claude-dev-env 4.3.0 → 7.1.0

package/.agents/skills/prototype/scripts/test_probe_sandbox_safety.py

@@ -1,312 +0,0 @@
-"""Tests for the sandbox safety-hook probe.
-
-The block-detection unit tests drive fixture hook scripts, and the
-integration tests point a settings file at the real installed safety hooks
-to prove they block their probe payloads end to end.
-"""
-
-from __future__ import annotations
-
-import importlib.util
-import json
-import sys
-from pathlib import Path
-from types import ModuleType
-
-from prototype_scripts_constants.config.build_sandbox_settings_constants import (
-    ALL_SAFETY_HOOK_SCRIPT_BASENAMES,
-    COMMAND_KEY,
-    HOOKS_KEY,
-    MATCHER_KEY,
-    PRE_TOOL_USE_KEY,
-)
-from prototype_scripts_constants.config.probe_sandbox_safety_constants import (
-    DESTRUCTIVE_PROBE_COMMAND,
-    ENVELOPE_TOOL_INPUT_KEY,
-    ENVELOPE_TOOL_NAME_KEY,
-    PII_PROBE_TOKEN_PREFIX,
-    PII_PROBE_TOOL_NAME,
-    PROBE_FAILURE_EXIT_CODE,
-    PROBE_SUCCESS_EXIT_CODE,
-    TOOL_INPUT_COMMAND_KEY,
-    TOOL_INPUT_CONTENT_KEY,
-)
-
-SCRIPTS_DIRECTORY = Path(__file__).resolve().parent
-BUILDER_PATH = SCRIPTS_DIRECTORY / "build_sandbox_settings.py"
-PROBE_PATH = SCRIPTS_DIRECTORY / "probe_sandbox_safety.py"
-HOOKS_BLOCKING_DIRECTORY = SCRIPTS_DIRECTORY.parents[3] / "hooks" / "blocking"
-
-PII_HOOK_BASENAME = ALL_SAFETY_HOOK_SCRIPT_BASENAMES[0]
-DESTRUCTIVE_HOOK_BASENAME = ALL_SAFETY_HOOK_SCRIPT_BASENAMES[1]
-
-DENY_HOOK_SOURCE = (
-    "import json, sys\n"
-    "sys.stdout.write(json.dumps("
-    '{"hookSpecificOutput": {"permissionDecision": "deny"}}))\n'
-)
-ASK_HOOK_SOURCE = (
-    "import json, sys\n"
-    "sys.stdout.write(json.dumps("
-    '{"hookSpecificOutput": {"permissionDecision": "ask"}}))\n'
-)
-ALLOW_HOOK_SOURCE = "import sys\nsys.exit(0)\n"
-
-
-def load_module_from_path(module_name: str, module_path: Path) -> ModuleType:
-    spec = importlib.util.spec_from_file_location(module_name, module_path)
-    assert spec is not None
-    assert spec.loader is not None
-    loaded_module = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(loaded_module)
-    return loaded_module
-
-
-def load_probe_module() -> ModuleType:
-    return load_module_from_path("probe_sandbox_safety", PROBE_PATH)
-
-
-def load_builder_module() -> ModuleType:
-    return load_module_from_path("build_sandbox_settings", BUILDER_PATH)
-
-
-def quoted_command(script_path: Path) -> str:
-    return f'"{sys.executable}" "{script_path}"'
-
-
-def real_hook_settings_document() -> dict:
-    pii_hook_path = HOOKS_BLOCKING_DIRECTORY / PII_HOOK_BASENAME
-    destructive_hook_path = HOOKS_BLOCKING_DIRECTORY / DESTRUCTIVE_HOOK_BASENAME
-    return {
-        HOOKS_KEY: {
-            PRE_TOOL_USE_KEY: [
-                {
-                    MATCHER_KEY: "Write",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(pii_hook_path)}],
-                },
-                {
-                    MATCHER_KEY: "Bash",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(destructive_hook_path)}],
-                },
-            ]
-        }
-    }
-
-
-def real_hook_deny_mode_settings_document() -> dict:
-    settings_document = real_hook_settings_document()
-    settings_document["env"] = {"CLAUDE_DESTRUCTIVE_DENY_MODE": "1"}
-    return settings_document
-
-
-def write_settings_file(tmp_path: Path, settings_document: dict) -> Path:
-    settings_path = tmp_path / "sandbox-settings.json"
-    settings_path.write_text(json.dumps(settings_document), encoding="utf-8")
-    return settings_path
-
-
-def test_settings_environment_overrides_reads_the_env_block() -> None:
-    probe = load_probe_module()
-    environment_overrides = probe.settings_environment_overrides(
-        real_hook_deny_mode_settings_document()
-    )
-    assert environment_overrides == {"CLAUDE_DESTRUCTIVE_DENY_MODE": "1"}
-
-
-def test_settings_environment_overrides_empty_without_an_env_block() -> None:
-    probe = load_probe_module()
-    environment_overrides = probe.settings_environment_overrides(
