p" ]] || { echo "ps_get: not-found: $p" >&2; return 1; }
   awk -v f="$field" '
     $0 ~ "^" f ":" {
       sub("^" f ":[[:space:]]*", "")
       print
       exit
     }
-  ' "$path"
+  ' "$p"
 }
 
 ps_set() {
@@ -90,9 +90,9 @@ ps_set() {
   local field="$2"
   shift 2
   local value="$*"
-  local path
-  path="$(ps_path "$slug")"
-  [[ -f "$path" ]] || { echo "ps_set: not-found: $path" >&2; return 1; }
+  local p
+  p="$(ps_path "$slug")"
+  [[ -f "$p" ]] || { echo "ps_set: not-found: $p" >&2; return 1; }
   local tmp
   tmp="$(mktemp)"
   awk -v f="$field" -v v="$value" '
@@ -108,8 +108,8 @@ ps_set() {
         print f ": " v
       }
     }
-  ' "$path" > "$tmp"
-  mv "$tmp" "$path"
+  ' "$p" > "$tmp"
+  mv "$tmp" "$p"
 }
 
 ps_status() {
@@ -146,9 +146,9 @@ ps_archive() {
 ps_reset() {
   local slug="$1"
   local reason="${2:-no reason given}"
-  local path
-  path="$(ps_path "$slug")"
-  [[ -f "$path" ]] || { echo "ps_reset: not-found: $path" >&2; return 1; }
+  local p
+  p="$(ps_path "$slug")"
+  [[ -f "$p" ]] || { echo "ps_reset: not-found: $p" >&2; return 1; }
 
   local now
   now="$(date -u +'%Y-%m-%dT%H:%M:%S+0000')"
@@ -188,8 +188,8 @@ EOF
       next
     }
     { print }
-  ' "$path" > "$tmp"
-  mv "$tmp" "$path"
+  ' "$p" > "$tmp"
+  mv "$tmp" "$p"
   rm -f "$entry_file"
 
   # Reset cycle-state fields

package/dist/lite/lib/skip-env-inline-check.sh

@@ -0,0 +1,61 @@
+#!/bin/bash
+# tier: lite
+# SKIP_* env-reach check for PreToolUse Bash hooks.
+#
+# Per #2036 Finding #4 — adopter report 2026-10-02.
+#
+# PreToolUse Bash hooks run in Claude Code's process env. The agent's
+# `SKIP_FOO=1 git commit ...` recipe sets FOO in the git subshell's env,
+# not the hook's env. Hooks that only read `${SKIP_FOO:-0}` miss the
+# inline override and the recipe lies to the adopter.
+#
+# This helper parses tool_input.command for inline `SKIP_FOO=1` and
+# falls back to process env. The adopter's natural recipe
+# `SKIP_FOO=1 cmd` now works regardless of harness env propagation.
+#
+# Retirement path: once Claude Code harness guarantees inline-env
+# propagation to hook subprocesses, this helper becomes redundant.
+# Comment stays as the audit trail.
+#
+# Usage:
+#   source "$CLAUDE_PROJECT_DIR/lib/skip-env-inline-check.sh"
+#   COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+#   if skip_var_set "SKIP_FOO" "$COMMAND"; then
+#     # bypass
+#     exit 0
+#   fi
+#
+# Anchors:
+#   @luminary john-ousterhout — deep module; narrow interface
+#   @luminary david-parnas — information hiding; consumer-free of mechanism
+#   @luminary alan-cooper — adopter-goal reliable override recipe
+
+# skip_var_set — return 0 if the named SKIP_* var is set to "1".
+# Checks two sources:
+#   1. Inline prefix in command string: `SKIP_FOO=1 cmd...`
+#   2. Fallback: process env `$SKIP_FOO`
+# Returns 1 otherwise.
+#
+# Args:
+#   $1 — var name (e.g., "SKIP_OPERATOR_PATHS")
+#   $2 — command string (from tool_input.command)
+skip_var_set() {
+  local var_name="$1"
+  local cmd="$2"
+
+  # Source 1 — inline prefix. The pattern anchors on word boundary (start
+  # of string or whitespace) and requires =1 followed by whitespace or
+  # end-of-string. This matches bash's own parsing of inline env prefix.
+  if [ -n "$cmd" ]; then
+    if echo "$cmd" | grep -qE "(^|[[:space:]])${var_name}=1([[:space:]]|$)"; then
+      return 0
+    fi
+  fi
+
+  # Source 2 — process env fallback (works where harness propagates env).
+  if [ "$(eval "echo \"\${${var_name}:-0}\"")" = "1" ]; then
+    return 0
+  fi
+
+  return 1
+}

