cc-discipline 2.13.6 → 2.15.1

package/README.md

@@ -65,7 +65,7 @@ Without the hook, Claude would keep editing `auth.py` indefinitely — each fix
 
 ---
 
-**`pre-edit-guard.sh`** — Before a source edit, checks `docs/debug-log.md` for hypotheses still marked pending, flags unusually large diffs, and reminds you to register newly created scripts. These are context notes, not blocks.
+**`pre-edit-guard.sh`** — Before a source edit, checks `docs/debug-log.md` for hypotheses still marked pending, and flags unusually large diffs. These are context notes, not blocks.
 
 > Downgraded from a hard block on 2026-07-30. Combined with the debugging rules it had become a trap: write three hypotheses into the log as the rules ask, and you were then barred from editing source until three were confirmed — including for unrelated planned work. The hypothesis discipline stays in the rules; only the enforcement was relaxed.
 
@@ -133,7 +133,7 @@ Auto-injected markdown in `.claude/rules/` — Claude sees them when operating o
 - Pre-edit checklist: understand the file, know the impact, fix root cause
 - Mole-whacking detection: recognize the pattern, stop, report
 - Phase discipline: stay in research/plan/implement, don't jump ahead
-- Multi-task gates: complete tasks in order, confirm each before moving on
+- Multi-task discipline: work in order, report done only when it is done, stop and report on failure
 - Tech stack rules for Python, JS/TS, embedded, RTL, mobile
 
 ### Subagents (the auditors)
@@ -163,14 +163,14 @@ The installer is interactive — pick your tech stack, name your project, done.
 
 ```
 .claude/
-├── rules/                    # Auto-injected when Claude operates on matching files
+├── rules/                    # Core rules load every session; stack rules load for matching files
 │   ├── 00-core-principles.md
 │   ├── 01-debugging.md
-│   ├── 02-before-edit.md
 │   ├── 03-context-mgmt.md
 │   ├── 04-no-mole-whacking.md
 │   ├── 05-phase-discipline.md
 │   ├── 06-multi-task.md
+│   ├── 07-integrity.md
 │   └── stacks/               # Picked during install
 ├── hooks/                    # Shell scripts, exit 2 = block operation
 │   ├── streak-breaker.sh
@@ -183,11 +183,14 @@ The installer is interactive — pick your tech stack, name your project, done.
 │   └── commit/SKILL.md       # /commit: test → update docs → commit
 └── settings.json             # Hook registration
 docs/
-├── progress.md               # Claude maintains this, read after compact
+├── progress.md               # What happened — Claude maintains it, read after compact
+├── todo.md                   # What's still open — Now / Later, edited by you and Claude
 └── debug-log.md              # Debug session tracking
 CLAUDE.md                     # Your project info (you fill this in)
 ```
 
+**Three record files, three jobs.** `progress.md` records what happened — status, milestones, decisions — and only grows. `todo.md` holds only what is still open: *Now* for the next steps, *Later* for deferred work, each with a condition for when to revisit it; an item is deleted once it's done. `debug-log.md` tracks hypotheses while debugging. At every session start and after each compaction, a hook injects progress.md's Current Status and todo.md's *Now* list, and counts the *Later* items.
+
 ## Customization
 
 **Adjust hook strictness:**
@@ -204,8 +207,8 @@ STOP_THRESHOLD=10    # Hard block after N edits
 ```bash
 cat > .claude/rules/my-rule.md << 'EOF'
 ---
-globs: "src/api/**/*"
-description: "API layer rules"
+paths:
+  - "src/api/**/*"
 ---
 - All API changes must be backwards-compatible
 - New endpoints need OpenAPI spec updates
@@ -226,7 +229,7 @@ See [Claude Code hooks docs](https://docs.anthropic.com/en/docs/claude-code/hook
 No. The hooks are the real enforcement — they're shell scripts that physically block operations. The rules are supplementary structure.
 
 **Does it slow things down?**
-No. Hooks are lightweight shell scripts, typically <100ms. Rules add ~8KB to context (~2%).
+Somewhat. Measured on Windows with Git Bash, the hooks on the edit path add about 150 ms to an edit of a docs or config file and about 650 ms to an edit of a source file. Rules add about 15 KB to context (under 2% of a 200K window), and stack rules load only when Claude reads a matching file.
 
 **Should I commit `.claude/` to git?**
 Yes. Team members get the same guardrails. Hook paths use `$CLAUDE_PROJECT_DIR`, so they work across machines.

package/README.zh-CN.md

@@ -25,7 +25,6 @@
 │  Layer 1: Rules（自动注入）             │
 │  core-principles — 核心原则            │
 │  debugging — 调试纪律                  │
-│  before-edit — 修改前检查              │
 │  context-mgmt — 上下文管理             │
 │  no-mole-whacking — 反打地鼠           │
 │  stacks/* — 技术栈特有规则             │
@@ -73,9 +72,11 @@ your-project/
 │   ├── rules/
 │   │   ├── 00-core-principles.md      # 核心工作原则
 │   │   ├── 01-debugging.md            # 调试纪律
-│   │   ├── 02-before-edit.md          # 修改前检查
 │   │   ├── 03-context-mgmt.md         # 上下文管理
 │   │   ├── 04-no-mole-whacking.md     # 反打地鼠
+│   │   ├── 05-phase-discipline.md     # 阶段纪律
+│   │   ├── 06-multi-task.md           # 多任务纪律
+│   │   ├── 07-integrity.md            # 诚信纪律
 │   │   └── stacks/                    # 技术栈特有规则
 │   │       ├── rtl.md                 #   RTL / IC 设计
 │   │       ├── embedded.md            #   嵌入式 C/C++
@@ -92,12 +93,15 @@ your-project/
 │   └── skills/
 │       └── commit/SKILL.md            # /commit 智能提交
 ├── docs/
-│   ├── progress.md                    # 进度记录（Claude 维护）
+│   ├── progress.md                    # 进度记录：已经发生的事（Claude 维护）
+│   ├── todo.md                        # 待办：Now / Later（你和 Claude 都可以改）
 │   └── debug-log.md                   # 调试日志（Claude 维护）
 └── ~/.claude/
     └── CLAUDE.md                      # 全局通用纪律（可选）
 ```
 