-        real_hook_settings_document()
-    )
-    assert environment_overrides == {}
-
-
-def test_main_exits_zero_when_the_real_destructive_hook_denies_in_deny_mode(
-    tmp_path: Path,
-) -> None:
-    probe = load_probe_module()
-    settings_path = write_settings_file(
-        tmp_path, real_hook_deny_mode_settings_document()
-    )
-    exit_code = probe.main(["--settings", str(settings_path)])
-    assert exit_code == PROBE_SUCCESS_EXIT_CODE
-
-
-def test_built_deny_environment_denies_real_destructive_hook() -> None:
-    builder_module = load_builder_module()
-    settings_document = builder_module.build_minimal_settings(
-        builder_module.resolve_safety_hook_entries(real_hook_settings_document())
-    )
-    probe_module = load_probe_module()
-    probe_payload = probe_module.build_probe_payload_for_basename(DESTRUCTIVE_HOOK_BASENAME)
-    destructive_hook_path = HOOKS_BLOCKING_DIRECTORY / DESTRUCTIVE_HOOK_BASENAME
-    destructive_hook_tokens = probe_module.parse_command_argv(
-        quoted_command(destructive_hook_path)
-    )
-    is_hook_blocking = probe_module.hook_blocks_probe(
-        destructive_hook_tokens,
-        probe_payload,
-        settings_document["env"],
-    )
-    assert is_hook_blocking is True
-
-
-def test_pii_basename_probe_payload_carries_the_secret() -> None:
-    probe = load_probe_module()
-    probe_payload = probe.build_probe_payload_for_basename(PII_HOOK_BASENAME)
-    assert probe_payload[ENVELOPE_TOOL_NAME_KEY] == PII_PROBE_TOOL_NAME
-    content = probe_payload[ENVELOPE_TOOL_INPUT_KEY][TOOL_INPUT_CONTENT_KEY]
-    assert PII_PROBE_TOKEN_PREFIX in content
-
-
-def test_destructive_basename_probe_payload_carries_the_command() -> None:
-    probe = load_probe_module()
-    probe_payload = probe.build_probe_payload_for_basename(DESTRUCTIVE_HOOK_BASENAME)
-    command = probe_payload[ENVELOPE_TOOL_INPUT_KEY][TOOL_INPUT_COMMAND_KEY]
-    assert command == DESTRUCTIVE_PROBE_COMMAND
-
-
-def test_find_hook_command_for_basename_returns_the_matching_command() -> None:
-    probe = load_probe_module()
-    settings_document = real_hook_settings_document()
-    command = probe.find_hook_command_for_basename(settings_document, PII_HOOK_BASENAME)
-    assert command is not None
-    assert PII_HOOK_BASENAME in command
-    assert probe.find_hook_command_for_basename(settings_document, "absent.py") is None
-
-
-def test_parse_command_argv_splits_and_unquotes_the_command() -> None:
-    probe = load_probe_module()
-    command_argv = probe.parse_command_argv('"/usr/bin/python" "/a/b hook.py"')
-    assert command_argv == ["/usr/bin/python", "/a/b hook.py"]
-
-
-def test_hook_blocks_probe_reports_true_for_a_deny_hook(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    deny_hook_path = tmp_path / "deny_hook.py"
-    deny_hook_path.write_text(DENY_HOOK_SOURCE, encoding="utf-8")
-    command_argv = [sys.executable, str(deny_hook_path)]
-    probe_payload = probe.build_probe_payload_for_basename(DESTRUCTIVE_HOOK_BASENAME)
-    assert probe.hook_blocks_probe(command_argv, probe_payload, {}) is True
-
-
-def test_hook_blocks_probe_reports_false_for_an_ask_hook(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    ask_hook_path = tmp_path / "ask_hook.py"
-    ask_hook_path.write_text(ASK_HOOK_SOURCE, encoding="utf-8")
-    command_argv = [sys.executable, str(ask_hook_path)]
-    probe_payload = probe.build_probe_payload_for_basename(DESTRUCTIVE_HOOK_BASENAME)
-    assert probe.hook_blocks_probe(command_argv, probe_payload, {}) is False
-
-
-def test_hook_blocks_probe_reports_false_for_an_allow_hook(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    allow_hook_path = tmp_path / "allow_hook.py"
-    allow_hook_path.write_text(ALLOW_HOOK_SOURCE, encoding="utf-8")
-    command_argv = [sys.executable, str(allow_hook_path)]
-    probe_payload = probe.build_probe_payload_for_basename(DESTRUCTIVE_HOOK_BASENAME)
-    assert probe.hook_blocks_probe(command_argv, probe_payload, {}) is False
-
-
-def test_probe_safety_hook_blocks_against_the_real_pii_hook() -> None:
