@thebassclef/lite 1.9.8 → 1.9.10

package/dist/lite/.claude/skills/autonomous/SKILL.md

@@ -15,15 +15,19 @@ requires:
 
 # Autonomous Development
 
-Entry point for autonomous and semi-autonomous development sessions.
-Invoke at any point in any repo that inherits bassclef.
+<!-- FKGL-EXEMPT: cli#331 cure — orientation block names skill scope + tier split. Short SVO loses the tier contract. -->
+Entry point for autonomous SDLC sessions. Use in any repo inheriting bassclef.
 
-This file is a thin dispatcher. Deep procedural detail lives in:
+**Lite adopters:** this file is self-contained. The `## Lite procedure` block below has the minimum steps to run `/autonomous start`. No `strategy/` file is needed at lite tier.
 
-- `strategy/autonomous-dry-run.md` — read-only boot-sequence preview
-- `strategy/autonomous-boot-sequence.md` — `/autonomous start` scaffold +
-  activate, including Step 0–9, Construction automation A–E, pre-build
-  gates, branch stacking, context management, transition hierarchy
+**Standard and ultra adopters:** deeper procedure lives in these standard-tier files:
+
+- `strategy/autonomous-dry-run.md` — read-only boot preview
+- `strategy/autonomous-boot-sequence.md` — full `/autonomous start` steps 0-9 + Construction automation A-E
+- `strategy/agent-choreography.md` — multi-agent operational guide
+
+Per cli#331 — closes the "lite skill points at files lite doesn't ship" gap.
+<!-- /FKGL-EXEMPT -->
 
 ## Usage
 
@@ -263,6 +267,48 @@ silently proceed with defaults.
 
 ---
 
+## Lite procedure — self-contained minimum (cli#331)
+
+<!-- FKGL-EXEMPT: cli#331 cure — procedure block for lite adopters. Short SVO loses step contract. -->
+Lite adopters run `/autonomous start` with this block only. No `strategy/` file needed.
+
+**Step 0 — validate args.** Accept `operator-gated` or `orchestrator-gated` for gating. Accept `sequential` or `parallel` for mode. Reject anything else with a helpful error.
+
+**Step 1 — ask the operator two choices.** Gating (default: operator-gated). Mode (default: sequential). Use AskUserQuestion.
+
+**Step 2 — check readiness.** Run through this checklist. Scaffold missing items as you go:
+- `substrate.config.md` present → if missing, dispatch `/onboard-repo` first
+- `docs/whereami.md` present → if missing, dispatch `/onboard-repo` first
+- Current iteration goal doc at `docs/iteration-bets/<slug>.md` → if missing, ask operator for the goal; create a minimal doc
+- Session lock free → if active and >30 min old, clear with announcement
+- Chronicle fresh (last 24h) → if stale, note "will write at session-end"
+
+**Step 3 — risk register (optional on lite).** `docs/risk-register.md` is optional at lite tier. Create one only when operator asks or when mode is orchestrator-gated. Skip the check otherwise.
+
+**Step 4 — budget ceiling (optional on lite).** Ask the operator "how many turns are you OK spending on this session?" Default to "proceed until operator says stop" when operator skips. Record whatever they say in session memory.
+
+**Step 5 — confirm scope.** Echo the goal, the two choices, and the ceiling (or "no ceiling"). Ask: "Ready to start?" Wait for yes.
+
+**Step 6 — execute the SDLC chain.** Fire the agents in order per gating choice:
+- **operator-gated:** pause between each agent for operator approval. Agents: Shaper → PM → Architect → Designer → Builder → Reviewer → Deployer → Closer. Operator picks which fire.
+- **orchestrator-gated:** chain the agents without pausing. Each writes a handoff doc. Builder commits code. Reviewer runs `/verify`. PRs open for operator merge (or admin-merge within scope).
+
+**Step 7 — handle Construction.** For code work:
+- Parse scope into GitHub issues (one issue per discrete change)
+- Write stack manifest at `docs/stacks/<slug>.md` if more than one branch
+- Create branches with issue numbers in name (not placeholder — per bassclef#295)
+- Dispatch Builder per branch; fire `/temperance` + `/diagnose` + `/verify` per branch
+- Open PR per branch; squash merge after Reviewer PASS
+
+**Step 8 — close the session.** Dispatch `/session-end` which handles chronicle write, whereami bump, journal entry.
+
+Lite adopters at any point can escalate to operator-gated mode mid-session. Say "pause for me to review" and the next agent handoff waits.
+
+**Deep procedure for standard+ adopters.** Standard+ and ultra adopters have the strategy/ files above. Those cover Construction automation A-E, pre-build gates, branch stacking, context management, transition hierarchy, and the full choreography rules. Read them for the complete design.
+<!-- /FKGL-EXEMPT -->
+
+---
+
 ## Rules
 