package/dist/lite/lib/state.sh

@@ -186,17 +186,19 @@ __state_atomic_write() {
 # crash caller).
 __state_yaml_write() {
   __state_check_binary_deps || return 4
-  local path="$1"
+  # Finding #6 (#2036): `local path` is a zsh-magic variable name — ties to
+  # $PATH when sourced from zsh. Renamed to `local p` throughout this file.
+  local p="$1"
   local field="$2"
   local value="$3"
-  if [ -z "$path" ] || [ -z "$field" ]; then
+  if [ -z "$p" ] || [ -z "$field" ]; then
     echo "__state_yaml_write: requires <path> <field> <value>" >&2
     return 2
   fi
   local dir
-  dir="$(dirname "$path")"
+  dir="$(dirname "$p")"
   [ -d "$dir" ] || mkdir -p "$dir" || return 4
-  local tmp="${path}.tmp.$$"
+  local tmp="${p}.tmp.$$"
   BASSCLEF_YAML_FIELD="$field" \
   BASSCLEF_YAML_VALUE="$value" \
   BASSCLEF_YAML_TMP="$tmp" \
@@ -213,7 +215,7 @@ except Exception as e:
     print(f"__state_yaml_write: safe_dump failed: {e}", file=sys.stderr)
     sys.exit(3)
 ' 2>&1 || { rm -f "$tmp"; return 3; }
-  mv "$tmp" "$path" || { rm -f "$tmp"; return 4; }
+  mv "$tmp" "$p" || { rm -f "$tmp"; return 4; }
 }
 
 # === Whereami (Shape A — JSON authoritative + markdown rendered) ===
@@ -239,21 +241,22 @@ state_whereami_get() {
 state_whereami_set() {
   local field="$1"
   local value="$2"
-  local path="docs/whereami.json"
+  local p="docs/whereami.json"
   if [ -z "$field" ] || [ -z "$value" ]; then
     echo "state_whereami_set: requires <field> <value>" >&2
     return 2
   fi
-  if [ ! -f "$path" ]; then
+  if [ ! -f "$p" ]; then
     echo "state_whereami_set: docs/whereami.json does not exist" >&2
     return 4
   fi
   local updated
-  # Use jq's setpath for nested field paths (e.g., 'phase.value')
+  # Use jq's setpath for nested field paths (e.g., 'phase.value').
+  # The jq `--arg path` names a jq variable (not shell) — safe to keep.
   updated="$(jq --arg path "$field" --arg val "$value" '
     setpath($path | split("."); $val)
-  ' "$path")" || return 3
-  __state_atomic_write "$path" "$updated"
+  ' "$p")" || return 3
+  __state_atomic_write "$p" "$updated"
 }
 
 # === IterationBet (Shape B — markdown + YAML frontmatter + body) ===
@@ -264,11 +267,11 @@ state_iteration_bet_get() {
     echo "state_iteration_bet_get: requires <slug>" >&2
     return 2
   fi
-  local path="docs/iteration-bets/${slug}.md"
-  if [ ! -f "$path" ]; then
+  local p="docs/iteration-bets/${slug}.md"
+  if [ ! -f "$p" ]; then
     return 1
   fi
-  __state_yq2json "$path"
+  __state_yq2json "$p"
 }
 
 # Special-purpose: returns the single active iteration bet (status=active),
@@ -333,25 +336,25 @@ state_roadmap_get() {
     echo "state_roadmap_get: requires <slug>" >&2
     return 2
   fi
-  local path="docs/roadmaps/${slug}.md"
-  if [ ! -f "$path" ]; then
+  local p="docs/roadmaps/${slug}.md"
+  if [ ! -f "$p" ]; then
     return 1
   fi
-  __state_yq2json "$path"
+  __state_yq2json "$p"
 }
 
