claudecode-omc 5.6.8 → 5.11.0

package/bundled/upstream/oh-my-claudecode/skills/ultragoal/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: ultragoal
+description: Durable multi-goal workflow that persists plan/ledger artifacts under .omc/ultragoal and prints Claude /goal handoff text for the active session
+argument-hint: "<brief or subcommand>"
+level: 3
+---
+
+<Purpose>
+Ultragoal breaks a brief into an ordered set of goals, records start/checkpoint/blocker/failure events in a durable append-only ledger, and tells the active Claude agent how to drive the Claude Code `/goal` slash command alongside the plan. It does not — and cannot — mutate Claude `/goal` state from the shell; it persists durable repo state and prints a model-facing handoff that the active agent must act on in-session.
+</Purpose>
+
+<Use_When>
+- The user wants a durable, repo-native way to track an ultragoal across multiple Claude sessions or worktrees
+- The work is large enough to warrant multiple ordered "stories" with attempt counts and per-story evidence
+- The user wants the final completion gated behind ai-slop-cleaner + verification + $code-review
+- The user wants the active Claude `/goal` directive coordinated with the ledger so that a session restart does not lose progress
+</Use_When>
+
+<Do_Not_Use_When>
+- The task is a single small change — use direct delegation or `ralph` instead
+- The user wants the assistant to literally invoke `/goal` itself from the shell — that is not possible; `omc ultragoal` only writes artifacts and prints handoff text
+- The user wants a planning-only artifact with no execution loop — use `plan` instead
+</Do_Not_Use_When>
+
+<Why_This_Exists>
+Claude Code `/goal` is a session-scoped Stop hook: it blocks the session from stopping until a condition holds, and auto-clears on success. That is a great single-session execution primitive, but it loses state across sessions and does not by itself enforce a final review gate. `omc ultragoal` adds a durable plan, ledger, and gating layer so a long multi-step initiative can survive session restarts, fresh worktrees, and review iterations while still leveraging Claude `/goal` to keep the active agent focused.
+</Why_This_Exists>
+
+<How_To_Use>
+
+1. Create a plan from a brief:
+   ```
+   omc ultragoal create-goals --brief-file plan.md
+   ```
+   Or with explicit stories:
+   ```
+   omc ultragoal create-goals --brief "ship the migration" \
+     --goal "Schema::Add new columns" \
+     --goal "Backfill::Backfill rows in batches" \
+     --goal "Cutover::Drop old columns and switch reads"
+   ```
+   The default mode is `aggregate` (one Claude `/goal` covers the run).
+   Pass `--claude-goal-mode per-story` if you want each story to have its own `/goal`.
+
+   **Multi-repo workspaces / parallel sessions:** when several Claude sessions
+   in the same workspace need to run `/ultragoal` concurrently, pass either
+   `--plan-id <stable-id>` or `--auto-plan-id` so the plan is written to
+   `.omc/ultragoal/plans/{planId}/` instead of the shared single-plan path.
+   Without that flag, two sessions creating goals would clobber each other.
+   `--auto-plan-id` derives `{epochMs}-{slug}` from the brief title. Then thread
+   the same `--plan-id <id>` through every subsequent subcommand in that session.
+   Use `omc ultragoal list-plans` to enumerate available planIds when needed.
+
+2. Start (or resume) the next story:
+   ```
+   omc ultragoal complete-goals
+   ```
+   This prints a model-facing handoff. The active Claude agent must read it and:
+   - Confirm/Set the active `/goal` condition in this session.
+   - Work the story.
+   - When the story is complete (and for the final story, after the full quality gate), share back a snapshot of the active `/goal` state and call `checkpoint`.
+
+3. Checkpoint a story:
+   ```
+   omc ultragoal checkpoint --goal-id G001-... --status complete \
+     --evidence "tests/files/PR evidence" \
+     --claude-goal-json '{"goal":{"objective":"...","status":"active"}}'
+   ```
+   For the final story, also pass `--quality-gate-json` containing
+   `aiSlopCleaner`, `verification`, and `codeReview` evidence (all clean).
+
+4. If the final review is not clean, do NOT mark complete. Record blockers:
+   ```
+   omc ultragoal record-review-blockers --goal-id G00X-... \
+     --title "Resolve final code-review blockers" \
+     --objective "Fix the listed review findings and rerun final gates" \
+     --evidence "<the review findings>" \
+     --claude-goal-json '{"goal":{"objective":"...","status":"active"}}'
+   ```
+   This appends a new blocker story and keeps the Claude `/goal` active.
+
+5. Inspect state at any time:
+   ```
+   omc ultragoal status
+   ```
+
+</How_To_Use>
+
+<Important_Limitations>
+- The shell cannot invoke or mutate Claude Code `/goal` state. `omc ultragoal` only persists durable artifacts and prints instructions that the active Claude agent reads and acts on in-session.
+- Snapshots passed via `--claude-goal-json` are model-supplied proof of the active `/goal` state; OMC validates them for textual consistency with the plan's expected objective and ledger event, but it cannot independently observe Claude `/goal` state.
+- If the Claude `/goal` slash command is renamed or restructured, only the handoff wording needs to change; the reconciliation logic is name-agnostic.
+</Important_Limitations>