 - Never start work without operator confirmation

package/dist/lite/.claude/skills/build/SKILL.md

@@ -255,7 +255,7 @@ FLOOR_PATTERN='src/lib/auth/|src/middleware\.ts|prisma/schema\.prisma|prisma/mig
 ACCEPTANCE_CONTENT=$(awk '
   /^```/{in_code = !in_code; next}
   in_code{next}
-  /^### WU-/{in_wu=1; next}
+  /^### (Step|WU)-/{in_wu=1; next}
   /^## /{in_wu=0}
   in_wu && /^- \[ \]/ {print}
 ' "docs/specs/${SPEC_PATH}.md" "docs/decompositions/${DECOMP_PATH}.md" 2>/dev/null)
@@ -273,8 +273,8 @@ fi
 ```
 
 **Why this is precise (per bassclef#366):** the scan only looks at
-step acceptance criteria (lines starting `- [ ]` under `### WU-N`
-headings, outside code blocks) plus file-path-shaped references in
+step acceptance criteria (lines starting `- [ ]` under `### Step-N`
+or `### WU-N` headings, outside code blocks) plus file-path-shaped references in
 the goal's frontmatter. Prose paragraphs that DESCRIBE the floor (like
 this section) don't trigger refusal. Code blocks that document the
 floor don't trigger refusal. Only structured ACTIONS the agent would
@@ -330,14 +330,25 @@ Parse the validated goal's structure:
 ```bash
 # Already have BET_JSON, SPEC_PATH, DECOMP_PATH, UX_MIG_PATH from Phase 0
 # Read spec body for step enumeration. Per bassclef#367, spec MUST have
-# the exact heading `## Steps enumerated` (pinned in /spec SKILL.md
-# rules + templates/spec-template.md). /launch's Phase 9
-# emits this heading by contract. Specs that lack the section → exit 4.
+# the heading `## Steps enumerated` (pinned in /spec SKILL.md rules +
+# templates/spec-template.md). /launch's Phase 9 emits this heading by
+# contract. Specs that lack the section → exit 4.
+#
+# Finding #2 + #3 cure (#2036): the previous awk range
+# `/^## Steps enumerated/,/^## /` closed on its own start line because
+# `^## ` matches `^## Steps enumerated`. Flag-based extraction fixes it.
+# Grace window per ADR-040 D1 (through 2026-10-31): accept both the new
+# "Steps enumerated" / "### Step-N" and the historical "Workunits
+# enumerated" / "### WU-N" headings so legacy specs still build.
 SPEC_FILE="docs/specs/${SPEC_PATH}.md"
-WU_LIST=$(awk '/^## Steps enumerated/,/^## /' "$SPEC_FILE" | grep -E '^### WU-')
+WU_LIST=$(awk '
+  /^## (Steps|Workunits) enumerated/ { in_section=1; next }
+  /^## / { in_section=0 }
+  in_section
+' "$SPEC_FILE" | grep -E '^### (Step|WU)-')
 
-# Each WU should reference at least one story (US-NNN)
-WU_COUNT=$(echo "$WU_LIST" | grep -c '^### WU-' || echo 0)
+# Each step should reference at least one story (US-NNN)
+WU_COUNT=$(echo "$WU_LIST" | grep -cE '^### (Step|WU)-' || echo 0)
 ```
 
 Build structured object: `{ bet, spec_path, decomp_path, ux_migration_path, wus[] }`.
@@ -348,7 +359,8 @@ Verify each step traces to at least one story. Refuse if any step lacks
 story traceability.
 
