agent-bios 0.19.1 → 0.19.3

package/claude/guides/korean-writing.md

@@ -0,0 +1,153 @@
+---
+guide_id: korean-writing
+language: en
+status: active
+description: Before writing, revising, or translating Korean prose, you must read and apply this entire guide, including for responses, documents, slide wording, and UI copy.
+use_when:
+  - writing, revising, or translating Korean responses or documents
+  - composing Korean slide text, headlines, buttons, or status labels
+core_rules:
+  - Consult the full guide before Korean writing and compare the result with the source and actual state.
+  - Connect the central judgment to evidence while preserving distinct concepts, conditions, and uncertainty.
+  - Distinguish proposals, available actions, and completed states; match action copy to actual behavior.
+---
+
+# Writing in Korean
+
+Before writing, revising, or translating Korean prose, read and apply this entire guide.
+If the same complete text is already in the current task context, no duplicate file read is needed.
+Apply it to responses, reports, notices, slide wording, and UI copy while respecting the requested
+length, format, and register. Do not force a headline or lengthy evidence onto a short response.
+Preserve quotations and identifiers that must remain exact.
+
+First decide what the reader needs to understand or judge. Connect the supporting evidence and
+conditions, and preserve conceptual distinctions and factual scope when shortening the text.
+The Korean golden sentences below are hypothetical teaching examples, not real facts or fixed
+templates. Apply their preservation of meaning, rather than copying sentence counts, headings,
+or endings.
+
+## 1. Define the question and central judgment
+
+Make each fact, comparison, and explanation's role in the central judgment clear. Split independent
+questions, or explain why they belong together.
+
+- Avoid: “문의가 늘었다. 담당자는 세 명이다. 안내 문서를 개편했다.”
+- Golden: “반복 문의를 줄이기 위해 안내 문서를 개편했다. 담당자 세 명이 자주 받는 질문을 모아 답변을 보강했다.”
+
+Use this connection only when the purpose and work described in the golden are supported.
+Do not invent purpose or activities from a list of facts alone.
+
+## 2. Make the subject and central judgment visible in the headline
+
+Avoid references that require earlier text or headlines that only preview a count. The argument
+should connect when headlines are read alone. Do not force a conclusion onto an overview,
+definition, or transition.
+
+- Avoid: “세 가지 개선 사항”
+- Golden: “신청 절차를 줄여 사용자의 입력 부담을 낮춘다”
+
+For a definition, a role-revealing title such as “신청 자격의 정의” is also appropriate.
+
+## 3. Keep claims within the evidence's scope and certainty
+
+Distinguish hypotheses from confirmed facts, examples from actual selections, and temporal order
+from causality. Retain uncertainty where the source has not established a relationship.
+
+- Avoid: “안내 문서 개편으로 문의가 감소했다.”
+- Golden: “안내 문서 개편 후 문의가 감소했다. 다만 같은 기간 이용자 수도 줄어, 개편의 효과인지는 확인되지 않았다.”
+
+Mention the decline in users only when supported too. Do not invent another fact to explain an
+unconfirmed cause.
+
+## 4. Use the same name for the same concept and distinguish different concepts
+
+Do not alternate synonyms merely for stylistic variety. Even when shortening an explanation,
+retain each independent concept's name, definition, and difference from others.
+
+- Avoid: “활성 사용자는 주간 이용자를 뜻한다. 참여 고객은 이번 주 120명이다.”
+- Golden: “활성 사용자는 일주일 동안 한 번 이상 서비스를 이용한 사용자다. 이번 주 활성 사용자는 120명이다.”
+
+Use the source or agreed definition. Ambiguous terminology does not authorize a new threshold.
+
+## 5. Preserve the subject and action even in short wording
+
+Qualify ambiguous words such as scope, criteria, or completion with the object the reader needs.
+Do not fill gaps in compressed wording with meaning absent from the source.
+
+- Avoid: “통과 범위와 보완 항목을 함께 남깁니다.”
+- Golden: “검토를 통과한 범위와 보완할 항목을 함께 기록합니다.”
+
+Name each state the reader must distinguish directly.
+
+- Avoid: “0처럼 보이는 누락을 구분합니다.”
+- Golden: “값이 누락된 경우와 실제 금액이 0인 경우를 구분합니다.”
+
+## 6. State relationships between concepts explicitly
+
+Make clear what causes, conditions, or forms part of what, and what is compared with what.
+Do not add unsupported causality, sequence, or superiority to create a connection.
+
+- Avoid: “교육 참여와 배포 권한은 연결됩니다.”
+- Golden: “교육 이수는 배포 권한을 신청하기 위한 조건입니다. 교육을 이수해도 권한이 자동으로 부여되지는 않습니다.”
+
+## 7. Move from judgment to evidence
+
+Present the central judgment and necessary premises, then the supporting explanation. Distinguish
+new implications derived from the explanation and avoid repeating the same content in several places.
+
+- Avoid: “연동 시험 두 건이 남았다. 금요일에 시험 환경을 사용할 수 있다. 출시 일정 조정이 필요하다.”
+- Golden: “출시를 다음 주로 미뤄야 한다. 필수 연동 시험 두 건이 남아 있으며, 시험 환경은 이번 주 금요일부터 사용할 수 있다.”
+
+This example assumes the release timing and mandatory tests are established. Do not settle a
+schedule or condition absent from the source.
+
+## 8. Keep conditions, exceptions, and scope close to the claim
+
+Do not relegate interpretation-changing conditions to incidental information. Align units, periods,
+subjects, and denominators when comparing numbers; disclose differences in the comparison bases.
+
+- Avoid: “모든 사용자는 신청을 취소할 수 있다.”
+- Golden: “사용자는 승인 전까지 신청을 취소할 수 있다. 승인 후에는 담당자에게 취소를 요청해야 한다.”
+
+## 9. Distinguish proposals, available actions, and completed states
+
+Do not describe a proposed procedure as an implemented feature. Name what has completed and
+keep review, approval, finalization, and transmission as distinct states.
+
+- Avoid, on a proposal screen before implementation: “원천 자료부터 회계 시스템 입력용 집계까지 검토합니다.”
+- Golden: “원천 자료부터 회계 시스템 입력용 집계까지, 검토 절차를 제안합니다.”
+
+- Avoid: “검토가 완료되어 회계 처리가 끝났습니다.”
+- Golden: “검토를 완료했습니다. 회계 승인과 결산 확정 여부는 별도로 확인해야 합니다.”
+
+## 10. Match action copy to actual behavior
+
+Buttons and links should say what the user will do or see. Distinguish viewing, selecting, saving,
+and submitting. Do not promise a result that the click alone does not achieve.
+
+- Avoid, on a button opening a scope explanation: “검토 시작”
+- Golden: “검토 범위 안내 보기”
+
+If the destination actually allows selection, use “검토 기간·상품 선택”.
+
+## 11. Remove repetition while retaining necessary explanation
+
+Do not delete essential evidence, definitions, or conditions for brevity. Do not add claims or
+repeat statements to fill space. Separate sentences with different roles, such as definition
+and interpretation.
+
+- Avoid: “처리 시간을 단축하고 더 빠르게 처리하기 위해 중복 확인 절차를 없애 처리 속도를 개선한다.”
+- Golden: “처리 시간을 줄이기 위해 같은 정보를 두 번 확인하는 절차를 한 번으로 합친다.”
+
+## 12. Compare the finished text with the source and actual state
+
+Check that key concepts, figures, conditions, subjects, and relationships survive. For features
+and procedures, also verify available behavior and current state. The headlines and body should
+communicate the argument without the author's additional explanation.
+
+- Source: “시범 운영에 참여한 20개 팀 중 12개 팀이 다음 분기에도 사용할 의향이 있다고 답했다.”
+- Avoid: “고객의 60%가 재계약을 확정했다.”
+- Golden: “시범 운영에 참여한 20개 팀 중 12개 팀(60%)이 다음 분기에도 사용할 의향을 밝혔다.”
+
+Preserve the subject, denominator, and response meaning when summarizing. Do not turn intent
+to use into a confirmed renewal.

