@thebassclef/lite 1.9.9 → 1.9.10

package/dist/lite/standards/lite-manifest-schema-changes.md

@@ -34,6 +34,51 @@ Every entry stays in this file for the life of the manifest. Never pruned. When
 
 ## Entries (newest first)
 
+### cli#305 — identifier-leak scrub self-exclude + commit author check (v1.15.3 → v1.15.4, 2026-10-04)
+
+- **Change type:** content-change (1 file: `.claude/hooks/pre-commit-identifier-leak-scrub.sh`). Check 2 now filters out hunks from the hook's own files, its test, the rule, and the pattern source. Check 3 added — scans `git var GIT_AUTHOR_IDENT` for the pattern set plus the `.local` suffix. BLOCK banner adds a resolution path pointing at the GitHub no-reply address.
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `pre-commit-identifier-leak-scrub` hook slug.
+- **Version bump:** v1.15.3 → v1.15.4 (patch — content-only change on 1 slug; no entry count change). Rides on top of the Finding #7 bump (v1.15.3) when PRs land in order.
+- **Rationale:** Kunal cli#305 — first commit after `bassclef init` blocked on the check's own files; author identity leaked silently when `user.email` was unset on Mac. Class A identity leak sister to cli#313 + cli#320 shipped in v1.15.2. Per PR #2062 (planned).
+- **Downstream cure:** no action for adopters at exact-pin. Self-exclude paths are PATH-scoped, not pattern-scoped — leaks moved into non-self files still block. Author check is additive; adopters with clean emails see no change. Adopters whose git author ends in `.local` or carries a hostname pattern see the new BLOCK with a recipe pointing at `<username>@users.noreply.github.com`.
+- **Old shape retired:** nothing retired. Check 1 (message) + Check 2 (staged content, now filtered) + Check 3 (author) chain is additive.
+
+### #2036 Finding #7 — Playwright probe file-based fallback (v1.15.4 → v1.15.5, 2026-10-05)
+
+- **Change type:** content-change (1 file: `lib/capability-probe.sh`). `probe_mcp_playwright()` extended with four MCP config file fallback paths after the `CLAUDE_MCP_PLAYWRIGHT` env-var fast path. Fail-soft on missing `jq` + malformed JSON.
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `capability-probe` lib slug.
+- **Version bump:** v1.15.4 → v1.15.5 (patch — content-change on existing lib slug per policy). Rebased on top of cli#305 which landed first.
+- **Rationale:** Kunal v1.6.4 adopter run installed Playwright MCP but did not set `CLAUDE_MCP_PLAYWRIGHT`; probe returned 1; `/riff` + `/build` skipped screenshots. Fallback now reads `.mcp.json`, project + user `.claude/settings.json`, and `~/.claude.json`. Per bassclef-upstream#2036 Finding #7 + PR #2060.
+- **Downstream cure:** nothing — byte-for-byte unchanged when `CLAUDE_MCP_PLAYWRIGHT` is set (fast path first). Adopters without the env var set gain file-based detection on the fly.
+- **Old shape retired:** immediately (new behavior is additive).
+
+### cli#313 + cli#320 — identity-leak sweep in luminary-pick + personas (v1.15.1 → v1.15.2, 2026-10-04)
+
+- **Change type:** content-change (2 files: `lib/luminary-pick.sh` + `.claude/skills/personas/SKILL.md`). luminary-pick basedir fallback moves from `$HOME/src/sunj-labs/bassclef` to `$CLAUDE_PROJECT_DIR` → `git rev-parse` → `pwd` chain, plus adds `.claude/luminaries/*.md` catalog fallback for lite tier. personas SKILL default slug changes from email-derived (`operator-[local-part]`) to plain `operator` (never from email).