 # Internal: rewrite a roadmap's frontmatter from JSON, preserving the body.
 __state_roadmap_write_frontmatter() {
   local slug="$1"
   local frontmatter_json="$2"
-  local path="docs/roadmaps/${slug}.md"
-  if [ ! -f "$path" ]; then
-    echo "__state_roadmap_write_frontmatter: roadmap $path not found" >&2
+  local p="docs/roadmaps/${slug}.md"
+  if [ ! -f "$p" ]; then
+    echo "__state_roadmap_write_frontmatter: roadmap $p not found" >&2
     return 1
   fi
   python3 -c "
 import sys, yaml, json
-path = '$path'
+path = '$p'
 fm = json.loads('''$frontmatter_json''')
 with open(path, 'r') as f:
     content = f.read()
@@ -726,15 +729,15 @@ state_chronicle_gate_evidence() {
     return 2
   fi
   # Try bassclef (chronicle/) and consumer-repo (docs/chronicle/) paths
-  local path=""
+  local p=""
   if [ -f "chronicle/${id}.md" ]; then
-    path="chronicle/${id}.md"
+    p="chronicle/${id}.md"
   elif [ -f "docs/chronicle/${id}.md" ]; then
-    path="docs/chronicle/${id}.md"
+    p="docs/chronicle/${id}.md"
   else
     return 1
   fi
-  __state_yq2json "$path" | jq -c '.gates_fired // []'
+  __state_yq2json "$p" | jq -c '.gates_fired // []'
 }
 
 # List chronicle IDs (filename without .md extension), optionally limited
@@ -1081,16 +1084,16 @@ __state_platform_resolve_path() {
 
 state_platform_get() {
   local key="${1:-}"
-  local path
-  path="$(__state_platform_resolve_path)"
-  if [ ! -f "$path" ]; then
+  local p
+  p="$(__state_platform_resolve_path)"
+  if [ ! -f "$p" ]; then
     return 1
   fi
   local json
   json="$(python3 -c "
 import sys, yaml, json
 try:
-    with open('$path') as f:
+    with open('$p') as f:
         data = yaml.safe_load(f) or {}
     print(json.dumps(data, default=str))
 except Exception as e:

package/dist/lite/lib/tier-check.sh

@@ -131,35 +131,35 @@ PYEOF
 # Mirrors detection shape from .claude/hooks/tier-tag-required-at-write.sh so
 # the reader half and the writer half stay consistent.
 resolve_file_tier() {
-  local path="$1"
-  if [ ! -f "$path" ]; then
+  local p="$1"
+  if [ ! -f "$p" ]; then
     return 0
   fi
 
   local tier=""
-  case "$path" in
+  case "$p" in
     *.md)
       # Frontmatter between --- markers, first 30 lines
       tier=$(awk '
         /^---/ { in_fm = !in_fm; if (!in_fm) exit; next }
         in_fm && /^tier:[[:space:]]/ { sub(/^tier:[[:space:]]*/, ""); sub(/[[:space:]]*$/, ""); print; exit }
         NR > 30 { exit }
-      ' "$path" 2>/dev/null)
+      ' "$p" 2>/dev/null)
       ;;
     *.sh|*.py)
-      tier=$(head -10 "$path" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | head -1 | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
+      tier=$(head -10 "$p" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | head -1 | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
       ;;
     *.yml|*.yaml)
-      tier=$(head -30 "$path" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]|^tier:[[:space:]]' | head -1 | sed -E 's/^#?[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
+      tier=$(head -30 "$p" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]|^tier:[[:space:]]' | head -1 | sed -E 's/^#?[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
       ;;
     *.json|*.jsonc)
-      tier=$(head -30 "$path" 2>/dev/null | grep -oE '"(_?tier)"[[:space:]]*:[[:space:]]*"[a-z]+"' | head -1 | sed -E 's/.*:[[:space:]]*"([a-z]+)"/\1/')
+      tier=$(head -30 "$p" 2>/dev/null | grep -oE '"(_?tier)"[[:space:]]*:[[:space:]]*"[a-z]+"' | head -1 | sed -E 's/.*:[[:space:]]*"([a-z]+)"/\1/')
       if [ -z "$tier" ]; then
-        tier=$(head -30 "$path" 2>/dev/null | grep -oE '//[[:space:]]*tier:[[:space:]]*[a-z]+' | head -1 | sed -E 's/.*tier:[[:space:]]*//')
+        tier=$(head -30 "$p" 2>/dev/null | grep -oE '//[[:space:]]*tier:[[:space:]]*[a-z]+' | head -1 | sed -E 's/.*tier:[[:space:]]*//')
       fi
       ;;
     *.txt)
-      tier=$(head -1 "$path" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
+      tier=$(head -1 "$p" 2>/dev/null | grep -E '^#[[:space:]]*tier:[[:space:]]' | sed -E 's/^#[[:space:]]*tier:[[:space:]]*//; s/[[:space:]]*$//')
       ;;
   esac