-    probe = load_probe_module()
-    settings_document = real_hook_settings_document()
-    assert probe.probe_safety_hook(settings_document, PII_HOOK_BASENAME) is True
-
-
-def test_main_exits_three_when_the_real_destructive_hook_only_asks(
-    tmp_path: Path,
-) -> None:
-    probe = load_probe_module()
-    settings_path = write_settings_file(tmp_path, real_hook_settings_document())
-    exit_code = probe.main(["--settings", str(settings_path)])
-    assert exit_code == PROBE_FAILURE_EXIT_CODE
-
-
-def test_main_exits_zero_when_both_real_hooks_hard_deny(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    deny_pii_hook_path = tmp_path / PII_HOOK_BASENAME
-    deny_pii_hook_path.write_text(DENY_HOOK_SOURCE, encoding="utf-8")
-    deny_destructive_hook_path = tmp_path / DESTRUCTIVE_HOOK_BASENAME
-    deny_destructive_hook_path.write_text(DENY_HOOK_SOURCE, encoding="utf-8")
-    settings_document = {
-        HOOKS_KEY: {
-            PRE_TOOL_USE_KEY: [
-                {
-                    MATCHER_KEY: "Write",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(deny_pii_hook_path)}],
-                },
-                {
-                    MATCHER_KEY: "Bash",
-                    HOOKS_KEY: [
-                        {COMMAND_KEY: quoted_command(deny_destructive_hook_path)}
-                    ],
-                },
-            ]
-        }
-    }
-    settings_path = write_settings_file(tmp_path, settings_document)
-    exit_code = probe.main(["--settings", str(settings_path)])
-    assert exit_code == PROBE_SUCCESS_EXIT_CODE
-
-
-def test_main_exits_three_when_a_hook_allows(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    allow_pii_hook_path = tmp_path / PII_HOOK_BASENAME
-    allow_pii_hook_path.write_text(ALLOW_HOOK_SOURCE, encoding="utf-8")
-    destructive_hook_path = HOOKS_BLOCKING_DIRECTORY / DESTRUCTIVE_HOOK_BASENAME
-    settings_document = {
-        HOOKS_KEY: {
-            PRE_TOOL_USE_KEY: [
-                {
-                    MATCHER_KEY: "Write",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(allow_pii_hook_path)}],
-                },
-                {
-                    MATCHER_KEY: "Bash",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(destructive_hook_path)}],
-                },
-            ]
-        }
-    }
-    settings_path = write_settings_file(tmp_path, settings_document)
-    exit_code = probe.main(["--settings", str(settings_path)])
-    assert exit_code == PROBE_FAILURE_EXIT_CODE
-
-
-def test_main_exits_three_when_the_settings_file_is_absent(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    absent_settings_path = tmp_path / "does-not-exist.json"
-    exit_code = probe.main(["--settings", str(absent_settings_path)])
-    assert exit_code == PROBE_FAILURE_EXIT_CODE
-
-
-def test_main_exits_three_when_the_settings_file_is_invalid_json(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    settings_path = tmp_path / "sandbox-settings.json"
-    settings_path.write_text("{not valid json", encoding="utf-8")
-    exit_code = probe.main(["--settings", str(settings_path)])
-    assert exit_code == PROBE_FAILURE_EXIT_CODE
-
-
-def test_main_exits_three_when_a_hook_script_is_bogus(tmp_path: Path) -> None:
-    probe = load_probe_module()
-    bogus_pii_hook_path = tmp_path / PII_HOOK_BASENAME
-    destructive_hook_path = HOOKS_BLOCKING_DIRECTORY / DESTRUCTIVE_HOOK_BASENAME
-    settings_document = {
-        HOOKS_KEY: {
-            PRE_TOOL_USE_KEY: [
-                {
-                    MATCHER_KEY: "Write",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(bogus_pii_hook_path)}],
-                },
-                {
-                    MATCHER_KEY: "Bash",
-                    HOOKS_KEY: [{COMMAND_KEY: quoted_command(destructive_hook_path)}],
-                },
-            ]
-        }
-    }
-    settings_path = write_settings_file(tmp_path, settings_document)
-    exit_code = probe.main(["--settings", str(settings_path)])
-    assert exit_code == PROBE_FAILURE_EXIT_CODE