package/claude/guides/learning-flow.md

@@ -76,7 +76,7 @@ Surface each surviving candidate compactly — lesson, type, intended layer,
 admission-bar verdict, domain (+ proposed_domain) — and record ONLY what the
 user explicitly approves.
 
-In a Codex app task using the explicit corpus bridge, use the `learn` command
+In a Codex app task using the explicit instructions bridge, use the `learn` command
 and environment returned in its `runtime` metadata, or its registered helper.
 Shell exports from an earlier app tool call do not persist into later calls.
 
@@ -96,11 +96,11 @@ match your host):
 
 The script (capability boundary) owns `learning_id` / `created` / `schema_version`
 and validates against `learn/learning.schema.json`. It appends the record to the
-private corpus's `learnings/<host>/events.jsonl`, keeping Claude and Codex captures
+private instruction store's `learnings/<host>/events.jsonl`, keeping Claude and Codex captures
 separate. Selected learnings enter future activated-session snapshots through the
-private corpus. Capture preserves the user's global instruction files and the
+private instructions. Capture preserves the user's global instruction files and the
 running session's snapshot. Upload runs after local storage when transport is configured.
-The private root is `$AGENT_BIOS_CORPUS_DIR`, defaulting to
+The private root is `$AGENT_BIOS_INSTRUCTIONS_DIR`, defaulting to
 `~/.config/agent-bios/corpus`; native host-home settings do not relocate it.
 `--config-dir` is restricted to explicit legacy mode. Use `--no-upload` for
 local-only capture or `--dry-run` to validate without writes or uploads.