package/bundled/upstream/oh-my-claudecode/skills/ultraqa/SKILL.md

@@ -15,17 +15,21 @@ You are now in **ULTRAQA** mode - an autonomous QA cycling workflow that runs un
 
 **Cycle**: qa-tester → architect verification → fix → repeat
 
+## Relationship to `/goal`, Ralph, Team, and Ultragoal
+
+UltraQA owns repeated quality-gate cycling only. Use the deterministic conflict policies `refuse`, `adopt_existing`, and `artifact_only` rather than non-deterministic warning handling. Use it after the target behavior is known and the remaining question is whether tests, build, lint, typecheck, or another explicit QA condition passes. If Claude Code `/goal` is active, UltraQA may produce visible command evidence for that goal, but must not describe the `/goal` evaluator as independently running commands or reading files. If Ralph or Team is active, UltraQA is a verification/fix sub-loop under that authority rather than a competing session loop. If no active loop is safe, record QA expectations and evidence in artifact-only Ultragoal notes instead of claiming automatic execution.
+
 ## Goal Parsing
 
 Parse the goal from arguments. Supported formats:
 
-| Invocation | Goal Type | What to Check |
-|------------|-----------|---------------|
-| `/oh-my-claudecode:ultraqa --tests` | tests | All test suites pass |
-| `/oh-my-claudecode:ultraqa --build` | build | Build succeeds with exit 0 |
-| `/oh-my-claudecode:ultraqa --lint` | lint | No lint errors |
-| `/oh-my-claudecode:ultraqa --typecheck` | typecheck | No TypeScript errors |
-| `/oh-my-claudecode:ultraqa --custom "pattern"` | custom | Custom success pattern in output |
+| Invocation                                     | Goal Type | What to Check                    |
+| ---------------------------------------------- | --------- | -------------------------------- |
+| `/oh-my-claudecode:ultraqa --tests`            | tests     | All test suites pass             |
+| `/oh-my-claudecode:ultraqa --build`            | build     | Build succeeds with exit 0       |
+| `/oh-my-claudecode:ultraqa --lint`             | lint      | No lint errors                   |
+| `/oh-my-claudecode:ultraqa --typecheck`        | typecheck | No TypeScript errors             |
+| `/oh-my-claudecode:ultraqa --custom "pattern"` | custom    | Custom success pattern in output |
 
 If no structured goal provided, interpret the argument as a custom goal.
 
@@ -52,6 +56,7 @@ If no structured goal provided, interpret the argument as a custom goal.
    - **NO** → Continue to step 3
 
 3. **ARCHITECT DIAGNOSIS**: Spawn architect to analyze failure
+
    ```
    Task(subagent_type="oh-my-claudecode:architect", model="opus", prompt="DIAGNOSE FAILURE:
    Goal: [goal type]
@@ -60,6 +65,7 @@ If no structured goal provided, interpret the argument as a custom goal.
    ```
 
 4. **FIX ISSUES**: Apply architect's recommendations
+
    ```
    Task(subagent_type="oh-my-claudecode:executor", model="sonnet", prompt="FIX:
    Issue: [architect diagnosis]
@@ -71,16 +77,17 @@ If no structured goal provided, interpret the argument as a custom goal.
 