package/.agents/skills/prototype/workflows/promotion.md

@@ -1,25 +0,0 @@
-# Promotion workflow (Phase 2)
-
-Turn a successful proof-of-concept into a real, verified change. Run every step in the normal, fully-hooked session — never inside the `--bare` sandbox. The sandbox produced a reference build; promotion re-verifies it to standard and often rewrites parts of it.
-
-## Seed the task list first
-
-Register every item in `reference/promotion-tasks.md` as a session task (`TaskCreate`, or `TodoWrite` if that is the host tool). Work only from the task list. Mark each complete with evidence — a command result, a path, a review record, or a skill's return.
-
-## The clean-room protocol
-
-The task seeds carry the full ordered detail. The shape:
-
-1. **Confirm** the POC is worth promoting and the user wants it shipped.
-2. **Fresh branch** off freshly-fetched `origin/main` via `fresh-branch` — clean history, based on live upstream.
-3. **Bring content as an uncommitted diff.** Copy the POC's file changes into the new branch's working tree. Do not cherry-pick or merge the sandbox commits; the sandbox history stays behind.
-4. **Cleanup.** Remove scratch files, debug dumps, and temp helpers the POC created (`cleanup-temp-files` rule).
-5. **Privacy sweep** via `privacy-hygiene` over the diff.
-6. **Review and verify** the real diff against the [review guide](../../skills-archived/reviews/SKILL.md#review-workflow). Record the checks run and repair every required finding.
-7. **Commit and PR.** After the review and verification record is complete, commit by hand per the `git-workflow` rule, then open a draft PR.
-8. **State the honest limitations** from `reference/honest-limitations.md` in the PR body or to the user.
-9. **Converge** by handing the PR to `autoconverge` by default; use `pr-converge` for paced ticks or `bugteam` for an open-loop audit.
-
-## Why the clean room, not a push
-
-`code_rules_enforcer` is a write-time Write/Edit gate. Content that lands through `git apply`, `git checkout`, or cherry-pick receives the clean-room controls in steps 4–6: cleanup, privacy review, and review and verification under the [review guide](../../skills-archived/reviews/SKILL.md#review-workflow). The promotion record states the checks run and the remaining TDD limitation.