package/claude/guides/llm-capability-boundary.md

@@ -110,7 +110,13 @@ Important levers:
   grounding checks, provenance checks, citation checks, static checks, E2E
   checks, and semantic quality gates.
 - Retry/fail policy: retry transient generation failures; fail clearly when the
-  available route cannot enforce the required contract.
+  available route cannot enforce the required contract. A contract-failing item
+  is rejected loudly and never recorded as a valid result; record its failed or
+  not-done status in artifact state. On a production path the whole run halts
+  only when continuing would contaminate what the next step reads — a stale or
+  not-reusable input, a contract-failing value about to be recorded as valid,
+  or an external write with an unknown outcome; otherwise it warns loudly and
+  continues, and the next run picks up the work not done.
 - Observability: prompt packet snapshot, model/provider version, schema hash,
   source snapshot, validator decision, retry reason, and artifact lineage.
 

package/claude/guides/session-distill-workflow.md

@@ -6,7 +6,7 @@ audience: author
 use_when:
   - a session was launched with the Session distill preset (mission-injected)
   - the launcher nudge says enough sessions accumulated for a mining window
-  - learning from LLM work sessions to improve the corpus and its application
+  - learning from LLM work sessions to improve the instructions and its application
   - promoting, incubating, or retiring items in the session-distill ledger
 core_rules:
   - read Goal and desired outcomes before state files or pipeline work; use it to judge the run and its delegated work
@@ -69,7 +69,7 @@ keep existing content, or a clearly bounded unresolved finding, is also useful.
 Carry this goal and the relevant outcome criteria into delegated work, then
 assess its results against them before presenting the run as complete.
 
-**Requires an agent-bios checkout.** This runbook edits the corpus itself, so it
+**Requires an agent-bios checkout.** This runbook edits the instructions themselves, so it
 names repo paths and runs repo scripts. On a packaged install those do not exist:
 say so and stop rather than following steps you cannot execute.
 
@@ -87,7 +87,7 @@ Everything durable lives in the agent-bios repo.
    correct on the day it is written and silently wrong afterwards.
 2. `design/session-distill/versions.json` — authoring provenance mapping each
    closed mining window to its commit. Private rollback selects an installed
-   `baseline_ref` through the corpus plan; this registry is not that authority.
+   `baseline_ref` through the instructions plan; this registry is not that authority.
 3. `design/session-distill/PLACEMENT-FRAMEWORK.md` — the placement framework
    (typology A–G, layers, admission bars, lifecycle). Apply the current
    `AGENTS.md` reductions-only rule and `SURFACES.md` delivery contract when
@@ -105,7 +105,7 @@ Run in order; each stage reads the previous stage's `out/`:
 2. `digest.py` — one secret-redacted digest per session with deterministic
    6-criteria signals. Screen ALL digests; triage orders, never drops.
 3. `batch.py` — the baseline blob (`claude/CLAUDE.md` + every guide, the
-   repo's canonical corpus) and per-provider batches; writes
+   repo's canonical instructions) and per-provider batches; writes
    `out/batch_index.json`, which the screeners take as their `args`.
 4. Provider-affine screening against that baseline: `screen-claude.js`
    (Claude sessions; a Workflow script — pass the index as `args`, one
@@ -173,12 +173,12 @@ Run in order; each stage reads the previous stage's `out/`:
    dated corrections for anything refuted.
 2. Write a new timestamped completion record under `design/session-distill/`
    following `AGENTS.md`; incidental finds become next-window candidates.
-3. Register the corpus version: append {version = window end, commit = the
-   corpus-close commit} to `design/session-distill/versions.json` for authoring provenance. Private rollback selects an installed `baseline_ref`
-   through `agent-bios corpus plan`; the window registry does not authorize a
+3. Register the instructions version: append {version = window end, commit = the
+   instructions-close commit} to `design/session-distill/versions.json` for authoring provenance. Private rollback selects an installed `baseline_ref`
+   through `agent-bios instructions plan`; the window registry does not authorize a
    global-file rollback. Then run
    `python3 session-distill/update-state.py --window-end <date>`
-   (nudge baseline) and `corpus-state.py project` (launcher status panel).
+   (nudge baseline) and `instructions-state.py project` (launcher status panel).
 4. Merge the branch, push, and confirm the private release from this checkout
    (`bash install.sh verify`); report stored-state and session-delivery evidence
    separately.

package/claude/guides/slide-writing/RUNBOOK.md

@@ -13,7 +13,7 @@ Do not substitute an HTML deliverable or claim that unrelated screenshots passed
 this paired runtime.
 