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `luminary-pick` lib slug + `personas` skill slug.
+- **Version bump:** v1.15.1 → v1.15.2 (patch; content-only on 2 slugs; no schema shape shift; no entry count change).
+- **Rationale:** bassclef-cli#313 (luminary-pick hardcoded eng path; adopters hit "catalog dir missing" every /launch Phase 3.5) + bassclef-cli#320 (operator slug derived from git email leaked GitHub account ID into committed docs). Kunal cold-adopter smoke caught both; shared class is "engineering assumption in cold paths" (per plan doc Slot 3).
+- **Downstream cure:** no action for adopters at exact-pin. Both changes are additive — lite tier adopters now get a working picker catalog; email-derived slugs never fire again. Operators wanting a display name beyond `operator` get an in-turn prompt instead.
+- **Old shape retired:** nothing retired. Both old shapes stay viable (BASSCLEF_DIR env var still honored first; manual slug entry still allowed via operator reply).
+
+### cli#307 — /build Phase 0 awk matches Step-N + WU-N (v1.15.0 → v1.15.1, 2026-10-04)
+
+- **Change type:** content-change (1 file: `.claude/skills/build/SKILL.md`). Phase 0 safety floor awk pattern + prose at L276 updated to recognize both `### Step-N` (new vocab per ADR-040 D1) and `### WU-N` (legacy).
+- **Fields:** 444 entries (unchanged). Content hash shifts on the `build` skill slug.
+- **Version bump:** v1.15.0 → v1.15.1 (patch; content-only change on 1 slug; no schema shape shift; no entry count change).
+- **Rationale:** bassclef-cli#307 — Kunal cold-adopter smoke caught the Phase 0 awk reading zero acceptance lines on Step-format specs. Partial-rename regression from ADR-040 D1 (Phase 1 grep got the rename, Phase 0 awk was missed).
+- **Downstream cure:** no action for adopters at exact-pin — the fix is additive (both heading forms match). Step-format specs now trigger the floor as designed. WU-format specs continue to work (characterization).
+- **Old shape retired:** nothing retired. The WU-only pattern leaves. The `(Step|WU)-` pattern stays indefinitely.
+
+### #2036 — install-written-paths manifest + lib + rule (v1.14.4 → v1.15.0, 2026-10-03)
+
+- **Change type:** content-add (3 new entries: `lib/install-written-paths.sh`, `.claude/rules/install-written-paths-mediation.md`, `.claude/hooks/session-reflection.d/83-install-written-paths-rebuild.sh`); content-change on `.claude/hooks/pre-commit-gate.sh` (filter block added for Kunal Finding #8 cure).
+- **Fields:** 441 entries → 444 entries (3 adds, 1 content_hash shift).
+- **Version bump:** v1.14.4 → v1.15.0 (content-add MINOR per discipline policy).
+- **Rationale:** bassclef-upstream#2036 Finding #8 structural cure. See `architecture/reviews/2026-10-03.md` + plan doc `docs/next-session-plan-2026-10-04-kunal-slots-5-6.md` Slot 5.
+- **Downstream cure:** no action for adopters at exact-pin — the new entries are additive and the lib's accessor API is new. Adopters pulling at `@thebassclef/lite@^1.15.0` get the cure automatically; the session-start fragment regenerates the install-written-paths manifest on first fresh-install session.
+- **Old shape retired:** nothing retired. All existing entries preserved.
+
 ### #1777 — friction hook pattern adds stage|launch new skill vocabulary (v1.14.2 → v1.14.3, 2026-10-01)
 