package/.agents/skills/prototype/workflows/sandbox.md

@@ -1,35 +0,0 @@
-# Sandbox workflow (Phase 1)
-
-Stand up an isolated worktree where a hookless agent builds a proof-of-concept with zero standards friction. Only two safety gates stay live: personal-data blocking and destructive-command blocking.
-
-## Step 1 — Isolated worktree
-
-Invoke the `fresh-branch` skill to create a worktree off `origin/main`. Keep the returned `worktree_path` and `base_commit` for the promotion phase. If `fresh-branch` is not installed, stop with the refusal line from `SKILL.md`.
-
-## Step 2 — Minimal safety settings
-
-Run `scripts/build_sandbox_settings.py --out <worktree>/.prototype-sandbox-settings.json`.
-
-It reads the live `~/.claude/settings.json`, resolves each safety hook's command (the correct interpreter and absolute path for this machine), and registers it on the matchers the sandbox needs — personal-data on Write, Edit, MultiEdit, and Bash; destructive-command on Bash. The write file carries only those two gates, plus an `env` block that sets `CLAUDE_DESTRUCTIVE_DENY_MODE`, so the destructive gate hard-denies a match. A hard deny holds under `--dangerously-skip-permissions`; an `ask` there is auto-resolved.
-
-- Exit 0 → continue with the printed settings path.
-- Exit 2 → one of the two safety hooks could not be resolved from the live settings. Stop; the sandbox cannot be contained without both. Report which one is missing.
-
-## Step 3 — Prove containment
-
-Run `scripts/probe_sandbox_safety.py --settings <settings path>`.
-
-It feeds each safety hook a payload the hook is proven to block and confirms a hard-deny decision — the block that holds even under `--dangerously-skip-permissions`, unlike an `ask` prompt the flag auto-resolves. It runs each hook under the settings' `env` block, so the destructive gate runs in deny mode, the same way the launched session runs it.
-
-- Exit 0 → both gates hard-deny their probe; the sandbox is contained.
-- Exit 3 → a gate allowed its probe, returned an `ask`, or errored. Stop; do not launch an uncontained sandbox. This is a runtime check, not a code read (verify-runtime-state) — do not skip it.
-
-## Step 4 — Launch the hookless session
-
-Run `scripts/launch_sandbox.py --worktree <worktree_path> --settings <settings path> --task-file <task file>`.
-
-It starts a headless `claude -p --bare --dangerously-skip-permissions --settings <settings path>` session in the worktree, so every standards gate is skipped and the two safety gates from the settings file are the only containment. Write the proof-of-concept task to the task file first; the sandbox agent cannot invoke other skills, so the task must be self-contained.
-
-## Step 5 — Judge the result
-
-Read what the sandbox built and decide whether the proof-of-concept proves the idea. On success, move to `promotion.md`. To discard, remove the worktree with `git worktree remove --force <worktree_path>`.