 Use `<runbook-root>` for the directory containing this file and its `scripts/`
-directory, and `<job>` for a new directory outside the immutable corpus bundle.
+directory, and `<job>` for a new directory outside the immutable instructions bundle.
 The runtime refuses an existing job directory; revised inputs or output use a
 new job revision. In every command, `--base` names the companion directory. The
 criteria source is its sibling, `<runbook-root>/../slide-writing.md`.
@@ -36,8 +36,8 @@ python3 -B "<runbook-root>/scripts/pair.py" --base "<runbook-root>" prepare \
 ```
 
 Omit `--asset` when no assets are needed; repeat it for additional files. Asset
-basenames must be unique. They are copied to `input/assets/<name>`, so URLs from
-`output/deck.html` use `../input/assets/<name>`.
+basenames must be unique. They are copied to `<job>/input/assets/<name>`, so URLs from
+`<job>/output/deck.html` use `../input/assets/<name>`.
 
 `check` parses and validates the primary criteria source without writing to the
 guide bundle. `prepare` derives `<job>/input/slide-writing.md` and the job-only
@@ -116,8 +116,8 @@ python3 -B "<runbook-root>/scripts/pair.py" --base "<runbook-root>" verify --job
 ```
 
 Every consuming command also performs its own preflight checks. An edit becomes
-available to the next activated corpus snapshot and the next prepared job. An
-existing job verifies against its original immutable corpus snapshot, frozen
+available to the next activated instructions snapshot and the next prepared job. An
+existing job verifies against its original immutable instructions snapshot, frozen
 criterion source, derived oracle, and runtime version. Mutating the guide or code
 path recorded by that job instead of using its original snapshot invalidates the
 binding, as do changes to its source document, specification, assets, HTML,

package/claude/guides/tooling-gotchas.md

@@ -256,7 +256,26 @@ depends on it, pin it explicitly instead of trusting the environment.
   and check for a front-side cache/CDN separately. Aim the probe at an
   in-unit sentinel the app answers without credentials: a denial the app
   produces anyway passes with the control off, and a redirect into it is a
-  bypass.
+  bypass. The address an IP-based rule compares is the one selected at its
+  enforcement point, and configuration alone may not establish which: behind
+  a proxy or CDN it can be the client address the configured forwarded-header
+  trust chain hands the app, and a managed platform can route particular
+  destinations outside an otherwise configured NAT path — on GCP, Google API
+  traffic did not use the Cloud NAT address despite
+  `privateIpGoogleAccess: false`. Before writing or editing an allowlist or
+  perimeter rule, observe the address for the real workload and destination
+  at the enforcement point, with a control path that should show a different
+  one.
+- **Locating a credential must not print it**: a command meant only to find
+  where a secret lives, or to check that it is set, exposes the value if it
+  emits it into the transcript — `cat` of an env file, `printenv`,
+  `echo $TOKEN`, a keychain read with `-w`, or a grep whose match is the
+  secret line. Check existence, length, or shape without emitting any secret
+  characters (`[ -n "${X:-}" ]`, `wc -c < file`, a key-name-only listing, a
+  nonprinting format check), and let the consumer read the value directly
+  from the environment or credential store only when it needs it. Do not
+  print even a partial prefix. A value that reached the transcript is
+  exposed: rotate it.
 - **Tightening exposure is a behavior change for external clients**: switching
   ingress mode, adding an allowlist, or requiring auth is not safe when
   callers live outside your redeploy. Enumerate which clients reach the