 - **Change type:** content-change (1 file: `post-skill-friction-check` hook)

package/dist/lite/standards/lite-manifest.json

@@ -1,7 +1,7 @@
 {
   "tier": "lite",
-  "manifest_version": "1.14.4",
-  "generated_at": "2026-10-03T09:49:31Z",
+  "manifest_version": "1.15.5",
+  "generated_at": "2026-10-04T22:12:41Z",
   "entries": [
     {
       "slug": "029-release-pipeline",
@@ -259,6 +259,14 @@
       "content_hash": "sha256:f4db0541d27a06e3f94ba557e7c8a39e747601b8ca9fd7af7313891b69548afd",
       "description": "Hook manifest staleness — flags standards/hook-cadence.json when it"
     },
+    {
+      "slug": "83-install-written-paths-rebuild",
+      "type": "hook",
+      "path": ".claude/hooks/session-reflection.d/83-install-written-paths-rebuild.sh",
+      "tier": "lite",
+      "content_hash": "sha256:3b8268e67f0eb25b84dd8cb010cfa02912c50c3c8eba73302341e445d19f97c5",
+      "description": "Session-start fragment: rebuild install-written-paths manifest when missing/stale."
+    },
     {
       "slug": "90-release-backlog",
       "type": "hook",
@@ -536,7 +544,7 @@
       "type": "hook",
       "path": ".claude/hooks/pre-commit-gate.sh",
       "tier": "lite",
-      "content_hash": "sha256:52bb9e21ec308a1684ef852cb02988442025c9a70fcad1efe38820829e331b7b",
+      "content_hash": "sha256:5b0385b5c3ab415c522285e70c710ef2351e5843a86867bd4a73b138e0e12e02",
       "description": "Observable failure trap — closes bassclef-upstream#1075 (silent-stderr class)."
     },
     {
@@ -544,7 +552,7 @@
       "type": "hook",
       "path": ".claude/hooks/pre-commit-identifier-leak-scrub.sh",
       "tier": "lite",
-      "content_hash": "sha256:2c4e842a4a34a706ad4993e15bbc75e62b988aa658e5a871ccee458fe0113a08",
+      "content_hash": "sha256:ea0f5430017f00b4cfe45e02f1c5232ab0532784258905dec28cc93eff1dfc65",
       "description": "PreToolUse: Bash"
     },
     {
@@ -632,7 +640,7 @@
       "type": "hook",
       "path": ".claude/hooks/state-validate.sh",
       "tier": "lite",
-      "content_hash": "sha256:a8c6b3ffbf13008d238ad87f47ec6a132ac407849dac00c0f1367909d2ace593",
+      "content_hash": "sha256:89fd09175f45f55f3f61f75cf7f4ae13cd3c5e813e17424eba296849452d5aec",
       "description": "state-validate.sh — PreToolUse hook that validates state-spine entity"
     },
     {
@@ -736,7 +744,7 @@
       "type": "lib",
       "path": "lib/capability-probe.sh",
       "tier": "lite",
-      "content_hash": "sha256:2db9a81735980513eebc9712510cb3b615557a5ab1b48ace48840ed28bc1e4c1",
+      "content_hash": "sha256:f22929492ea24941e7652aeedaaeb136f9c646e72bb8528039717b8aaead36b4",
       "description": "lib/capability-probe.sh — capability probe deep module."
     },
     {
@@ -768,7 +776,7 @@
       "type": "lib",
       "path": "lib/composer-preflight.sh",
       "tier": "lite",
-      "content_hash": "sha256:e4b5a09f0908897bb2709d5e4f7e191e9503e104a4a54cf5f43abdef218fc572",
+      "content_hash": "sha256:70e8d5ac6a0c5c39c8e217206fe9e0d5bd3afe3ca402a98e095e5e041be5dc12",
       "description": "lib/composer-preflight.sh — shared pre-flight check for composer skills."
     },
     {
@@ -835,12 +843,20 @@
       "content_hash": "sha256:5bc5b46f0478817665a77787e9b26997be3452572c7514e5ce540f37a9b9188a",
       "description": "Operator-identifier leak check for staged git content."
     },
+    {
+      "slug": "install-written-paths",
+      "type": "lib",
+      "path": "lib/install-written-paths.sh",
+      "tier": "lite",