 ```bash
-ORPHAN_WUS=$(echo "$WU_LIST" | grep -v 'US-' || true)
+# Keep only step headings; drop body lines before the US-NNN check.
+ORPHAN_WUS=$(echo "$WU_LIST" | grep -E '^### (Step|WU)-' | grep -v 'US-' || true)
 if [ -n "$ORPHAN_WUS" ]; then
   echo "/build: step enumeration lacks story traceability (bassclef#358 violation)" >&2
   echo "Orphan steps (no US-NNN ref):" >&2
@@ -578,7 +590,26 @@ already open. Operator merges inline.
 
 ### Phase 7 — ApprovalGateLink (LIVE — STUBBED)
 
-Tonight emits literal:
+<!-- FKGL-EXEMPT: cli#332 cure — Phase 7 branches on hosting_platform value. Three code-shape outputs. Technical stub-shape dispatch pattern. -->
+
+Phase 7 branches on `hosting_platform` read from `substrate.config.md`:
+
+**When `hosting_platform: none`** (lite adopters, operator-only tools, local-first apps) — emit:
+
+```
+TODO: live execution — built, not deployed. hosting_platform=none in
+substrate.config.md. The code is reviewed and committed. Running it is
+your choice.
+
+To add hosting later:
+  - Edit substrate.config.md: set hosting_platform to one of
+    github-pages | netlify | cloudflare-pages | vercel | amplify
+  - Run /onboard-repo --with-deploy-host to wire the host
+  - Then /build Phase 7 will dispatch /deploy-prod via GitHub Environment
+    + required-reviewer rail per manual-prod-approval.md.
+```
+
+**When `hosting_platform` is set to a known value** — emit:
 
 ```
 TODO: live execution — when all steps merged + CI green, would dispatch
@@ -587,6 +618,17 @@ required-reviewer rail per manual-prod-approval.md. Operator approves
 prod deploy via GitHub UI from phone. /build NEVER bypasses this rail.
 ```
 
+**When `hosting_platform` is unset or unrecognized** — emit:
+
+```
+TODO: live execution — hosting_platform not set in substrate.config.md.
+Can't deploy without a target. Set hosting_platform to one of none |
+github-pages | netlify | cloudflare-pages | vercel | amplify, then re-run.
+```
+
+Per cli#332 — closes the "lite promises deployed app without a deploy path" honesty gap.
+<!-- /FKGL-EXEMPT -->
+
 <!-- FKGL-EXEMPT: Phase 7.5 references paths + skip criteria per architect-review SKILL; technical dispatch stub matches sibling STUB pattern -->
 ### Phase 7.5 — /architect-review auto-dispatch (LIVE — STUBBED, per #1437 Step 2 wiring)
 

package/dist/lite/.claude/skills/deploy-prod/SKILL.md

@@ -17,8 +17,18 @@ requires:
 
 # Deploy to Production
 
+<!-- FKGL-EXEMPT: cli#332 cure — tier contract block names scope + override path. Short SVO loses host-override contract. -->
 Standard deployment procedure. Run after code is reviewed and ready to ship.
 
+**Tier contract (per cli#332):**
+
+- This skill ships at `tier: lite` as a generic 5-step template: test → build → push → CI → verify.
+- The template body is host-agnostic. Host-specific commands (AWS, Vercel, Netlify, Fly, Railway, GitHub Pages) are not shipped here.
+- When `substrate.config.md` sets `hosting_platform` to a known value, standard-tier adopters add a host-specific wrapper that calls this skill AND runs the host commands. Lite adopters without `hosting_platform` run the template steps + stop.
+- `/build` Phase 7 dispatches this skill only when `hosting_platform` is set to a known value — see /build Phase 7 branching logic per cli#332.
+- `manual-prod-approval.md` applies in all tiers: GitHub Environment `prod` with required reviewer MUST be configured before any prod deploy fires.
+<!-- /FKGL-EXEMPT -->
+
 ## Procedure
 