package/.agents/skills/rebase/.claude/CLAUDE.md

@@ -1 +0,0 @@
-@../AGENTS.md

package/.agents/skills/rebase/AGENTS.md

@@ -1 +0,0 @@
-

package/.agents/skills/rebase/SKILL.md

@@ -1,178 +0,0 @@
----
-name: rebase
-description: >-
-  Rebases a branch onto its base ref with the verification gates that catch
-  logically broken results before pushing. Use when the user invokes `/rebase`,
-  says 'rebase this branch', 'PR has merge conflicts', or 'rebase onto main', or
-  asks for a force-push to update a remote branch's history.
----
-
-# /rebase
-
-Rebase the current branch (or a named branch's worktree) onto its correct base ref. Resolve conflicts. Verify the result is **logically correct**, not just textually clean. Push only after explicit authorization.
-
-The default failure mode is shipping a rebase that compiled but doesn't run. This skill exists to prevent that.
-
-## When to rebase vs. merge
-
-> **Decision thresholds**
->
-> | Threshold | Value |
-> |---|---|
-> | Maximum commits for solo rebase | 5 |
-> | Divergence age that triggers merge-instead | 2 weeks |
-
-**Default to rebase** when:
-
-- Solo branch (you are the only author of the commits being rebased).
-- 1–5 commits ahead of base (see Decision thresholds above).
-- Stacked PR whose base just merged via squash.
-
-**Default to merge** when:
-
-- Branch has multiple authors (force-push would clobber their state).
-- More than 5 commits or more than 2 weeks of divergence (see Decision thresholds above; rebase complexity grows non-linearly).
-- The user said "merge", not "rebase".
-- Open PR with approving reviews already on the current SHA (force-push invalidates them).
-
-When in doubt, ask. Both work; the choice affects history shape, not correctness.
-
-## Phase 1 — Pre-rebase analysis
-
-1. **Resolve the canonical base.** Stacked-PR base refs change when the base PR merges. Always re-resolve:
-
-   ```
-   gh pr view <N> --json baseRefName,mergeable,mergeStateStatus
-   ```
-
-   Trust GitHub's `baseRefName`, not whatever the local branch was originally based on.
-
-2. **Identify the rebase scenario.** Three playbooks:
-
-   | Scenario | Signal | Approach |
-   |---|---|---|
-   | Stacked PR, base merged via squash | base PR `state: MERGED`, base ref redirected to main | Rebase onto main; expect to `--skip` the squash-absorbed commit |
-   | Stacked PR, base still open | base PR `state: OPEN` | Rebase onto base PR's tip, not main |
-   | Long-lived feature branch | many commits, no stacking | Straight `rebase origin/main` |
-
-3. **Fetch fresh.** `git fetch origin <base-ref> <head-ref>` before starting. Stale local refs cause false conflicts.
-
-4. **Read every rebased commit's message.** Author intent lives in commit messages ("removes orphan constants X, Y, Z"). For every named symbol mentioned as deleted or renamed, scan `origin/main` for new consumers — if main has new uses of those symbols, the rebase will produce broken state without conflicting at the textual level.
-
-   **Tool preference for symbol scans** (in order):
-
-   | Tool | Use when | Example |
-   |---|---|---|
-   | `mcp__serena__find_symbol` / `find_referencing_symbols` | Symbol-aware language server is available — definition vs. reference distinction matters, and you want call-site context | `find_referencing_symbols(symbol_name)` returns every caller with file/line and surrounding code |
-   | `Grep` tool (ripgrep) | Local single-repo plain-text scan; no symbol awareness needed | `Grep(pattern, type="py")` — much faster than shell `grep` and respects `.gitignore` |
-   | `grep -rn` | Last resort; only when the above are unavailable | — |
-
-   The Grep tool is the default for plain-text scans (faster than shell grep, respects gitignore). Reach for serena when you need to distinguish "this name is defined here" from "this name is referenced here," which catches false positives from comments, docstrings, and string literals.
-
-   This is the bug that hides best. Don't skip it.
-
-## Phase 2 — During rebase
-
-5. **`--skip` only after verifying content overlap.** When a commit fails to apply because main already has its content (squash-merge case), confirm the content is actually equivalent:
-
-   ```
-   git diff <skipped-commit> origin/<base> -- <files-touched-by-skipped-commit>
-   ```
-
-   Skip only after that diff shows the equivalent content lives in main. Don't skip on the heuristic "main is downstream."
-
-6. **Audit auto-merged files.** Files that git merged without conflict markers are not automatically correct. After each commit applies, run:
-
-   ```
-   git diff --name-only --diff-filter=M ORIG_HEAD
-   ```
-
-   Use `ORIG_HEAD`, which git sets at rebase start; the reflog index `HEAD@{1}` shifts as each rebase step runs and is unreliable mid-rebase. For each modified file with no conflict markers, eyeball the changes — auto-merge can produce duplicate blocks (when both sides added similar content) or silently drop content (when both sides removed adjacent lines). Pay extra attention to `config/`, `constants.*`, and `__init__.py` files where additions often sit near each other.
-
-7. **At every conflict, take both sides' intent seriously.** Read both, then decide based on the post-rebase logical state. Do not reflex-pick HEAD or `origin/main`. Document the resolution reasoning in the commit message if it is non-obvious.
-
-## Phase 3 — Verification gates (mandatory before push)
-
-`py_compile`, `tsc --noEmit`, `cargo check`, etc. validate **syntax and types**, not **import resolution and runtime correctness**. Run real checks.