 ## Exit Conditions
 
-| Condition | Action |
-|-----------|--------|
-| **Goal Met** | Exit with success: "ULTRAQA COMPLETE: Goal met after N cycles" |
-| **Cycle 5 Reached** | Exit with diagnosis: "ULTRAQA STOPPED: Max cycles. Diagnosis: ..." |
-| **Same Failure 3x** | Exit early: "ULTRAQA STOPPED: Same failure detected 3 times. Root cause: ..." |
-| **Environment Error** | Exit: "ULTRAQA ERROR: [tmux/port/dependency issue]" |
+| Condition             | Action                                                                        |
+| --------------------- | ----------------------------------------------------------------------------- |
+| **Goal Met**          | Exit with success: "ULTRAQA COMPLETE: Goal met after N cycles"                |
+| **Cycle 5 Reached**   | Exit with diagnosis: "ULTRAQA STOPPED: Max cycles. Diagnosis: ..."            |
+| **Same Failure 3x**   | Exit early: "ULTRAQA STOPPED: Same failure detected 3 times. Root cause: ..." |
+| **Environment Error** | Exit: "ULTRAQA ERROR: [tmux/port/dependency issue]"                           |
 
 ## Observability
 
 Output progress each cycle:
+
 ```
 [ULTRAQA Cycle 1/5] Running tests...
 [ULTRAQA Cycle 1/5] FAILED - 3 tests failing
@@ -94,6 +101,7 @@ Output progress each cycle:
 ## State Tracking
 
 Track state in `.omc/ultraqa-state.json`:
+
 ```json
 {
   "active": true,
@@ -132,6 +140,13 @@ rm -f .omc/state/ultraqa-state.json
 
 This ensures clean state for future sessions. Stale state files with `active: false` should not be left behind.
 
+## Parallel session caveats
+
+- **Multi-repo workspace anchor:** drop a `.omc-workspace` marker at the parent directory so multiple sessions across sub-repos share one `.omc/`. Resolution order: `OMC_STATE_DIR > .omc-workspace > git > cwd`. See `docs/REFERENCE.md`.
+- **Session id source:** OMC_SESSION_ID env var wins in CLI contexts; hook payload data.session_id wins in hook contexts.
+- **Plan id (when applicable):** UltraQA state is session-scoped. Mutual-exclusion with ralph applies only within the same session.
+- **Parallel verdict:** supported (session-scoped state)
+
 ---
 
 Begin ULTRAQA cycling now. Parse the goal and start cycle 1.

package/bundled/upstream/oh-my-claudecode/skills/ultrawork/SKILL.md

@@ -125,6 +125,13 @@ Why bad: Opus is expensive overkill for a trivial fix. Use executor with Haiku i
 - [ ] No new errors introduced
 </Final_Checklist>
 
+## Parallel session caveats
+
+- **Multi-repo workspace anchor:** drop a `.omc-workspace` marker at the parent directory so multiple sessions across sub-repos share one `.omc/`. Resolution order: `OMC_STATE_DIR > .omc-workspace > git > cwd`. See `docs/REFERENCE.md`.
+- **Session id source:** OMC_SESSION_ID env var wins in CLI contexts; hook payload data.session_id wins in hook contexts.
+- **Plan id (when applicable):** Ultrawork has no persistent state; two concurrent runs are independent by design. No plan-id needed.
+- **Parallel verdict:** supported (stateless component)
+
 <Advanced>
 ## Relationship to Other Modes
 

package/bundled/upstream/superpowers/.omc-source/bundle.json

@@ -1,8 +1,9 @@
 {
-  "syncedAt": "2026-05-15T05:55:34.311Z",
+  "syncedAt": "2026-06-05T07:53:35.433Z",
   "sourceName": "superpowers",
   "remote": "https://github.com/obra/superpowers.git",
   "ref": "main",
+  "commit": "6fd4507659784c351abbd2bc264c7162cfd386dc",
   "kind": "content-repo",
   "harnesses": [
     "claude"