 ### Step 1: Pre-flight

package/dist/lite/.claude/skills/launch/SKILL.md

@@ -309,9 +309,35 @@ Per `standards/voice-input-pattern.md` + Phase V Hey-Alexa MVD goal (`docs/itera
 - Existing text-mode + brownfield-mode behavior unchanged when flag absent
 - Composes with `--brownfield` (rare; voice-driven brownfield refactor is plausible but not the MVD path)
 
+### Phase 0b — hosting_platform ask (per cli#332)
+
+<!-- FKGL-EXEMPT: cli#332 cure — hosting_platform ask step. Short SVO loses the config-key contract. -->
+Read `substrate.config.md` for the `hosting_platform` key. If unset or missing, ask the operator once:
+
+```
+Where should this run?
+  a. local only (default — develop + preview on your machine)
+  b. a static host (GitHub Pages / Netlify / Cloudflare Pages / Vercel)
+  c. a server host (Amplify / Fly.io / Railway)
+  d. I'll deploy myself — just build the plan
+```
+
+Write the answer to `substrate.config.md` `hosting_platform`:
+- `a` → `hosting_platform: none`
+- `b` → prompt for which static host; write that value (`github-pages` / `netlify` / `cloudflare-pages` / `vercel`)
+- `c` → prompt for which server host; write that value (`amplify` / `fly` / `railway`)
+- `d` → `hosting_platform: operator-managed`
+
+If already set, skip the question. The answer flows to /build Phase 7 which branches on this value per cli#332.
+
+Per cli#332 — closes "Nothing asks where the app will run" at the earliest surface in the chain.
+<!-- /FKGL-EXEMPT -->
+
 ### Phase 1 — `/interpret-input`
 
+<!-- FKGL-EXEMPT: pre-existing text-mode + brownfield-mode description — technical dispatch contract per bassclef#459 sub-goal 1. -->
 Dispatches `/interpret-input` with the type detected by Phase 0. Text mode preserves the existing text-mode behavior; brownfield mode invokes the Phase C extractor (LR2 WU-1, bassclef#459 sub-goal 1) which walks the repo and populates structural hints (entities, actors, routes, README excerpt).
+<!-- /FKGL-EXEMPT -->
 
 ```bash
 # Generate sprint slug + InputArtifact path

package/dist/lite/.claude/skills/onboard-repo/SKILL.md

@@ -433,25 +433,25 @@ Idempotent API calls against the target repo via `gh`.
 # Read from git remote — don't infer from cwd basename (cwd can be renamed)
 REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
 
-declare -A LABELS=(
-  [bassclef-evolution]="A6E0F2:Candidate for promotion to bassclef"
-  [agent-user-proposed]="D4A5F5:Proposed by agent in an app repo"
-  [bassclef-sync]="8FD4A4:Related to bassclef substrate syncing"
-  [review-required]="F5B94A:Blocks — human review required"
-  [bug]="E4443A:Defect"
-  [enhancement]="A2EEEF:New or improved functionality"
-  [security]="FF0000:Security-relevant"
-  [infra]="C9D1D9:Infrastructure / workflows / tooling"
-  [priority-high]="E4443A:High priority"
-  [priority-medium]="F5B94A:Medium priority"
-  [question]="D876E3:Needs operator input or design discussion"
-)
-
-for NAME in "${!LABELS[@]}"; do
-  COLOR="${LABELS[$NAME]%%:*}"
-  DESC="${LABELS[$NAME]#*:}"
+# Per cli#306 — use while-read loop over pipe-delimited heredoc instead
+# of `declare -A`. macOS ships bash 3.2 which has no associative arrays.
+# Format per line: NAME|COLOR|DESCRIPTION
+while IFS='|' read -r NAME COLOR DESC; do
+  [ -z "$NAME" ] && continue
   gh label create "$NAME" --repo "$REPO" --color "$COLOR" --description "$DESC" --force >/dev/null
-done
+done <<'EOF'
+bassclef-evolution|A6E0F2|Candidate for promotion to bassclef
+agent-user-proposed|D4A5F5|Proposed by agent in an app repo
+bassclef-sync|8FD4A4|Related to bassclef substrate syncing
+review-required|F5B94A|Blocks — human review required
+bug|E4443A|Defect
+enhancement|A2EEEF|New or improved functionality
+security|FF0000|Security-relevant
+infra|C9D1D9|Infrastructure / workflows / tooling
+priority-high|E4443A|High priority
+priority-medium|F5B94A|Medium priority
+question|D876E3|Needs operator input or design discussion
+EOF
 ```
 