+**三个记录文件，各管一件事**：`progress.md` 记录已经发生的事（状态、里程碑、决策），只增不减；`todo.md` 只放还没做的事——*Now* 是接下来的具体步骤，*Later* 是推迟的工作，每条都写明什么时候、什么条件下再看，做完就删；`debug-log.md` 记录调试中的假设。每次开会话和每次压缩上下文之后，hook 会注入 progress.md 的 Current Status 和 todo.md 的 *Now* 列表，并报出 *Later* 的条数。
+
 ## 各层详解
 
 ### Rules（自动注入）
@@ -109,10 +113,7 @@ Claude 无法选择性忽略这些规则——它们在操作匹配文件时会
 - `00-core-principles.md` — 先理解再动手、不锁定第一解释、连续3次失败必须停下
 - `01-debugging.md` — 四阶段调试流程（收集→假设→验证→修复）
 - `03-context-mgmt.md` — 主动检查点、调研隔离、compact 策略
-- `04-no-mole-whacking.md` — 打地鼠检测和汇报模板
-
-**源码规则**（编辑 src/ 等目录时生效）：
-- `02-before-edit.md` — 修改前的 5 项强制检查
+- `04-no-mole-whacking.md` — 打地鼠检测
 
 **技术栈规则**（按文件类型触发）：
 - `.v/.sv/.vhd` → RTL 规则（时序意识、CDC 检查、综合/仿真区分）
@@ -251,8 +252,8 @@ Claude: 先别急着改。测试期望 200 但拿到了 401。
 # Create a new rule
 cat > .claude/rules/my-rule.md << 'EOF'
 ---
-globs: "src/api/**/*"
-description: "API 层特有规则"
+paths:
+  - "src/api/**/*"
 ---
 ## API 修改规则
 - 所有 API 变更必须向后兼容
@@ -289,7 +290,7 @@ EOF
 A: CLAUDE.md 在对话开始时读取一次。Rules 是按文件路径匹配自动注入的——当 Claude 操作匹配 glob 的文件时，对应规则会自动出现在它的上下文中。Rules 更可靠，因为它们不依赖 Claude "记得去看"。
 
 **Q: Hooks 会影响性能吗？**  
-A: 几乎不会。它们是轻量的 shell 脚本，执行时间通常 <100ms。
+A: 有一些。在 Windows 的 Git Bash 下实测：编辑文档或配置文件时，每次编辑约增加 150 ms；编辑源码文件约增加 650 ms。规则约占 15 KB 上下文（不到 200K 窗口的 2%），技术栈规则只在读到对应文件时才加载。
 
 **Q: 可以把 .claude/ 提交到 git 吗？**  
 A: 强烈建议提交。这样团队成员都能共享同一套纪律。注意 `.claude/settings.json` 中的 hooks 路径是相对路径，团队成员不需要额外配置。

package/bin/cli.js

@@ -144,4 +144,9 @@ const result = spawnSync(bash, [unixScript, ...scriptArgs], {
     cwd: process.cwd(),
 });
 
-process.exit(result.status || 0);
+if (result.error) {
+    console.error(`cc-discipline: could not start bash (${result.error.code || result.error.message})`);
+    process.exit(1);
+}
+// status is null when bash was killed by a signal: a failure, not a success.
+process.exit(result.status === null ? 1 : result.status);

package/global/CLAUDE.md

@@ -39,7 +39,7 @@ Don't skip the first three steps and jump straight to the fourth.
 