package/bundled/upstream/superpowers/.omc-source/provenance.json

@@ -0,0 +1,63 @@
+{
+  "syncedAt": "2026-06-05T07:53:35.433Z",
+  "sourceName": "superpowers",
+  "remote": "https://github.com/obra/superpowers.git",
+  "ref": "main",
+  "commit": "6fd4507659784c351abbd2bc264c7162cfd386dc",
+  "artifacts": {
+    "skills": {
+      "brainstorming/scripts/frame-template.html": "sha256:fb22ba9d47f3b83b",
+      "brainstorming/scripts/helper.js": "sha256:e763d82f32b4ebb3",
+      "brainstorming/scripts/server.cjs": "sha256:ea81185f581897c6",
+      "brainstorming/scripts/start-server.sh": "sha256:3442a54b5ee55116",
+      "brainstorming/scripts/stop-server.sh": "sha256:f65b7634a27343ea",
+      "brainstorming/SKILL.md": "sha256:bba47904a7f6bbee",
+      "brainstorming/spec-document-reviewer-prompt.md": "sha256:12cb5ed58aef41b8",
+      "brainstorming/visual-companion.md": "sha256:a2bc6fc47d0df1df",
+      "dispatching-parallel-agents/SKILL.md": "sha256:76806091c7f923ba",
+      "executing-plans/SKILL.md": "sha256:e2102f1163143393",
+      "finishing-a-development-branch/SKILL.md": "sha256:5c8d4b59aedb14c9",
+      "receiving-code-review/SKILL.md": "sha256:c9382e92b8f32363",
+      "requesting-code-review/code-reviewer.md": "sha256:595d91d05d5ecba5",
+      "requesting-code-review/SKILL.md": "sha256:5a3a44a3667800e2",
+      "subagent-driven-development/code-quality-reviewer-prompt.md": "sha256:2eeb3bf63fccfbee",
+      "subagent-driven-development/implementer-prompt.md": "sha256:a416193f881e5a71",
+      "subagent-driven-development/SKILL.md": "sha256:905a2b9be59b734d",
+      "subagent-driven-development/spec-reviewer-prompt.md": "sha256:631980e472eec539",
+      "systematic-debugging/condition-based-waiting-example.ts": "sha256:40ae5ebe497fdf31",
+      "systematic-debugging/condition-based-waiting.md": "sha256:e89fec8400d6cd50",
+      "systematic-debugging/CREATION-LOG.md": "sha256:c24733a5b1821bd6",
+      "systematic-debugging/defense-in-depth.md": "sha256:1e175fb86fc357e5",
+      "systematic-debugging/find-polluter.sh": "sha256:6462747eae9b175a",
+      "systematic-debugging/root-cause-tracing.md": "sha256:6b0622269e098ca1",
+      "systematic-debugging/SKILL.md": "sha256:4999cb851360485e",
+      "systematic-debugging/test-academic.md": "sha256:fe2ba480d78ac0d6",
+      "systematic-debugging/test-pressure-1.md": "sha256:0b6a915db0054577",
+      "systematic-debugging/test-pressure-2.md": "sha256:b2030aeffba07050",
+      "systematic-debugging/test-pressure-3.md": "sha256:96b50a52e2c7989c",
+      "test-driven-development/SKILL.md": "sha256:7dee67b4af6bdccc",
+      "test-driven-development/testing-anti-patterns.md": "sha256:bde453bc258f0654",
+      "using-git-worktrees/SKILL.md": "sha256:085a45ee3de432bd",
+      "using-superpowers/references/codex-tools.md": "sha256:37e06103a352516d",
+      "using-superpowers/references/copilot-tools.md": "sha256:9fb400a432d31494",
+      "using-superpowers/references/gemini-tools.md": "sha256:a66092fb2dd2c69b",
+      "using-superpowers/SKILL.md": "sha256:316e29381219adf0",
+      "verification-before-completion/SKILL.md": "sha256:ea52d15aabaf72bc",
+      "writing-plans/plan-document-reviewer-prompt.md": "sha256:6fce2aa83c637156",
+      "writing-plans/SKILL.md": "sha256:4fd4627d2c023678",
+      "writing-skills/anthropic-best-practices.md": "sha256:20914c2fda31670c",
+      "writing-skills/examples/CLAUDE_MD_TESTING.md": "sha256:0b379a3415e185d3",
+      "writing-skills/graphviz-conventions.dot": "sha256:e2890a593c91370e",
+      "writing-skills/persuasion-principles.md": "sha256:c3c84f572a51dd8b",
+      "writing-skills/render-graphs.js": "sha256:ccda971a87bb185f",
+      "writing-skills/SKILL.md": "sha256:38ba648975ae6ba5",
+      "writing-skills/testing-skills-with-subagents.md": "sha256:c711346852c911b2"
+    },
+    "hooks": {
+      "hooks-cursor.json": "sha256:53d8ceb3ff5d8bb1",
+      "hooks.json": "sha256:01616c57b96cc234",
+      "run-hook.cmd": "sha256:d3d9c6199678dab2",
+      "session-start": "sha256:4dff45d935243af2"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudecode-omc",
-  "version": "5.6.8",
+  "version": "5.11.0",
   "description": "Claude Code harness — best-practice skills, agents, hooks, and configs from multiple sources",
   "bin": {
     "omc-manage": "bin/omc-manage.js"
@@ -9,6 +9,7 @@
     "bin",
     "src",
     ".local",
+    ".omc-curation",
     "bundled",
     "scripts",
     "templates",