 Uses `--force` so the call is idempotent (updates existing label or
@@ -462,9 +462,28 @@ immediately without waiting for a sync cycle.
 
 ##### 1.2 Protect main from force-push and deletion
 
+**Heads up — GitHub free-tier adopters on PRIVATE repos:** the API call
+below returns HTTP 403 ("Upgrade to GitHub Pro or make this repository
+public") on free-tier accounts, because branch protection is a paid
+feature for private repos. Public repos get branch protection on every
+plan, free included. Pick a path below BEFORE running the call.
+
+Three ways to clear this step:
+
+1. **Make the repo public** — simplest; free plan includes branch
+   protection on public repos. Good fit when the code is open source
+   or ships to adopters anyway.
+2. **Upgrade the GitHub plan** — Pro / Team / Enterprise includes
+   branch protection on private repos.
+3. **Skip the API call** — rely on local safety (no `git push --force`
+   habits, PR review, pre-commit hooks). Mark the repo config so later
+   phases know branch protection is operator-managed, not substrate-
+   managed. See the fallback block below.
+
 ```bash
 DEFAULT_BRANCH=$(gh repo view "$REPO" --json defaultBranchRef -q '.defaultBranchRef.name')
 
+# Pro / public-repo path — run the API call.
 gh api "repos/$REPO/branches/$DEFAULT_BRANCH/protection" \
   --method PUT \
   --input - <<EOF
@@ -484,6 +503,28 @@ required here — agent-created PRs (bassclef-sync) need to merge
 without human intervention for the mobile-sync story. Add stricter
 rules per-repo in `.github/branch-protection.yml` if the repo warrants.
 
+**Free-tier private-repo fallback (path 3 above).** If the API
+returned 403 and the operator picked "skip and manage locally":
+
+```bash
+# Record the choice so later audits know main is not API-protected.
+mkdir -p .claude
+cat >> .claude/onboard-notes.md <<'NOTE'
+## Branch protection — operator-managed
+
+GitHub free-tier does not include branch protection on private repos.
+This repo relies on:
+- Local discipline: no `git push --force` to main.
+- PR review before merge.
+- Pre-commit hooks shipped by bassclef.
+
+Revisit if the repo moves to public, or the plan upgrades to Pro+.
+NOTE
+```
+
+The adopter can revisit this step after switching to public OR
+upgrading the plan.
+
 ##### 1.3 Add the production approval gate (if this repo deploys to prod)
 
 If the repo will deploy to production, per `manual-prod-approval.md`:

package/dist/lite/.claude/skills/personas/SKILL.md

@@ -87,7 +87,7 @@ When no persona files exist in the repo, auto-populate a minimal persona file fo
 
 - `CLAUDE.md` — read the "What this repo is" / "Active initiative" sections for goal context
 - `substrate.config.md` — read `agents:` and `deploy_targets:` for role context
-- If a git `user.email` exists, use it to derive a rough slug (`operator-[local-part]`), otherwise `operator`
+- Default slug: `operator`. Do not derive it from `user.email`. GitHub no-reply addresses carry the account ID and handle. The slug then leaks into committed docs (cli#320). Ask for a display name in-turn if the operator wants one.
 
 Emit the operator default to the conversation (not to disk — operator decides whether to persist it):
 

package/dist/lite/.claude/skills/release-notes/SKILL.md

@@ -108,6 +108,30 @@ Rules for external notes:
 - No feature names that aren't visible to users
 - Test: could someone who's never seen the codebase understand this?
 
+### 3.5. Run `/ogilvy-writing-audit` on each body
+
+Before saving the drafted bodies to disk, run `/ogilvy-writing-audit`
+on each one. The skill scans against Ogilvy + Roman-Raphaelson's
+rules (see `standards/ogilvy-writing-rules.md`) and returns
+severity-tagged findings.
+
+```bash
+/ogilvy-writing-audit docs/release-notes/YYYY-MM-DD-internal.md
+/ogilvy-writing-audit docs/release-notes/YYYY-MM-DD-external.md
+```
+
+Fix every 🔴 and 🟡 finding before step 4. When a 🟡 ships without
+a fix, cite the audit in the commit body and name why.
+
+Why this step. Release notes land in reader surfaces that must read
+clean — the GitHub Release artifact plus the Google Doc the team
+reviews. Jargon and grade-13 prose creep in without a mechanical
+check. PR #408 ran this discipline by hand across 8 entries, and
+PR #412 formalizes it so every future entry inherits the floor.
+
+Cross-ref: `.claude/rules/session-artifacts.md` §Release notes names
+this step as the discipline anchor.
+
 ### 4. Save locally
 