package/claude/guides/ui-design/visual-direction.md

@@ -0,0 +1,88 @@
+---
+language: en
+status: active
+---
+
+# Choosing a visual direction for an operational interface
+
+Use when a new visual direction or a material arrangement decision remains
+unresolved in the requested work. For an established direction or a bounded copy
+correction, use the existing system and verify the affected result proportionately.
+
+## Start from the task and supported system
+
+Identify the content people must read, compare, select, edit or act on. Preserve
+the working scope, authority and state distinctions that matter to that task.
+Inspect the project's existing components and tokens before introducing a new
+visual vocabulary. An external reference does not itself justify replacing the
+project's framework or component library.
+
+Consult a reference when it helps resolve the remaining visual decision; reuse
+sufficient existing evidence. Research more when the decision needs it or the
+user requests research. Prefer task-relevant product views or official pattern
+documentation. Distinguish live observations, release screenshots, historical
+images and explanatory artwork. Record the source and date, what it informs,
+and its applicability limits in the ordinary design note. Do not infer token
+values or usability from an image alone.
+
+## Choose only the patterns the task needs
+
+| Task | Useful arrangement | Meaning to preserve |
+| --- | --- | --- |
+| Reading and review | Give the artifact sufficient space; keep necessary evidence nearby when switching would obstruct comparison | The artifact, source, applicable conditions and review target |
+| Repeated record comparison | Align comparable values; distinguish whole-list, selected-set and individual-record actions | Units, comparison basis, exceptions and each action's scope |
+| Selection-driven editing | Keep relevant properties bound to the selected object | Selection, draft and resulting changes remain attached to the same target |
+| Input and result confirmation | Keep input, consequential effects and results close enough to follow | Entered, saved, approved and actually executed states stay distinct |
+
+These are conditional patterns, not a required navigation structure or panel
+count. Choose persistent supporting panels or transient overlays according to
+their role. Give prose a readable measure and comparisons sufficient width.
+Adapt the arrangement to the supported viewport while preserving the current
+selection, return context, reading order and keyboard focus order. Compact
+navigation when needed to keep the main task reachable on a narrow screen.
+
+## Define roles before values
+
+Explain the proposed reading order, emphasis, density and grouping briefly.
+Map foregrounds, surfaces, action states, spacing relationships and any required
+depth to the existing semantic tokens. Keep focus, selection, feedback and
+disabled states distinct even when values initially coincide. Add a pattern
+token only when it represents an independent decision. The role of a token
+must survive theme changes; check its actual foreground/background pairing.
+
+For information-dense operational work, start with typography, alignment and
+spacing to organize content; add containers, color or elevation when they
+communicate a needed relationship or interaction. Large introductory areas,
+repeated summary cards, badges and icon backgrounds need a task or brand purpose.
+Ordinary content need not look raised. Use depth when it clarifies a floating,
+movable or otherwise distinct object. Preserve useful brand and user preferences.
+
+Do not impose a reference palette, fixed pixel scale, permanently dim navigation,
+universal card ban or identical layout across tasks. When no system exists, mark
+initial values as project proposals. Define consistent text roles and spacing
+within and between groups, then check the resulting density. Resolve crowded
+content through grouping, widths and wrapping before shrinking text. Keep words
+and meaningful phrases together where the language permits, with a fallback for
+unbroken strings. Check representative Korean text when the product uses Korean.
+
+## Compare only enough to resolve the decision
+
+Use representative content, long labels, important exceptions and relevant
+states at the target sizes. Keep task, content and capability constant while
+comparing visual alternatives; use a credible baseline. Distinguish token
+changes from changes to regions, information order and grouping. Typography
+and spacing can still alter wrapping and geometry. Where narrow layouts
+converge, do not claim a difference the user cannot see.
+
+Inspect the actual rendered result when appearance is being judged. Check
+contrast, clipping, wrapping, state distinctions, action targets and focus
+visibility under the applicable accessibility requirements. Verify that
+rearrangement preserves semantic reading and keyboard order. For interactive
+changes, exercise selection, draft retention and the relevant failure/recovery
+paths; styling does not establish permission or execution.
+
+Record visual preference separately from observed task performance. Rendered
+samples support visual inspection; interaction and user-performance claims need
+their own evidence. Preserve the result and remaining uncertainty in ordinary
+team artifacts. No prescribed number of variants or new research report is
+needed for every task.