package/src/catalog/source-catalog.js

@@ -162,7 +162,8 @@ function listManifestFiles(sourceName, sourceConfig, root) {
   });
 }
 
-async function buildSourceCatalog(sourceName, root = getProjectRoot()) {
+async function buildSourceCatalog(sourceName, root = getProjectRoot(), options = {}) {
+  const { ignoreAllowlist = false } = options;
   const config = readConfig();
   const sourceConfig = config.sources[sourceName];
   if (!sourceConfig) {
@@ -177,9 +178,14 @@ async function buildSourceCatalog(sourceName, root = getProjectRoot()) {
     const artifactPath = getSourceArtifactDir(sourceName, artifactType, root);
     const present = fs.existsSync(artifactPath);
     const loader = getArtifactLoader(artifactType);
-    const loadedItems = (present && loader)
-      ? filterItemsByAllowlist(sourceConfig, artifactType, loader(artifactPath, sourceName))
-      : [];
+    // When re-curating (plan apply with a selection file), ignore the current
+    // allowlist so itemNames exposes the full available universe — otherwise the
+    // catalog pre-filters to already-allowed names and new selections can never
+    // be validated/added (chicken-and-egg).
+    const rawItems = (present && loader) ? loader(artifactPath, sourceName) : [];
+    const loadedItems = ignoreAllowlist
+      ? rawItems
+      : filterItemsByAllowlist(sourceConfig, artifactType, rawItems);
     upsertSurface(surfaces, {
       name: artifactType,
       harness: 'claude',

package/src/cli/index.js

@@ -20,6 +20,9 @@ function showHelp() {
   console.log('            Install merged artifacts (skills, agents, hooks, commands, etc.)');
   console.log('  doctor    Health checks for all artifact types');
   console.log('  source    list|add|remove|sync|status — manage sources');
+  console.log('            sync [<name>] [--frozen] — update sources (--frozen: to locked commits)');
+  console.log('            lock [<name>] — pin sources to their synced commit');
+  console.log('            drift [<name>] [--json] — detect edits vs recorded provenance');
   console.log('            inspect <name> — inspect source bundle/catalog');
   console.log('  plan      install <source> [--profile <name>] — build install plan');
   console.log('            apply <source> [--profile <name>] — materialize plan into source activation');
@@ -103,6 +106,7 @@ async function main(argv) {
     else if (arg === '--profile' && args[i + 1]) flags.profile = args[++i];
     else if (arg.startsWith('--profile=')) flags.profile = arg.split('=')[1];
     else if (arg === '--json') flags.json = true;
+    else if (arg === '--frozen') flags.frozen = true;
     else if (arg === '--apply') flags.apply = true;
     else if (arg === '--threshold' && args[i + 1]) flags.threshold = args[++i];
     else if (arg.startsWith('--threshold=')) flags.threshold = arg.split('=')[1];