 ```

package/dist/lite/bassclef-version.json

@@ -1,7 +1,7 @@
 {
-  "version": "v1.6.4",
-  "marker_tag": "release-2026-09-28-21212e17",
-  "release_date": "2026-09-28T01:33:41Z",
-  "release_sha": "21212e17",
-  "release_tag": "release-2026-09-28-21212e17"
+  "version": "v1.6.6",
+  "marker_tag": "release-2026-10-05-484c6f3e",
+  "release_date": "2026-10-05T03:42:33Z",
+  "release_sha": "484c6f3e",
+  "release_tag": "release-2026-10-05-484c6f3e"
 }

package/dist/lite/gitignore

@@ -31,6 +31,14 @@ state/luminary-implementations/
 .claude/hooks/logs/
 .claude/hooks/*.trace
 
+# SDLC traces (operator-private; runtime artifacts carry operator paths)
+# Per #2036 Finding #1 (adopter report 2026-10-02) — auto-save was
+# committing /Users/<name>/ paths to adopter git every fire. Shipping this
+# line stops future adopter installs from leaking. Existing installs run
+# `git rm --cached -r docs/sdlc-traces/` one time to untrack files
+# already in history.
+docs/sdlc-traces/
+
 # Build output
 dist/
 

package/dist/lite/lib/capability-probe.sh

@@ -44,8 +44,46 @@ probe_gh_auth() {
 }
 
 probe_mcp_playwright() {
-  # V1 heuristic — env var contract. V2 may read tool inventory.
+  # Fast path — explicit opt-in via env var. Adopters who want to force the
+  # probe TRUE set CLAUDE_MCP_PLAYWRIGHT=1 in their shell init. Documented at
+  # docs/use-cases/UC-lib-capability-probe-mcp-fallback.md.
   [ -n "${CLAUDE_MCP_PLAYWRIGHT:-}" ] && return 0
+
+  # Fallback — look for a Playwright MCP server in known MCP config files.
+  # jq is required for parsing. When absent, the probe fails soft to 1.
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "probe_mcp_playwright: jq not found; env-var fast path only" >&2
+    return 1
+  fi
+
+  local project_dir="${CLAUDE_PROJECT_DIR:-.}"
+  local home_dir="${HOME:-}"
+
+  # Check paths in precedence order. First hit wins.
+  _probe_mcp_json_has_playwright "${project_dir}/.mcp.json"              && return 0
+  _probe_mcp_json_has_playwright "${project_dir}/.claude/settings.json"  && return 0
+  if [ -n "$home_dir" ]; then
+    _probe_mcp_json_has_playwright "${home_dir}/.claude/settings.json"   && return 0
+    _probe_mcp_json_has_playwright "${home_dir}/.claude.json"            && return 0
+  fi
+  return 1
+}
+
+# _probe_mcp_json_has_playwright <path>
+# Returns 0 when the JSON file names a Playwright MCP server. Checks two
+# shapes:
+#   1. Top-level "playwright" key (used by `.mcp.json` on some adopters)
+#   2. Nested "mcpServers.playwright" (used by `settings.json` + `~/.claude.json`)
+# Fail-soft on missing file + malformed JSON — returns 1 silently.
+# Per bassclef-upstream Finding #6 (#2036): `local path` is a zsh-magic variable
+# name — ties to $PATH when sourced from zsh. Renamed to `local p`.
+_probe_mcp_json_has_playwright() {
+  local p="$1"
+  [ -f "$p" ] || return 1
+  # Shape 1 — top-level playwright
+  jq -e '.playwright // empty' "$p" >/dev/null 2>&1 && return 0
+  # Shape 2 — nested mcpServers.playwright
+  jq -e '.mcpServers.playwright // empty' "$p" >/dev/null 2>&1 && return 0
   return 1
 }
 