package/claude/guides/ui-design.md

@@ -0,0 +1,90 @@
+---
+guide_id: ui-design
+language: en
+status: active
+description: For designing, reviewing, or changing task flows, information layout, visual hierarchy, or interaction in operational user interfaces; keep bounded corrections proportionate.
+use_when:
+  - designing or reviewing a work application, operations tool, or interactive work surface
+  - changing information arrangement, visual hierarchy, design tokens, or interaction states
+  - preserving scope, evidence, authority, and continuity through a user interface
+---
+
+# Operational interface design and delivery
+
+Use for interfaces where people inspect evidence, compose work, make decisions
+or act on records. Match the deliverable to the user's requested stage and scope.
+A clear text correction needs that correction and a proportionate check.
+
+1. **Establish what the sources mean now.** Separate implemented behavior,
+   accepted requirements, proposed design choices and illustrative states.
+   Reconcile amendments and decisions before reusing an older screen. A newer
+   date alone does not establish authority. Keep material contradictions and
+   unknowns visible instead of silently choosing a convenient interpretation.
+
+2. **Preserve requested coverage; bound the work at the right level.** Identify
+   the operator, outcome and evidence that would complete this deliverable.
+   Distinguish people consuming work context from those authoring or managing
+   it; do not invent their visit frequency or force a common starting screen.
+   For a complete design request, cover the required operations even when their
+   backend is not built; specify their subjects, inputs, effects, dependencies
+   and recovery rather than claiming implementation. For a bounded change,
+   complete the requested path before expanding neighboring features. Include
+   adjacent repairs when that path depends on them or this change causes a
+   regression, and state why. An unavailable implementation does not erase a
+   requested design contract.
+
+3. **Organize around a meaningful next decision.** Show the working scope,
+   evidence to compare, current state, available action and resulting next step
+   together. Internal modules or protocol phases are not automatically menus
+   or buttons. Combine preparation steps behind one authorized intent when no
+   user choice is needed, while keeping distinct outcomes understandable. Use
+   the team's visual language to assign emphasis according to the task, and
+   make typography, spacing, color and boundaries express meaningful
+   relationships. Test whether actual task content is prominent at the target
+   size; decorative summaries must earn their space. When layout uncertainty
+   matters, compare arrangements at the lowest useful fidelity, explaining the
+   task tradeoff and what evidence would change the choice.
+
+   When a new visual direction or a material arrangement decision remains
+   unresolved, use
+   `${CLAUDE_CONFIG_DIR:-$HOME/.claude}/guides/ui-design/visual-direction.md`.
+   An established direction or a bounded correction does not require new
+   reference research or multiple designs.
+
+4. **Keep qualifications with the thing they qualify.** Preserve applicable
+   conditions, exceptions, units, source/version, time meaning and affected
+   scope through summaries, edits, comparisons and exports. Keep independent
+   dimensions separate. Missing evidence is not an empty result or a zero, and
+   an index or relationship view is not proof of its underlying body or meaning.
+   Expand technical detail when useful without hiding a consequential limit.
+
+5. **Make each action's authority and effect precise.** Name the exact target,
+   base and changed content when reviewing a change. Recheck a changed base or
+   permission instead of carrying approval onto different input. Distinguish
+   selection, saved draft, approval, execution and recipient use as applicable;
+   one positive state does not prove the next. Preserve request identity when
+   an outcome is uncertain and reconcile its actual result before retrying.
+   UI controls reflect the existing authoritative policy; they do not create it.
+   If policy is unsettled, label proposed choices and the responsible decision
+   owner rather than implying permission or omitting the required design.
+
+6. **Carry the same work across views and people.** Preserve the draft, target,
+   review/request identity and return context when moving between surfaces.
+   Equivalent outcomes need suitable representations, not identical layouts or
+   duplicated business rules. Provide keyboard and structured alternatives for
+   necessary spatial interactions. Verify evidence for the actual recipient;
+   another worker's receipt does not establish their access or delivery.
+
+7. **Verify this deliverable, then finish it.** Walk a design's concrete scenario
+   and relevant exceptions against its sources; inspect its proposed composition.
+   For working changes, exercise the changed runtime path, relevant failures,
+   keyboard and recovery. When a visual change is material, inspect the affected
+   composition with representative content and relevant states at the target
+   size, distinguishing token changes from changes to information arrangement.
+   Check that visual, reading and focus order remain coherent across layouts.
+   Report visual preference separately from observed task performance. Keep
+   simulation, observed runtime and user evidence distinct. Once the required
+   checks are complete, leave the result, material decisions, source bindings
+   and remaining work in ordinary team artifacts. Keep private facts within
+   their permitted boundary. Choose dependencies only when a requirement
+   demands a decision, using the supported environment first.