 ## Context Hygiene
 
-- Use subagents for research. Don't read large volumes of files in the main conversation.
-- Update docs/progress.md after completing each milestone.
+- Delegate to subagents only for sizeable, independent work that would otherwise flood the conversation; do small reads, edits and checks yourself.
+- Update docs/progress.md after completing each milestone; keep open work in docs/todo.md.
 - Don't proactively warn about context running low or suggest compacting. The system auto-compacts at 0% — you cannot see the percentage. Keep progress.md updated instead.
-- First thing after compact: read `docs/progress.md` and `docs/debug-log.md`.
+- First thing after compact: read `docs/progress.md`, `docs/todo.md` and `docs/debug-log.md`.

package/init.sh

@@ -191,6 +191,18 @@ fi
 # Parse choices into array
 IFS=' ' read -ra STACKS <<< "$STACK_CHOICES"
 
+# Stack rules are framework files, like the core rules, so anything other than a
+# fresh install refreshes every stack already installed, whatever was chosen
+# above. Without this an `upgrade` (which passes --auto, and --auto defaults the
+# stack to 7, meaning none) or an interactive "Enter to keep current" copied no
+# stack file at all, so changes to stack rules never reached an existing install.
+if [ "$INSTALL_MODE" != "fresh" ]; then
+    detect_installed_stacks
+    for s in $INSTALLED_STACKS; do
+        case " ${STACKS[*]} " in *" $s "*) ;; *) STACKS+=("$s") ;; esac
+    done
+fi
+
 # ─── Project name ───
 if [ -n "$ARG_NAME" ]; then
     PROJECT_NAME="$ARG_NAME"
@@ -237,13 +249,24 @@ mkdir -p docs
 echo -e "${GREEN}Installing core rules...${NC}"
 cp "$SCRIPT_DIR/templates/.claude/rules/00-core-principles.md" .claude/rules/
 cp "$SCRIPT_DIR/templates/.claude/rules/01-debugging.md" .claude/rules/
-cp "$SCRIPT_DIR/templates/.claude/rules/02-before-edit.md" .claude/rules/
 cp "$SCRIPT_DIR/templates/.claude/rules/03-context-mgmt.md" .claude/rules/
 cp "$SCRIPT_DIR/templates/.claude/rules/04-no-mole-whacking.md" .claude/rules/
 cp "$SCRIPT_DIR/templates/.claude/rules/05-phase-discipline.md" .claude/rules/
 cp "$SCRIPT_DIR/templates/.claude/rules/06-multi-task.md" .claude/rules/
 cp "$SCRIPT_DIR/templates/.claude/rules/07-integrity.md" .claude/rules/
 
+# Retired core rules. Core rules are framework files that every upgrade overwrites,
+# so a rule dropped from templates/ has to be deleted here as well — otherwise the
+# old copy stays in every existing install indefinitely. The pre-upgrade backup in
+# .claude/.backup-* still holds it.
+#   02-before-edit.md — retired 2026-09-23: every item duplicated another rule or a
+#   trained default, and it loaded unconditionally although written as a per-file check.
+#   Only in upgrade mode: in append mode the project has never had cc-discipline,
+#   so a file by that name is the user's own.
+if [ "$INSTALL_MODE" = "upgrade" ]; then
+    rm -f .claude/rules/02-before-edit.md
+fi
+
 # ─── Copy stack-specific rules based on selection ───
 if [ ${#STACKS[@]} -gt 0 ] && [ -n "${STACKS[0]}" ]; then
     echo -e "${GREEN}Installing stack rules...${NC}"
@@ -281,15 +304,138 @@ if [ ${#STACKS[@]} -gt 0 ] && [ -n "${STACKS[0]}" ]; then
     done
 fi
 