package/src/cli/plan.js

@@ -135,9 +135,21 @@ async function plan(args, flags = {}) {
 
       const root = getProjectRoot();
       const profile = flags.profile || 'claude-runtime';
-      const catalog = await buildSourceCatalog(sourceName, root);
+      // Resolve the curation source of truth: an explicit --selection-file wins,
+      // otherwise auto-discover the in-repo .omc-curation/<source>-selection.json
+      // so `plan apply <source>` applies the committed curation with no flags.
+      let selectionFile = flags.selectionFile;
+      if (!selectionFile) {
+        const defaultSelection = path.join(root, '.omc-curation', `${sourceName}-selection.json`);
+        if (fs.existsSync(defaultSelection)) {
+          selectionFile = defaultSelection;
+          console.log(`Using curation: ${path.relative(root, defaultSelection)}`);
+        }
+      }
+      // Re-curating: load the full available universe so new selections validate.
+      const catalog = await buildSourceCatalog(sourceName, root, { ignoreAllowlist: Boolean(selectionFile) });
       const planResult = buildInstallPlan(catalog, profile);
-      const selectionData = flags.selectionFile ? await readSelectionFile(flags.selectionFile) : {};
+      const selectionData = selectionFile ? await readSelectionFile(selectionFile) : {};
       const allowlist = extractAllowlistFromSelection(planResult, selectionData);
       const currentSource = readConfig().sources[sourceName] || {};
       const activation = {

package/src/cli/setup.js

@@ -4,13 +4,14 @@ const fsp = require('fs/promises');
 const path = require('path');
 const os = require('os');
 const { getProjectRoot, getScopedInstallTarget, getMergeConfigPath } = require('../config/paths');
-const { readConfig, filterItemsByAllowlist } = require('../config/sources');
+const { readConfig, filterItemsByAllowlist, loadGovernance } = require('../config/sources');
 const { getArtifactTypeNames, ARTIFACT_TYPES } = require('../config/artifact-types');
 const { detectConflicts, resolveConflicts, applyResolutions } = require('../merge/base-merger');
 const { loadHooksConfig, mergeHooksConfigs, hasHookLib } = require('../merge/hook-merger');
 const { loadClaudeMd, mergeIntoExisting, assembleSections } = require('../merge/claude-md-merger');
 const { loadSettingsFragment, mergeSettingsFragments } = require('../merge/settings-merger');
 const { collectSourceDirsForType, getArtifactLoader } = require('../merge/artifact-source-loader');
+const { applyContentPatch } = require('../merge/content-patch');
 
 const OMC_VERSION_PATH = path.join(os.homedir(), '.claude', '.omc-version.json');
 const OMC_CONFIG_PATH = path.join(os.homedir(), '.claude', '.omc-config.json');
@@ -231,11 +232,12 @@ async function installNameBasedArtifacts(artifactType, sources, mergeConfig, ins
   const excludeList = (mergeConfig.exclude && mergeConfig.exclude[artifactType]) || [];
   if (excludeList.length > 0) {
     const excludeSet = new Set(excludeList);
-    const before = merged.length;
+    // Names actually present and removed — so the count and the listed names
+    // always agree (exclude entries absent from the catalog aren't reported).
+    const removedNames = merged.filter(item => excludeSet.has(item.name)).map(item => item.name);
     merged = merged.filter(item => !excludeSet.has(item.name));
-    const excluded = before - merged.length;
-    if (excluded > 0) {
-      console.log(`    excluded ${excluded} items: ${excludeList.filter(n => merged.every(m => m.name !== n)).join(', ')}`);
+    if (removedNames.length > 0) {
+      console.log(`    excluded ${removedNames.length} items: ${removedNames.join(', ')}`);
     }
   }
 