-
-Before each gate command, state in one line which gate it is and why it applies to this rebase ("post-rebase gate: `pkg_x` carried a conflict resolution, running its suite").
-
-8. **Real import check.** For Python:
-
-   ```
-   python -m compileall -q <package>
-   ```
-
-   Follow immediately with the test-collection step below. `compileall` catches import-time failures across every module file; combined with `--collect-only` it surfaces `NameError`, `AttributeError`, and `ImportError` cases that a syntax-only check misses.
-
-9. **Test collection.** `pytest --collect-only -q` on the changed packages catches NameError, AttributeError, and ImportError surfaces beyond plain imports.
-
-10. **Targeted test run — scoped by content diff.** First check, per candidate package, whether the rebase changed its content at all:
-
-    ```
-    git diff <pre-rebase-tip> HEAD -- <package>
-    ```
-
-    - **Empty diff:** the package's files are byte-for-byte what the branch already carried before the rebase, and that state was verified pre-rebase. The compile and collect-only gates (steps 8–9) cover the remaining import-level risk; skip the package's full suite.
-    - **Non-empty diff, a conflict resolution, or an auto-merged file (step 6) in the package:** run its full suite. Do not push a rebase that dropped or broke test coverage that was passing pre-rebase.
-
-    Capture the pre-rebase tip SHA before the rebase begins; step 15 pins the force-with-lease to that same SHA.
-
-11. **Reference scan for removals/renames.** For every symbol the rebase deleted or renamed (per the commit messages from step 4), scan the post-rebase tree using the same tool-preference order as step 4:
-
-    - **Preferred:** `mcp__serena__find_referencing_symbols` (symbol-aware; ignores false matches in comments and string literals).
-    - **Then:** the `Grep` tool (e.g., `Grep(pattern="<symbol>", type="py")`) for fast in-repo scans.
-    - **Last resort:** `grep -rn "<symbol>" .` (let ripgrep defaults and `.gitignore` handle scoping)
-
-    Any reference outside the rebased commits' own changes is a stale reference. Either update it (with user authorization) or surface it and refuse to push.
-
-12. **"Unchanged" files are not safe.** A rebase can break files it never textually modified if their imports depend on something the rebase removed or renamed. List `git diff --name-only origin/<base>..HEAD`, then for every file NOT in that list but that imports from a file IN that list, manually verify the imports still resolve.
-
-## Phase 4 — Push
-
-13. **Force-push requires explicit authorization.** Auto mode does not bypass this. Before any `git push --force` or `--force-with-lease`:
-
-    - State the rewrite scope: "this rewrites N commits of remote history on branch `<name>`".
-    - State the branch's PR state: "PR #M is OPEN with K approving reviews on the current SHA" (force-push invalidates approvals).
-    - Ask for explicit authorization.
-    - If denied: leave the rebase result locally, report merge-instead as the alternative, stop.
-
-14. **Refuse to force-push** `main`, `master`, `release/*`, `production`, or any branch with more than one unique author. Count unique authors in a cross-platform way: `git log --format='%ae' origin/<branch> | python -c "import sys; print(len(set(sys.stdin)))"`. This form works on both Windows (PowerShell) and Unix without shell pipeline extensions. Surface the refusal; do not ask for authorization on these.
-
-15. **Always `--force-with-lease=<branch>:<sha>`**, never bare `--force`. Pin the lease to the SHA you started from so concurrent pushes are detected as a lease mismatch instead of clobbered.
-
-16. **Confirm mergeability** post-push:
-
-    ```
-    gh pr view <N> --json mergeable,mergeStateStatus,headRefOid
-    ```
-
-    Expect `mergeable: MERGEABLE`, `mergeStateStatus: CLEAN`. Anything else means the rebase didn't actually unblock the PR — investigate before declaring done.
-
-## Anti-patterns (the failure modes this skill prevents)
-
-- **`py_compile` exit 0 → "verified"**. Wrong. Syntax-clean is not import-clean. Always run a real `import` check.
-- **Skipping squash-absorbed commits without diff verification.** Heuristically usually right, occasionally wrong, never confirmed without the diff.
-- **Auditing only `git diff --name-only`.** Files unchanged by the rebase can still break if their imports depended on what the rebase removed.
-- **Force-pushing under "the user asked me to fix the conflicts" interpretation.** Force-push is a separate authorization from "fix this." Ask.
-- **Bare `--force` instead of `--force-with-lease=<branch>:<sha>`.** Loses the safety net against concurrent pushes.
-- **Running full suites for packages the rebase left byte-for-byte the same.** The step-10 content diff settles it in seconds; a long suite on unchanged content stalls the session.
-
-## Quick decision flowchart
-
-```
-Branch shared with others?  ──► merge instead
-Stacked PR, base merged?    ──► rebase onto main, expect --skip
-Stacked PR, base open?      ──► rebase onto base PR tip
-Solo, ≤5 commits ahead?     ──► straight rebase
-
-After rebase, BEFORE push:
-  python -c "import …"      ──► must succeed
-  pytest --collect-only     ──► must succeed
-  pytest, packages w/ diff  ──► must pass
-  symbol scan (serena → Grep) ──► no stale references
-
-Push:
-  not main/master/release   ──► force-with-lease, ask first
-  main/master/release       ──► refuse
-```