+# ─── Content hashing (skills and hooks) ───
+# Two properties matter here, and both were learned the hard way.
+#
+# 1. Record WHICH algorithm produced a digest. The fallback below resolves
+#    differently depending on what is installed, so a manifest holding a bare
+#    digest silently mis-compares the moment tool availability changes — every
+#    hash mismatches, every retired skill looks user-modified, and the
+#    retirement pass does nothing. (fixed 2026-08-28, before 2.13.0 shipped.)
+#
+# 2. Hash line-ending-NORMALIZED content, not raw bytes. Projects that commit
+#    .claude/ and run with core.autocrlf=true and no .gitattributes get their
+#    SKILL.md rewritten to CRLF by git on checkout. Byte-exact comparison then
+#    reports every skill as modified, with the same two consequences as above
+#    plus a .new file dropped beside every skill on every upgrade. Measured on
+#    one install: the file differed from its manifest entry by exactly 44 bytes
+#    across 44 lines, and matched perfectly once normalized. (fixed 2026-08-28)
+#
+# sha256sum and `shasum -a 256` produce identical digests, so both label sha256.
+
+_cc_digest_with() {   # $1=tool  $2=file  $3=norm|raw  ->  bare digest
+    if [ "$3" = "norm" ]; then
+        case "$1" in
+            sha256sum) sed 's/\r$//' "$2" | sha256sum | cut -d' ' -f1 ;;
+            shasum)    sed 's/\r$//' "$2" | shasum -a 256 | cut -d' ' -f1 ;;
+            md5sum)    sed 's/\r$//' "$2" | md5sum | cut -d' ' -f1 ;;
+            md5)       sed 's/\r$//' "$2" | md5 -q ;;
+            cksum)     sed 's/\r$//' "$2" | cksum | cut -d' ' -f1 ;;
+        esac
+    else
+        case "$1" in
+            sha256sum) sha256sum "$2" | cut -d' ' -f1 ;;
+            shasum)    shasum -a 256 "$2" | cut -d' ' -f1 ;;
+            md5sum)    md5sum "$2" | cut -d' ' -f1 ;;
+            md5)       md5 -q "$2" ;;
+            cksum)     cksum "$2" | cut -d' ' -f1 ;;
+        esac
+    fi
+}
+
+_cc_algo() {
+    for _a in sha256sum shasum md5sum md5 cksum; do
+        command -v "$_a" >/dev/null 2>&1 && { echo "$_a"; return; }
+    done
+    echo cksum
+}
+
+_cc_label() {
+    case "$1" in sha256sum|shasum) echo sha256 ;; md5sum|md5) echo md5 ;; *) echo cksum ;; esac
+}
+
+# What gets written into the manifest: normalized, algorithm-labelled.
+_cc_hash() {
+    _a=$(_cc_algo)
+    echo "$(_cc_label "$_a"):$(_cc_digest_with "$_a" "$1" norm)"
+}
+
+# True when manifest entry $2 still describes file $1. Accepts, in order of how
+# the entry was most likely written:
+#   - "<algo>:<digest>" from 2.13.1+, normalized
+#   - "<algo>:<digest>" from 2.13.0, byte-exact
+#   - a bare digest from 2.12.2/2.12.3, algorithm and normalization both unknown
+# Anything that matches under any of those readings counts as pristine. Being
+# permissive here is the safe direction: a false "modified" freezes a skill in
+# place forever and buries the user in .new files, while a false "pristine" can
+# only overwrite a file that is byte-identical to what we would install anyway.
+_cc_hash_matches() {
+    _f="$1"; _rec="$2"
+    # The manifest itself has no file extension, so .gitattributes rules keyed on
+    # *.sh/*.md/*.json never cover it and git may hand it back with CRLF. A
+    # trailing CR then rides along in the recorded digest and every comparison
+    # fails — the same bug this function exists to fix, one level up. Strip it.
+    _rec=${_rec%$'\r'}
+    [ -n "$_rec" ] || return 1
+    [ -f "$_f" ] || return 1
+    case "$_rec" in
+        *:*)
+            _rl=${_rec%%:*}; _rd=${_rec#*:}
+            case "$_rl" in
+                sha256) _cands="sha256sum shasum" ;;
+                md5)    _cands="md5sum md5" ;;
+                *)      _cands="cksum" ;;
+            esac
+            for _al in $_cands; do
+                command -v "$_al" >/dev/null 2>&1 || continue
+                [ "$(_cc_digest_with "$_al" "$_f" norm)" = "$_rd" ] && return 0
+                [ "$(_cc_digest_with "$_al" "$_f" raw)" = "$_rd" ] && return 0
+            done
+            return 1
+            ;;
+    esac
+    for _al in sha256sum shasum md5sum md5 cksum; do
+        command -v "$_al" >/dev/null 2>&1 || continue
+        [ "$(_cc_digest_with "$_al" "$_f" norm)" = "$_rec" ] && return 0
+        [ "$(_cc_digest_with "$_al" "$_f" raw)" = "$_rec" ] && return 0
+    done
+    return 1
+}
+
 # ─── Install hooks ───
+# Framework hooks are always replaced. They are enforcement code, and a
+# customized copy left in place would keep whatever holes the new version
+# closes: a stale git-guard keeps every bypass fixed since. But a local change
+# must not vanish silently, as HUB_Rev1_FW's session-start did in the 2.14.0
+# rollout. A hook counts as locally modified when it matches none of: the
+# template being installed, the hash recorded when we last installed it, or any
+# template version shipped up to 2.14.0 (lib/hook-hashes, for installs that
+# predate the hooks manifest). The backup made above keeps the old copy, and
+# the end of this script lists what was replaced.
 echo -e "${GREEN}Installing hooks...${NC}"
-cp "$SCRIPT_DIR/templates/.claude/hooks/pre-edit-guard.sh" .claude/hooks/
-cp "$SCRIPT_DIR/templates/.claude/hooks/post-error-remind.sh" .claude/hooks/
-cp "$SCRIPT_DIR/templates/.claude/hooks/streak-breaker.sh" .claude/hooks/
-cp "$SCRIPT_DIR/templates/.claude/hooks/session-start.sh" .claude/hooks/
-cp "$SCRIPT_DIR/templates/.claude/hooks/phase-gate.sh" .claude/hooks/
-cp "$SCRIPT_DIR/templates/.claude/hooks/git-guard.sh" .claude/hooks/
-cp "$SCRIPT_DIR/templates/.claude/hooks/action-counter.sh" .claude/hooks/
+HOOKS_MANIFEST=".claude/.cc-discipline-hooks.manifest"
+KNOWN_HOOK_HASHES="$SCRIPT_DIR/lib/hook-hashes"
+_cc_hook_pristine() {   # $1=installed file  $2=template  $3=hook file name
+    _cc_hash_matches "$1" "$(_cc_hash "$2")" && return 0
+    _hrec=$(grep "^$3 " "$HOOKS_MANIFEST" 2>/dev/null | head -1 | cut -d' ' -f2)
+    [ -n "$_hrec" ] && _cc_hash_matches "$1" "$_hrec" && return 0
+    [ -f "$KNOWN_HOOK_HASHES" ] || return 1
+    _ha=$(_cc_algo)
+    [ "$(_cc_label "$_ha")" = sha256 ] || return 1
+    # CRs stripped first: a CRLF checkout of this list must not flag every hook
+    tr -d '\r' < "$KNOWN_HOOK_HASHES" | grep -q "^$3 sha256:$(_cc_digest_with "$_ha" "$1" norm)\$"
+}
+MODIFIED_HOOKS=""
+NEW_HOOKS_MANIFEST=$(mktemp 2>/dev/null || echo ".claude/.hooks-manifest.tmp")
+for hook in pre-edit-guard post-error-remind streak-breaker session-start phase-gate git-guard action-counter; do
+    if [ -f ".claude/hooks/$hook.sh" ] && \
+       ! _cc_hook_pristine ".claude/hooks/$hook.sh" "$SCRIPT_DIR/templates/.claude/hooks/$hook.sh" "$hook.sh"; then
+        MODIFIED_HOOKS="$MODIFIED_HOOKS $hook.sh"
+    fi
+    cp "$SCRIPT_DIR/templates/.claude/hooks/$hook.sh" .claude/hooks/
+    echo "$hook.sh $(_cc_hash ".claude/hooks/$hook.sh")" >> "$NEW_HOOKS_MANIFEST"
+done
+mv "$NEW_HOOKS_MANIFEST" "$HOOKS_MANIFEST"
 chmod +x .claude/hooks/*.sh
 