+      "content_hash": "sha256:38148e8de456928b13846c2999377c30ac303cf0369cc7755ecc0ba9a8f899fb",
+      "description": "Install-written-paths manifest + accessor lib."
+    },
     {
       "slug": "luminary-pick",
       "type": "lib",
       "path": "lib/luminary-pick.sh",
       "tier": "lite",
-      "content_hash": "sha256:ad6e909a84c3371260377a98a94575a6cac2efbb6ff331bb1164e0ca42748a65",
+      "content_hash": "sha256:4d6d60d11a56c79e894a843a90550f10ee6f0160eebfd4e55402c840f2666741",
       "description": "andon-allow: docs/operator-private/[a-z-]+/20[0-9][0-9]-[0-9]{2}"
     },
     {
@@ -920,7 +936,7 @@
       "type": "lib",
       "path": "lib/state.sh",
       "tier": "lite",
-      "content_hash": "sha256:c840236de9a217a9d2d92d6be916b8548f1116125af12b68e7ee9f5824886fe9",
+      "content_hash": "sha256:e8482e2cf41f90adfedb3dc58dc585547db93983a6ca71bb19ae3b0507a76307",
       "description": "lib/state.sh — typed accessor library over bassclef's state spine."
     },
     {
@@ -1640,6 +1656,13 @@
       "content_hash": "sha256:31df845d034bbd756172ad7895ff561cbfeab38aa0b744f29862ff4095e4300b",
       "description": "Bassclef commits stay free of operator machine identifiers."
     },
+    {
+      "slug": "install-written-paths-mediation",
+      "type": "rule",
+      "path": ".claude/rules/install-written-paths-mediation.md",
+      "tier": "lite",
+      "content_hash": "sha256:282a2c4303315417afa75efb02724bc0913d9b3aa77d53fcfe4a7eb88ef65137"
+    },
     {
       "slug": "iteration-bet-brief-completeness",
       "type": "rule",
@@ -2187,7 +2210,7 @@
       "type": "skill",
       "path": ".claude/skills/autonomous/SKILL.md",
       "tier": "lite",
-      "content_hash": "sha256:94c65a68b005979ac17d8c3bbbfa1c63704843b0a59955a725175d0124525273",
+      "content_hash": "sha256:731b6954a38c3735e13ff635d19a05178e739c5986384c48ffbf09121026b892",
       "description": "Start or check an autonomous SDLC session. Two axes: who approves handoffs (you vs. the agent) and how work runs (one session vs. parallel agents). Defaults to operator-gated + sequential. Entry point for shipping features hands-off.",
       "inputs": [
         "start or check mode",
@@ -2226,7 +2249,7 @@
       "type": "skill",
       "path": ".claude/skills/build/SKILL.md",
       "tier": "lite",
-      "content_hash": "sha256:2abf1366cecf55c6b0e897c4a50fc4fbef0e175dcd9588af54240e98c7f789ea",
+      "content_hash": "sha256:a9196b9d0b89d8ed8619be911d3cae31b7e15b9bbe5d43592848c4310180cffb",
       "description": "Take a plan from /launch and ship it. One builder per user story. Runs /verify. Opens PRs. Gates prod on a human. Refuses auth, schema, security, and tenant work. Two modes — full and degrade-with-note.",
       "inputs": [
         "A goal slug pointing to a spec on disk"
@@ -2327,7 +2350,7 @@
       "type": "skill",
       "path": ".claude/skills/deploy-prod/SKILL.md",
       "tier": "lite",
-      "content_hash": "sha256:ff8921f0c5ad350c2428783ea7800ca90526400631f408660dd77f0a54fb45e5",
+      "content_hash": "sha256:fcc46296bbb82876be97882d08b6408b4fd6f0d0a32e2d0f9dfea1e2b05673b5",
       "description": "Production deployment procedure — test, build, push, CI, verify. Template for any project.",
       "inputs": [
         "Optional deploy-host override"
@@ -2614,7 +2637,7 @@
       "type": "skill",
       "path": ".claude/skills/launch/SKILL.md",
       "tier": "lite",
-      "content_hash": "sha256:35763f40fe046500da02f8d37ff4e6984e18ab08b64ed0eaa3c4095d90a22225",