package/.agents/skills/review-router/SKILL.md

@@ -1,51 +0,0 @@
----
-name: review-router
-description: >-
-  Resolve and arm one supported `route_review_config` route through the registered Agent|Task gate. Triggers: /review-router and guarded reviewer spawn.
----
-
-# Review Router
-
-Resolve and arm the supported `e-simplify` route. The registered `PreToolUse Agent|Task` hook enforces the exact armed spawn payload.
-
-## When this applies
-
-Use for `/review-router` and route execution after `/review-tier`. Return `UNSUPPORTED_ROUTE` for `e-code-review`; preserve `/e-code-review` behavior.
-
-## Operations
-
-1. Register `reference/task-seeds.md` with the host task tool.
-2. Call `scripts/review_router_cli.py resolve` for the current `route_policy_hash` decision and optional tier override.
-3. Call `arm` for the exact selected slot and dispatch the returned Agent|Task payload.
-4. Let the registered hook enforce the payload, then call `close`.
-
-The route topology is fixed: T1 uses one Luna High slot, T2 uses one Luna Max slot, and T3 uses six ordered Luna High slots.
-
-## Composition
-
-| Peer | When | Produces | Missing behavior |
-|---|---|---|---|
-| `/review-tier` | Before routing | Current tier decision | Return the route request to `/review-tier`. |
-| `/e-simplify` | When cleanup review is requested | Cleanup review request | Return `UNSUPPORTED_ROUTE`. |
-
-## File index
-
-| File | Purpose |
-|---|---|
-| `SKILL.md` | Route contract and operations |
-| `reference/route-policy.json` | Supported route topology |
-| `reference/task-seeds.md` | Current route task seeds |
-| `scripts/review_router.py` | `route_policy_hash` input and route resolution |
-| `scripts/review_router_cli.py` | Resolve, arm, and close operations |
-| `scripts/test_review_router.py` | Route policy tests |
-| `scripts/test_review_router_cli.py` | CLI rejection tests |
-| `scripts/test_review_router_integration.py` | CLI and registered-hook tests |
-| `scripts/review_router_constants/config/constants.py` | Portable route constants |
-| `scripts/review_router_constants/config/__init__.py` | Runtime configuration package |
-| `scripts/review_router_constants/__init__.py` | Constants package |
-| `scripts/conftest.py` | Test import setup |
-
-## Folder map
-
-- `reference/` — route policy and task seeds.
-- `scripts/` — route resolution, CLI operations, and tests.

package/.agents/skills/review-router/reference/route-policy.json

@@ -1,7 +0,0 @@
-{
-  "version": 1,
-  "routes": {
-    "e-simplify": {"status": "SUPPORTED", "skill": "e-simplify", "tiers": ["T1", "T2", "T3"], "models": {"T1": {"role": "executor", "model": "gpt-5.6-luna", "effort": "high", "pass_ids": ["simplify-01"]}, "T2": {"role": "executor", "model": "gpt-5.6-luna", "effort": "max", "pass_ids": ["simplify-01"]}, "T3": {"role": "executor", "model": "gpt-5.6-luna", "effort": "high", "pass_ids": ["simplify-01", "simplify-02", "simplify-03", "simplify-04", "simplify-05", "simplify-06"]}}},
-    "e-code-review": {"status": "UNSUPPORTED_ROUTE", "skill": "e-code-review", "tiers": []}
-  }
-}

package/.agents/skills/review-router/reference/task-seeds.md

@@ -1 +0,0 @@
-Register resolve e-simplify, apply override, arm exact slot, enforce through the registered Agent|Task hook, close the decision, and report unsupported e-code-review as host tasks. Complete each with command output or the current decision/armed record.

package/.agents/skills/review-router/scripts/conftest.py

@@ -1,4 +0,0 @@
-from pathlib import Path
-import sys
-
-sys.path.insert(0, str(Path(__file__).resolve().parent))