 # ─── Check jq availability ───
@@ -321,9 +467,13 @@ else
         TEMP_SETTINGS=$(mktemp)
         MERGE_OK=false
 
+        # is_cc must name every hook this framework registers. It once omitted
+        # git-guard, so each jq upgrade kept the old git-guard entry and appended
+        # another; one install had accumulated eleven. With git-guard listed, the
+        # next upgrade filters every old entry out and adds exactly one back.
         if jq -s '
           .[0] as $e | .[1] as $t |
-          def is_cc: .hooks | any(.command | test("pre-edit-guard|streak-breaker|post-error-remind|session-start|phase-gate|action-counter"));
+          def is_cc: .hooks | any(.command | test("pre-edit-guard|streak-breaker|post-error-remind|session-start|phase-gate|action-counter|git-guard"));
           def merge($ev): (($e.hooks[$ev] // []) | map(select(is_cc | not))) + ($t.hooks[$ev] // []);
           $e * {
             hooks: (($e.hooks // {}) + {
@@ -403,104 +553,6 @@ KEPT_RETIRED=""
 OLD_MANIFEST=$(mktemp 2>/dev/null || echo ".claude/.skills-manifest.old")
 [ -f "$SKILLS_MANIFEST" ] && cp "$SKILLS_MANIFEST" "$OLD_MANIFEST"
 