package/claude/guides/verification-discipline.md

@@ -77,6 +77,7 @@ cheapest one to write.
 - A/B or on/off measurements: before accepting a null result, verify the arms actually received different treatment in the mechanism under test — a shared default or unconditional upstream step can silently apply the treatment to both arms.
 - Multi-stage pipelines with nondeterministic stages: a final-output diff cannot attribute an effect or a regression to a stage — it conflates the change with run-to-run variance. Persist every stage's output, tabulate what each creates, may edit, and only guards, restrict the suspects to the stages that edit the content in question, and find the first stage where the intended effect disappears or the defect appears. Fix there, preferring a structural recheck over another prompt-level instruction that already failed.
 - Before/after comparisons: pin the input to an immutable copy — a snapshot or versioned artifact — and run both arms against it, because a live artifact (a growing log, a regenerated upstream stage) drifts between runs and any diff over it, a matching one included, is evidence of nothing; when the arms are metered, restore the baseline's exact upstream inputs and re-run only the changed stage. This is input identity, not the separate unit-and-denominator basis rule.
+- Cost figures from provider usage records: before pricing, map every provider's token fields onto one schema — uncached input, cache read, cache write, output. Some providers report input as a total that already includes cached tokens: treating that total as uncached input and then adding the cache-read field again counts the cached portion twice, while charging the inclusive total once at the full rate misprices that portion instead. Other providers exclude cached tokens from the input field. When a provider reports or prices cache writes separately, keep them in their own field. Confirm each provider's field meaning against its own usage documentation or a known sample, never by analogy with another provider, and derive the cache hit rate from the normalized fields.
 - Model-behavior guardrails: verify by changed behavior, not recitation — a staged battery from named-trigger cases through disguised, deconfounded, category-wide, and single-variable framings; a clean pass means "no known defect", so re-run the battery when the model changes.
 - Branch/version test builds against real data: explicitly separate every state sink the app touches (files, DB, OS-level stores that ignore env overrides), confirm the launch path propagates the isolation to child processes, and back up live data before the first run — a mismatched schema that drops unknown fields on write is data loss, not a no-op.
 - Sandbox, replay, or re-adjudication runs on production-derived config: enumerate every outbound channel the stage can reach — publish, upload, notify, external write — and disable or redirect each one before the run, proving each disarm fires as you would prove a path guard; a guard on the input or target path alone leaves egress armed. Fingerprint every external destination before the run and diff it after, so an escaped write is caught by the run rather than by a recipient.
@@ -151,6 +152,11 @@ produce a green with no evidence behind it:
 - **The suspiciously fast or empty run.** When a check goes green unexpectedly quickly, or reports
   nothing at all, dump what it actually ran over before believing it. A harness that crashed early
   and one that found nothing produce the same exit code.
+- **The verdict that ran before its checks.** If a runner computes or prints its overall verdict
+  before all checks finish, later failures cannot change it. Accumulate one failure count across
+  every check, then compute the verdict and exit status once, after the last check. Read a
+  multi-check run from that final count and an exit status verified to derive from it — never from
+  `tail` or collapsed last lines, which hide failures printed earlier.
 - **The control that failed by crashing.** A negative control is evidence only when it fails
   through the assertion it names: a traceback and a caught violation share an exit code, and an
   early crash can pre-empt every control after it. Treat each traceback in a control run as a
@@ -173,7 +179,10 @@ produce a green with no evidence behind it:
 - **The mutant that never ran.** A mutation verdict counts only if the mutant is valid: it
   compiled, sits on a path the exercised test traverses, and changes the guarded behavior, not
   healed downstream or coinciding with a default. The runner must report build failure,
-  unreachable, and equivalent distinctly from KILLED and SURVIVED, and halt on a moved anchor.
+  unreachable, equivalent, and timed out distinctly from KILLED and SURVIVED, and halt on a moved
+  anchor. A timeout is not a kill: it moves with machine load, so set the limit well above the
+  unmutated suite's runtime and accept a verdict only when repeated runs agree on which mutants
+  timed out.
   More tests red than the mutation should touch indicts it; classify a survivor (rebuild,
   discard, genuine gap) before writing a test. **Equivalent is a verdict about the probe as
   much as the mutant**: a probe that is dead or returns a constant reports every mutant as