package/dist/lite/lib/composer-preflight.sh

@@ -178,10 +178,14 @@ composer_preflight_check() {
     echo "check_5_recommendation="
     pass=$((pass + 1))
   elif [ -f "$repo_skill" ] || [ -L "$repo_skill" ]; then
-    echo "check_5_status=warn"
-    echo "check_5_message=Skill at repo-level only ($repo_skill); user-level symlink missing — harness may not pick up (bassclef#271)"
-    echo "check_5_recommendation=Run bassclef-sync.sh to create user-level symlink OR restart Claude session"
-    warn=$((warn + 1))
+    # Per cli#321 — Claude Code's harness loads project .claude/skills/
+    # directly; user-level symlinks are not required. Repo-level IS a
+    # valid discovery path. Previously flagged as WARN, trained adopters
+    # to ignore warnings. Now PASS with informational message.
+    echo "check_5_status=pass"
+    echo "check_5_message=Skill resolves at repo-level: $repo_skill (harness loads project .claude/skills directly)"
+    echo "check_5_recommendation="
+    pass=$((pass + 1))
   elif [ -n "${BASSCLEF_DIR:-}" ] && [ -f "$bassclef_skill" ]; then
     echo "check_5_status=warn"
     echo "check_5_message=Skill at bassclef only; consumer-side links missing — substrate sync incomplete"

package/dist/lite/lib/deferred-actions.sh

@@ -72,9 +72,9 @@ _da_resolve_path() {
 da_get_field() {
   local id="$1"
   local field="$2"
-  local path
-  path="$(_da_resolve_path "$id")"
-  [[ -f "$path" ]] || { echo "not-found: $path" >&2; return 1; }
+  local p
+  p="$(_da_resolve_path "$id")"
+  [[ -f "$p" ]] || { echo "not-found: $p" >&2; return 1; }
   # Read frontmatter only (between two `---` lines)
   awk -v f="$field" '
     BEGIN { in_fm = 0; seen_open = 0 }
@@ -89,7 +89,7 @@ da_get_field() {
       print
       exit
     }
-  ' "$path"
+  ' "$p"
 }
 
 da_resolve() {

package/dist/lite/lib/fixture-builder.sh

@@ -82,16 +82,16 @@ fixture_cleanup() {
   if [ "${SKIP_FIXTURE_BUILDER:-0}" = "1" ]; then
     return 0
   fi
-  local path="${1:?fixture_cleanup requires path}"
-  if [ ! -e "$path" ]; then
+  local p="${1:?fixture_cleanup requires path}"
+  if [ ! -e "$p" ]; then
     # Idempotent — nothing to do
     return 0
   fi
-  if [ ! -f "$path/$_FIXTURE_SENTINEL" ]; then
-    echo "fixture_cleanup: refusing to remove path without sentinel: $path" >&2
+  if [ ! -f "$p/$_FIXTURE_SENTINEL" ]; then
+    echo "fixture_cleanup: refusing to remove path without sentinel: $p" >&2
     return 1
   fi
-  rm -rf "$path"
+  rm -rf "$p"
   return 0
 }
 