-# ─── Skill content hashing ───
-# Two properties matter here, and both were learned the hard way.
-#
-# 1. Record WHICH algorithm produced a digest. The fallback below resolves
-#    differently depending on what is installed, so a manifest holding a bare
-#    digest silently mis-compares the moment tool availability changes — every
-#    hash mismatches, every retired skill looks user-modified, and the
-#    retirement pass does nothing. (fixed 2026-08-28, before 2.13.0 shipped.)
-#
-# 2. Hash line-ending-NORMALIZED content, not raw bytes. Projects that commit
-#    .claude/ and run with core.autocrlf=true and no .gitattributes get their
-#    SKILL.md rewritten to CRLF by git on checkout. Byte-exact comparison then
-#    reports every skill as modified, with the same two consequences as above
-#    plus a .new file dropped beside every skill on every upgrade. Measured on
-#    one install: the file differed from its manifest entry by exactly 44 bytes
-#    across 44 lines, and matched perfectly once normalized. (fixed 2026-08-28)
-#
-# sha256sum and `shasum -a 256` produce identical digests, so both label sha256.
-
-_cc_digest_with() {   # $1=tool  $2=file  $3=norm|raw  ->  bare digest
-    if [ "$3" = "norm" ]; then
-        case "$1" in
-            sha256sum) sed 's/\r$//' "$2" | sha256sum | cut -d' ' -f1 ;;
-            shasum)    sed 's/\r$//' "$2" | shasum -a 256 | cut -d' ' -f1 ;;
-            md5sum)    sed 's/\r$//' "$2" | md5sum | cut -d' ' -f1 ;;
-            md5)       sed 's/\r$//' "$2" | md5 -q ;;
-            cksum)     sed 's/\r$//' "$2" | cksum | cut -d' ' -f1 ;;
-        esac
-    else
-        case "$1" in
-            sha256sum) sha256sum "$2" | cut -d' ' -f1 ;;
-            shasum)    shasum -a 256 "$2" | cut -d' ' -f1 ;;
-            md5sum)    md5sum "$2" | cut -d' ' -f1 ;;
-            md5)       md5 -q "$2" ;;
-            cksum)     cksum "$2" | cut -d' ' -f1 ;;
-        esac
-    fi
-}
-
-_cc_algo() {
-    for _a in sha256sum shasum md5sum md5 cksum; do
-        command -v "$_a" >/dev/null 2>&1 && { echo "$_a"; return; }
-    done
-    echo cksum
-}
-
-_cc_label() {
-    case "$1" in sha256sum|shasum) echo sha256 ;; md5sum|md5) echo md5 ;; *) echo cksum ;; esac
-}
-
-# What gets written into the manifest: normalized, algorithm-labelled.
-_cc_hash() {
-    _a=$(_cc_algo)
-    echo "$(_cc_label "$_a"):$(_cc_digest_with "$_a" "$1" norm)"
-}
-
-# True when manifest entry $2 still describes file $1. Accepts, in order of how
-# the entry was most likely written:
-#   - "<algo>:<digest>" from 2.13.1+, normalized
-#   - "<algo>:<digest>" from 2.13.0, byte-exact
-#   - a bare digest from 2.12.2/2.12.3, algorithm and normalization both unknown
-# Anything that matches under any of those readings counts as pristine. Being
-# permissive here is the safe direction: a false "modified" freezes a skill in
-# place forever and buries the user in .new files, while a false "pristine" can
-# only overwrite a file that is byte-identical to what we would install anyway.
-_cc_hash_matches() {
-    _f="$1"; _rec="$2"
-    # The manifest itself has no file extension, so .gitattributes rules keyed on
-    # *.sh/*.md/*.json never cover it and git may hand it back with CRLF. A
-    # trailing CR then rides along in the recorded digest and every comparison
-    # fails — the same bug this function exists to fix, one level up. Strip it.
-    _rec=${_rec%$'\r'}
-    [ -n "$_rec" ] || return 1
-    [ -f "$_f" ] || return 1
-    case "$_rec" in
-        *:*)
-            _rl=${_rec%%:*}; _rd=${_rec#*:}
-            case "$_rl" in
-                sha256) _cands="sha256sum shasum" ;;
-                md5)    _cands="md5sum md5" ;;
-                *)      _cands="cksum" ;;
-            esac
-            for _al in $_cands; do
-                command -v "$_al" >/dev/null 2>&1 || continue
-                [ "$(_cc_digest_with "$_al" "$_f" norm)" = "$_rd" ] && return 0
-                [ "$(_cc_digest_with "$_al" "$_f" raw)" = "$_rd" ] && return 0
-            done
-            return 1
-            ;;
-    esac
-    for _al in sha256sum shasum md5sum md5 cksum; do
-        command -v "$_al" >/dev/null 2>&1 || continue
-        [ "$(_cc_digest_with "$_al" "$_f" norm)" = "$_rec" ] && return 0
-        [ "$(_cc_digest_with "$_al" "$_f" raw)" = "$_rec" ] && return 0
-    done
-    return 1
-}
-
 for skill_dir in "$SCRIPT_DIR"/templates/.claude/skills/*/; do
     [ -d "$skill_dir" ] || continue
     skill_name=$(basename "$skill_dir")
@@ -640,6 +692,9 @@ fi
 if [ ! -f "docs/debug-log.md" ]; then
     cp "$SCRIPT_DIR/templates/docs/debug-log.md" docs/
 fi
+if [ ! -f "docs/todo.md" ]; then
+    cp "$SCRIPT_DIR/templates/docs/todo.md" docs/
+fi
 
 # ─── Install auto memory (symlink to .claude/memory/) ───
 echo -e "${GREEN}Installing auto memory...${NC}"
@@ -762,6 +817,23 @@ echo -e "${CYAN}║  Setup complete!                              ║${NC}"
 echo -e "${CYAN}╚══════════════════════════════════════════════╝${NC}"
 echo ""
 