@@ -256,19 +258,49 @@ async function installNameBasedArtifacts(artifactType, sources, mergeConfig, ins
 
   await fsp.mkdir(installTarget, { recursive: true });
   let fileCount = 0;
+  let patchedCount = 0;
+
+  // Content patches: governance.json sources.<name>.patches["<type>/<artifact>"]
+  // are applied to the winning artifact's content as it is written.
+  const govSources = loadGovernance().sources || {};
+  const patchFor = (item) => {
+    const patches = (govSources[item.sourceName] || {}).patches;
+    return patches ? patches[`${artifactType}/${item.name}`] : undefined;
+  };
 
   for (const item of merged) {
+    const dest = path.join(installTarget, getManagedPathForItem(artifactType, item));
+    const patch = patchFor(item);
+
+    // (dry-run already returned above; this loop only runs for real installs)
     if (artifactType === 'skills' || item.isDirectory) {
-      const dest = path.join(installTarget, getManagedPathForItem(artifactType, item));
       fileCount += await copyDirectory(item.path, dest, flags);
+      // A skill patch targets its entry file (SKILL.md) inside the copied dir.
+      if (patch) {
+        const skillFile = path.join(dest, 'SKILL.md');
+        if (fs.existsSync(skillFile)) {
+          const { content, warnings } = applyContentPatch(fs.readFileSync(skillFile, 'utf8'), patch);
+          await fsp.writeFile(skillFile, content, 'utf8');
+          patchedCount += 1;
+          for (const w of warnings) console.log(`    patch warn (${item.name}): ${w}`);
+        }
+      }
     } else {
-      const dest = path.join(installTarget, getManagedPathForItem(artifactType, item));
       await fsp.mkdir(path.dirname(dest), { recursive: true });
-      await fsp.copyFile(item.path, dest);
+      if (patch) {
+        const { content, warnings } = applyContentPatch(fs.readFileSync(item.path, 'utf8'), patch);
+        await fsp.writeFile(dest, content, 'utf8');
+        patchedCount += 1;
+        for (const w of warnings) console.log(`    patch warn (${item.name}): ${w}`);
+      } else {
+        await fsp.copyFile(item.path, dest);
+      }
       fileCount += 1;
     }
   }
 
+  if (patchedCount > 0) console.log(`    patched ${patchedCount} item(s) from governance`);
+
   return {
     count: fileCount,
     total: merged.length,
@@ -413,11 +445,18 @@ async function setup(args, flags = {}) {
   if (typeFilter) console.log(`Types: ${typeFilter.join(', ')}`);
   console.log('');
 
-  // Load merge config
-  const mergeConfigPath = getMergeConfigPath(root);
-  let mergeConfig = { preferences: {} };
-  if (fs.existsSync(mergeConfigPath)) {
-    try { mergeConfig = JSON.parse(fs.readFileSync(mergeConfigPath, 'utf8')); } catch {}
+  // Conflict policy: unified governance.json is authoritative; fall back to the
+  // legacy templates/merge-config.json when governance declares no conflict block.
+  const governanceConflict = loadGovernance().conflict;
+  let mergeConfig;
+  if (governanceConflict && typeof governanceConflict === 'object') {
+    mergeConfig = { preferences: {}, ...governanceConflict };
+  } else {
+    const mergeConfigPath = getMergeConfigPath(root);
+    mergeConfig = { preferences: {} };
+    if (fs.existsSync(mergeConfigPath)) {
+      try { mergeConfig = JSON.parse(fs.readFileSync(mergeConfigPath, 'utf8')); } catch {}
+    }
   }
 
   const allTypes = getArtifactTypeNames().filter(type => type !== 'claude-md');

package/src/cli/skill.js

@@ -192,7 +192,7 @@ async function recommend(args, flags) {
 
   // Load existing config
   const configPath = getMergeConfigPath(root);
-  let config = { merge_strategy: 'version-priority', auto_merge: true, allow_namespacing: false, sources: [], preferences: {} };
+  let config = { preferences: {} };
   if (fs.existsSync(configPath)) {
     try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
   }