+      "content_hash": "sha256:f0373719bb530dbdc5721c6d253dff7c628afb75a4f94112cf0a622ce039e4b0",
       "description": "Compare variants of an idea. Get a mock gallery. Pick a direction. Get a spec, user stories, and a plan to build. Two sizes — medium and full. Three modes — full, local, scratch.",
       "inputs": [
         "A rough idea or ticket or canvas"
@@ -2737,7 +2760,7 @@
       "type": "skill",
       "path": ".claude/skills/onboard-repo/SKILL.md",
       "tier": "lite",
-      "content_hash": "sha256:f6f9a0029ff31f1abb1e56c1fb56c63e0f7569c50eb97136596c2fee62dbd7eb",
+      "content_hash": "sha256:531b910cb45153b939b1f2a74dd1b214d2e87e4575ec3483624fe56510a4563c",
       "description": "Bootstrap the bassclef framework in a new repo. Installs the sync hook. Scaffolds config, whereami, and CLAUDE.md. Modes: default, --with-deploy-host, --with-secrets, --full, --greenfield-from-intent (starts a new repo from a short intent paragraph).",
       "inputs": [
         "Optional flags — --with-deploy-host or --with-secrets or --full"
@@ -2773,7 +2796,7 @@
       "type": "skill",
       "path": ".claude/skills/personas/SKILL.md",
       "tier": "lite",
-      "content_hash": "sha256:c03a2e1235ef7774fa014aff0e3690e6c81224887c46c8bcf7690ce7a80b5e19",
+      "content_hash": "sha256:fa3040d1a1c604cfa49dfa2de0993ee4242104040bc69659007e763711602749",
       "description": "Load, list, and manage user personas — the bassclef WHO record. Downstream skills (value-prop-canvas, synthetic-user, user-stories, jtbd-tasks) read from its output. Defaults to operator when no personas exist.",
       "inputs": [
         "Manage command — list or add or edit or delete"
@@ -3817,7 +3840,7 @@
       "type": "standard",
       "path": "standards/lite-manifest-schema-changes.md",
       "tier": "lite",
-      "content_hash": "sha256:11d4386e915614b3bc0de53a419e1ce76f4a3ebc0db9436c97c63772ce540a95",
+      "content_hash": "sha256:a3fb462a6061680fbb5416823055f0f7845d7b11c186479573bf7de7777a61ff",
       "description": "Chronological ledger of every lite-manifest schema change. Adopters read this before sync to know what shifted."
     },
     {
@@ -4097,7 +4120,7 @@
       "type": "standard",
       "path": "standards/state-spine.md",
       "tier": "lite",
-      "content_hash": "sha256:a3bccef9419e73b896bbf7dec3512530dd181654aae8769e255e90f3cfc682c0",
+      "content_hash": "sha256:c7081fbbd72b6eac299f811ea3862dd68ac0d255fd60ef602087f12d79fec5af",
       "description": "Schema'd JSON state spine for bassclef's substrate."
     },
     {

package/dist/lite/standards/state-spine.md

@@ -262,6 +262,7 @@ the schema doesn't constrain them.
 | InputArtifact | `docs/input-artifacts/<slug>.json` | whole file |
 | StackTemplate | `state/stack-templates/<slug>.json` | whole file |
 | SubstrateHardening | `state/substrate-hardening/inventory.json` (per bassclef bet 2026-06-17a Phase Z) | whole file |
+| InstallWrittenPaths | `state/install-written-paths.json` (per bassclef-upstream#2036 Finding #8 — manifest of install-written paths for discipline-hook mediation) | whole file |
 
 These entities are machine-consumed; operator-readability isn't
 load-bearing. Pure JSON; schema validates the whole file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thebassclef/lite",
-  "version": "1.9.9",
+  "version": "1.9.10",
   "description": "Bassclef CLI — install and upgrade bassclef in your project with two commands.",
   "keywords": [
     "bassclef",