+# Anything the user has to act on goes here, where it cannot scroll past
+# unseen. Rollouts that capture this output must surface these lines too.
+if [ -n "$MODIFIED_HOOKS" ] || [ -n "$PRESERVED_SKILLS" ]; then
+    echo -e "${YELLOW}Needs your attention:${NC}"
+    if [ -n "$MODIFIED_HOOKS" ]; then
+        echo -e "  ${YELLOW}Framework hooks with local changes were REPLACED:${NC}$MODIFIED_HOOKS"
+        echo "    Your versions are in ${BACKUP_DIR}/hooks/"
+        echo "    Framework hooks are overwritten on every upgrade. Keep project-specific"
+        echo "    behaviour in a hook of your own: its own file, registered in settings.json."
+    fi
+    if [ -n "$PRESERVED_SKILLS" ]; then
+        echo -e "  ${YELLOW}Skills you edited were kept; the new templates wait beside them:${NC}${PRESERVED_SKILLS}"
+        echo "    Compare: diff .claude/skills/<name>/SKILL.md{,.new}"
+    fi
+    echo ""
+fi
+
 if [ "$INSTALL_MODE" = "fresh" ]; then
     echo -e "Created files:"
     echo -e "  ${GREEN}CLAUDE.md${NC}                    ← Project rules (fill in [TODO] sections)"
@@ -771,6 +843,7 @@ if [ "$INSTALL_MODE" = "fresh" ]; then
     echo -e "  ${GREEN}.claude/skills/${NC}              ← Skills (run 'npx cc-discipline status' to list)"
     echo -e "  ${GREEN}.claude/settings.json${NC}        ← Hooks configuration"
     echo -e "  ${GREEN}docs/progress.md${NC}             ← Progress log (maintained by Claude)"
+    echo -e "  ${GREEN}docs/todo.md${NC}                 ← Open work: Now / Later"
     echo -e "  ${GREEN}docs/debug-log.md${NC}            ← Debug log (maintained by Claude)"
     echo -e "  ${GREEN}.claude/memory/${NC}              ← Auto memory (symlinked, lives in repo)"
     echo ""
@@ -794,6 +867,7 @@ else
     echo -e "What was ${GREEN}NOT${NC} touched:"
     echo -e "  CLAUDE.md                    ← Your project info is safe"
     echo -e "  docs/progress.md             ← Your progress records are safe"
+    echo -e "  docs/todo.md                 ← Your open items are safe (created only if missing)"
     echo -e "  docs/debug-log.md            ← Your debug logs are safe"
     echo -e "  Your custom rules/agents     ← Untouched (we only add our files)"
     echo ""

package/lib/doctor.sh

@@ -32,7 +32,7 @@ fi
 # 2. Core rules
 echo ""
 echo "Core rules:"
-for i in 00 01 02 03 04 05 06 07; do
+for i in 00 01 03 04 05 06 07; do   # 02 retired 2026-09-23
     FILE=$(ls .claude/rules/${i}-*.md 2>/dev/null | head -1)
     if [ -n "$FILE" ]; then
         ok "$(basename "$FILE")"
@@ -60,23 +60,18 @@ done
 echo ""
 echo "Hook registration:"
 if [ -f ".claude/settings.json" ]; then
-    if command -v jq &>/dev/null; then
-        CONTENT=$(cat .claude/settings.json)
-        for hook in pre-edit-guard streak-breaker post-error-remind session-start phase-gate action-counter git-guard; do
-            if echo "$CONTENT" | grep -q "$hook"; then
-                ok "${hook} registered"
-            else
-                fail "${hook} NOT registered in settings.json"
-            fi
-        done
-    else
-        warn "jq not installed — cannot verify hook registration details"
-        if grep -q "pre-edit-guard" .claude/settings.json 2>/dev/null; then
-            ok "settings.json contains hook references"
+    # A text search is all this needs, so it runs the same with or without jq.
+    # The old jq-less branch looked only for pre-edit-guard, so an install whose
+    # settings.json never registered git-guard (possible after a jq-less upgrade,
+    # which leaves settings.json alone) was reported healthy.
+    CONTENT=$(cat .claude/settings.json)
+    for hook in pre-edit-guard streak-breaker post-error-remind session-start phase-gate action-counter git-guard; do
+        if echo "$CONTENT" | grep -q "$hook"; then
+            ok "${hook} registered"
         else
-            fail "settings.json doesn't reference any hooks"
+            fail "${hook} NOT registered in settings.json"
         fi
-    fi
+    done
 else
     fail "settings.json missing"
 fi
@@ -102,6 +97,13 @@ for skill_dir in .claude/skills/*/; do
     SKILL_FOUND=$((SKILL_FOUND + 1))
 done
 [ "$SKILL_FOUND" -eq 0 ] && warn "No skills installed (optional)"
+# A skill the user edited is kept on upgrade and the new template is written
+# beside it. Nothing else reminds anyone that it is waiting.
+PENDING=""
+for f in .claude/skills/*/SKILL.md.new; do
+    [ -f "$f" ] && PENDING="$PENDING $(basename "$(dirname "$f")")"
+done
+[ -n "$PENDING" ] && warn "New skill templates waiting to be merged:$PENDING — diff .claude/skills/<name>/SKILL.md{,.new}"
 