package/claude/hooks/tooling-gotchas-hook.py

@@ -18,7 +18,29 @@ GUIDE = "guides/tooling-gotchas.md"
 # Both hosts receive the same command payload and additionalContext response.
 # The guide remains available when native hooks are disabled, untrusted, or do
 # not cover a tool path. --self-test checks every anchor against both guide trees.
+_SECRET_FILE = (r"(?:\.env(?:\.\w+)?|\.netrc|\.pgpass|\.npmrc|\.pypirc|credentials(?:\.json)?"
+                r"|auth\.json|secrets?\.(?:ya?ml|json|toml))\b")
 RULES = [
+    # First because it is the one reminder whose miss is not re-work but exposure. Each
+    # branch is a command whose ordinary output IS the value: a keychain read with -w/-g,
+    # printenv or a bare env, a token-printing CLI, an echo of a credential-named variable
+    # (`\w*TOKEN\b` leaves $MAX_TOKENS alone), and a display or match over a secret-bearing
+    # file. A grep with -l/-L/-c/-q prints names, counts or nothing, so it stays quiet.
+    ("credential-print",
+     re.compile(r"(?i)\bsecurity\s+find-(?:generic|internet)-password\b[^|;&]*\s-[a-z]*[wg]\b"
+                r"|\bprintenv\b(?!\s+(?:PATH|HOME|SHELL|USER|PWD|LANG|TERM|TMPDIR)\b)"
+                r"|(?:^|[|;&]\s*)env\s*(?:$|[|;&])"
+                r"|\bgcloud\s+auth\s+(?:application-default\s+)?print-(?:access|identity)-token\b"
+                r"|\bgh\s+auth\s+token\b"
+                r"|\bkubectl\s+get\s+secrets?\b[^|;&]*-o\s*=?\s*(?:ya?ml|json|jsonpath)"
+                r"|\b(?:echo|printf)\b[^|;&]*\$\{?\w*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_?KEY"
+                r"|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?)\b"
+                r"|\b(?:cat|head|tail|less|more|bat)\b[^|;&]*" + _SECRET_FILE +
+                r"|\b(?:grep|rg)\b(?![^|;&]*\s-[a-zA-Z]*[lLcq])[^|;&]*" + _SECRET_FILE),
+     "Checking where a credential lives or that it is set must not print it — test "
+     "existence, length, or shape without emitting secret characters; a value that "
+     f"reached the transcript is exposed, rotate it ({GUIDE}).",
+     "Locating a credential must not print it"),
     ("reserved-shell-names",
      re.compile(r"\b(UID|EUID|GID|PPID)="),
      "Assigning reserved shell names (UID/EUID/GID/PPID) can invoke the bound "
@@ -280,6 +302,7 @@ def self_test() -> int:
     # matches() never reaches the caller either — both leave the rule inert while this file
     # goes on reporting that all of them fire.
     FIXTURES = {
+        "credential-print":      "cat .env",
         "reserved-shell-names":  "UID=0 echo hi",
         "git-diff-two-dot":      "git diff main..HEAD",
         "git-pull-dirty":        "git pull origin main",
@@ -417,6 +440,24 @@ def self_test() -> int:
     if "grep-binary-heuristic" in [h for h, _ in matches("(grep -a needle payload)", limit=None)]:
         problems.append("grep-binary-heuristic: fired although the subshell-grouped "
                         "grep carries its own text-mode flag")
+    # Every branch of credential-print is a separate way the value reaches the transcript,
+    # so each gets its own firing case — a regex that loses one alternative still fires on
+    # `cat .env` and would pass the fixture above. The quiet cases are the look-alikes the
+    # rule must leave alone: existence and length checks, name-only and count-only greps,
+    # a variable named for LLM token counts, a keychain lookup without -w, and a printenv
+    # of a non-secret variable.
+    for cmd in ("printenv", "env | grep KEY", "echo $GITHUB_TOKEN", 'echo "${OPENAI_API_KEY}"',
+                "printf '%s' $DB_PASSWORD", "security find-generic-password -s svc -w",
+                "gcloud auth print-access-token", "gh auth token", "grep API_KEY .env",
+                "kubectl get secret db -o yaml", "head -3 credentials.json", "tail ~/.netrc"):
+        if "credential-print" not in [h for h, _ in matches(cmd, limit=None)]:
+            problems.append(f"credential-print: does not fire on a value-printing command ({cmd!r})")
+    for cmd in ('[ -n "${GH_TOKEN:-}" ]', "wc -c < .env", "grep -c API_KEY .env", "grep -l token .env",
+                "echo $MAX_TOKENS", "security find-generic-password -s svc", "gh auth status",
+                "gcloud auth list", "cat README.md", "env FOO=1 python3 x.py", "printenv PATH",
+                "grep -rn token src/"):
+        if "credential-print" in [h for h, _ in matches(cmd, limit=None)]:
+            problems.append(f"credential-print: fired on a command that prints no secret ({cmd!r})")
     for envcmd in ("LC_ALL=C grep needle payload", "cat payload | LC_ALL=C grep needle"):
         if "grep-binary-heuristic" not in [h for h, _ in matches(envcmd, limit=None)]:
             problems.append(f"grep-binary-heuristic: an env-assignment prefix hid the "

package/claude/skills/repo-charter/SKILL.md

@@ -5,8 +5,8 @@ description: Write or overhaul a repository's AGENTS.md (with CLAUDE.md as a one
 
 # Repo charter
 
-A repository's AGENTS.md is the repo's own layer of agent instruction — what a global
-corpus cannot know because it is true only here. This skill produces that layer for a real
+A repository's AGENTS.md is the repo's own layer of agent instruction — what global
+instructions cannot supply because it is true only here. This skill produces that layer for a real
 repository, and it produces it *from the repository*: the substantive half is reading the
 invariants, the gates and the traps out of the code, and no template can do that part.
 
@@ -40,7 +40,7 @@ thick; everything else stays thin or absent.
 | Application / product | project invariants, pitfall warnings, co-change duties |
 | CLI / single-author tool | repo orientation, project invariants, task procedure |
 | Monorepo / platform | context routing, task procedure |
-| Corpus / payload the repo publishes elsewhere (the code is delivery, the content is the product) | hard boundaries, co-change duties, completion gates |
+| Instructions / payload the repo publishes elsewhere (the code is delivery, the content is the product) | hard boundaries, co-change duties, completion gates |
 | Content / docs | repo orientation only, minimal |
 
 A repo may take two rows; take the union and note which row explains each thick category.