@@ -105,10 +105,10 @@ fixture_cleanup_all() {
     return 0
   fi
   local IFS=$'\n'
-  local path
-  for path in $_FIXTURE_REGISTRY; do
-    [ -n "$path" ] || continue
-    fixture_cleanup "$path" 2>/dev/null || true
+  local p
+  for p in $_FIXTURE_REGISTRY; do
+    [ -n "$p" ] || continue
+    fixture_cleanup "$p" 2>/dev/null || true
   done
   _FIXTURE_REGISTRY=""
 }

package/dist/lite/lib/identifier-leak-check.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+# tier: lite
+# Operator-identifier leak check for staged git content.
+#
+# Shared across:
+#   - .claude/hooks/save-state.sh (inline before `git commit`;
+#     bypasses pre-commit-gate.sh because save-state runs git
+#     directly, not through the agent's PreToolUse path)
+#   - future: .claude/hooks/pre-commit-gate.sh CCF-3 (unification
+#     deferred to a follow-on; shape intentionally matches CCF-3
+#     today so the two can merge without semantic drift)
+#
+# Rejects staged content carrying absolute operator paths matching
+# /Users/<name>/ or /home/<name>/. Mirrors pre-commit-gate.sh:50-53
+# exemptions so policy docs that quote the pattern don't trip.
+#
+# Per #2036 Finding #1 (adopter report 2026-10-02).
+# Per @luminary nygard — stability pattern (circuit breaker on commit).
+# Per @luminary hoare — precondition contract before `git commit`.
+
+# check_staged_for_leaks — scan git-staged content for operator paths.
+#
+# Returns 0 when staged content is clean OR when every leaking file
+# sits in an exempt path (policy docs, rules, luminaries).
+# Returns 1 when staged content outside exempt paths carries a leak.
+# On exit 1, every leaking file is named on stderr with line number
+# and the matched pattern.
+check_staged_for_leaks() {
+  # Staged non-exempt files. Match pre-commit-gate.sh:46-53 exemption shape
+  # so the two gates agree on which paths carry policy docs legitimately
+  # quoting operator paths.
+  local staged
+  staged=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null | \
+    grep -vE '^\.claude/(rules|hooks|skills|luminaries|agents)/' | \
+    grep -vE '^standards/' | \
+    grep -vE '^architecture/' | \
+    grep -vE '^design/' | \
+    grep -vE '^docs/standards/' | \
+    grep -vE '^docs/rules/' | \
+    grep -vE '^chronicle/' | \
+    grep -vE '^strategy/' | \
+    grep -vE '^scripts/tests/' || true)
+
+  [ -z "$staged" ] && return 0
+
+  local leaked=""
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    [ ! -f "$f" ] && continue
+    local matches
+    matches=$(grep -nE '/Users/[A-Za-z0-9_.-]+|/home/[A-Za-z0-9_.-]+' "$f" 2>/dev/null || true)
+    if [ -n "$matches" ]; then
+      leaked="${leaked}
+  ${f}:
+${matches}
+"
+    fi
+  done <<< "$staged"
+
+  if [ -n "$leaked" ]; then
+    {
+      echo ""
+      echo "============================================"
+      echo "BLOCKED: operator path in staged content (#2036 Finding #1)"
+      echo "============================================"
+      echo "$leaked"
+      echo ""
+      echo "Operator-specific paths (/Users/<name>, /home/<name>) must NOT"
+      echo "ship in adopter git. Common cause: docs/sdlc-traces/*.log"
+      echo "carrying absolute paths from PreToolUse hook callers."
+      echo ""
+      echo "Fixes:"
+      echo "  1. Delete the staged file if it's a trace log auto-generated"
+      echo "     (gitignored going forward per #2036 Finding #1 cure)"
+      echo "  2. Rewrite the path as repo-relative"
+      echo "  3. Move policy docs under docs/standards/ or docs/rules/ (exempt)"
+      echo ""
+      echo "Policy: standards/two-layer-config.md (bassclef#740)"
+      echo "============================================"
+    } >&2
+    return 1
+  fi
+
+  return 0
+}