 # 7. jq
 echo ""
@@ -130,6 +132,11 @@ if [ -f "docs/progress.md" ]; then
 else
     warn "No docs/progress.md"
 fi
+if [ -f "docs/todo.md" ]; then
+    ok "docs/todo.md"
+else
+    warn "No docs/todo.md — run upgrade to create it"
+fi
 
 # Summary
 echo ""
@@ -143,3 +150,6 @@ else
     echo "Run 'npx cc-discipline upgrade' to fix missing files."
 fi
 echo ""
+
+# Non-zero when there are critical issues, so scripts and CI can act on the result.
+[ "$ISSUES" -eq 0 ] || exit 1

package/lib/hook-hashes

@@ -0,0 +1,26 @@
+# sha256 of every version of each framework hook ever committed to templates/,
+# up to 2.14.0, CRs stripped before hashing. init.sh uses it to tell an older
+# shipped hook from a locally modified one in installs that predate the hooks
+# manifest. Frozen: installs from 2.15.0 on record what they got in
+# .claude/.cc-discipline-hooks.manifest instead. Generated 2026-09-24.
+action-counter.sh sha256:2c3b514017c528771c78997c69db454e2b5dcdbcb813d70f4a18392d4da02f89
+action-counter.sh sha256:6befc0b53a4f245fa4b9cbbadc4fca4c524ea66a8d000cc7e388363a906509a2
+action-counter.sh sha256:9a213ff10ade78193e761f4443c51cc9d8a5242525a6177f0d084d81fa256070
+git-guard.sh sha256:11a210bebccb6c82ce7e42de4a29d8fb10507722cff1d5a2346ebfc1863a5bb0
+git-guard.sh sha256:70fe3e335b6b142bb193912b76735386553d8187ddf2d934f1f49a7e949d424e
+git-guard.sh sha256:c391e51a8c0c20a7278695aeee4c46ed464614dccdb1acc5ca7728221ae0c84c
+git-guard.sh sha256:cb650c0532cd6bb6595ddff375195ad2338df422172663769dccdcbf41b3c354
+git-guard.sh sha256:dc55636e9847cc76f31c1ced71b5b6c7ea2ba9a8380347a8fca5332e162e8e6d
+phase-gate.sh sha256:7cbd2ec05d5ab9d1e2919c327a975a1b082ef27684e5d0effdf664f17efbedff
+post-error-remind.sh sha256:389ab860dfb217cd24253e85d28add3961155158961beffaabb9e2e6fa725c1f
+post-error-remind.sh sha256:83b9cbb836af45889bd06e62feebc71a44c741c0cc8b40d8dff2e6d7bf21c7a6
+pre-edit-guard.sh sha256:07c8a3b9e2c87feff1d11dcb195175cf3d6f421968dea17981e9fc573e9caf24
+pre-edit-guard.sh sha256:3be58e3f0a62842ac44a20581275a9bb3cc597439db2e16602bb87bcf3762fb9
+pre-edit-guard.sh sha256:6daf162b6c9835e80960f873d0f9b514065fe726f70dda7b524dbc9cf3675f52
+pre-edit-guard.sh sha256:ae88735efb05dab465f40a1e6bcf7b808fc8dc14d7695aad0e9f4a273d7b5fb8
+pre-edit-guard.sh sha256:c11aaf1da9fab45501478079ed3937321d2d6213c84d374671e5bd6699d08738
+session-start.sh sha256:5d147dae576fe2443b13410849f97bc7edf0d6c92ad26ddf1fd5b1ef32055890
+session-start.sh sha256:60dc913a7d35f6c119ee465730e00f42deabd057e68c935f96a00511663feaaa
+session-start.sh sha256:7cd80aa4c1873851a4c9c0797369bfa9bc1fbce12672ce830748ba8d469977d3
+streak-breaker.sh sha256:7782280af6c40b9dfd58c99f7c7bcffc58f53e247edfab242d5b5454a56cf79a
+streak-breaker.sh sha256:cb667aee973a72380958241e349359b07ea7711b405abdf68ab626ef5211f1f4

package/lib/status.sh

@@ -72,6 +72,11 @@ for skill_dir in .claude/skills/*/; do
 done
 SKILL_COUNT=$(echo "$SKILLS" | wc -w | tr -d ' ')
 echo -e "${GREEN}${SKILL_COUNT}${NC} (${SKILLS% })"
+PENDING=""
+for f in .claude/skills/*/SKILL.md.new; do
+    [ -f "$f" ] && PENDING="$PENDING /$(basename "$(dirname "$f")")"
+done
+[ -n "$PENDING" ] && echo -e "  ${YELLOW}New templates waiting to be merged:${NC}${PENDING} (see: npx cc-discipline doctor)"
 
 # Settings
 echo -n "Settings: "

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-discipline",
-  "version": "2.13.6",
+  "version": "2.15.1",
   "description": "Discipline framework for Claude Code — rules, hooks, and agents that keep AI on track",
   "bin": {
     "cc-discipline": "bin/cli.js"