continuous-improvement 3.20.4 → 3.21.0

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -7,8 +7,8 @@
   "plugins": [
     {
       "name": "continuous-improvement",
-      "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.20.4",
+      "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
+      "version": "3.21.0",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.4",
-  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
+  "version": "3.21.0",
+  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",
     "url": "https://github.com/naimkatiman"

package/plugins/continuous-improvement/commands/production-readiness-review.md

@@ -1,6 +1,6 @@
 ---
 name: production-readiness-review
-description: "Parallel multi-agent readiness gate — fan blind reviewers across performance, security, UI/UX, and test coverage, each grounding findings in real code/logs/live data, then reconcile into one deduplicated, severity-ranked punch-list. Reports only; never fixes, merges, or deploys."
+description: "Parallel multi-agent readiness gate — fan blind reviewers across performance, security, UI/UX, test coverage, and simplicity, each grounding findings in real code/logs/live data, then reconcile into one deduplicated, severity-ranked punch-list. Reports only; never fixes, merges, or deploys."
 ---
 
 # /production-readiness-review
@@ -20,11 +20,12 @@ Pure routing over existing skills and agents. Adds no new code.
 ## Behavior
 
 1. **Scope** — establish ground truth: the diff under review and which changes are recent (`git diff`; `reconcile` fallback for branch/base state). Recent changes get extra scrutiny because they are the likeliest source of self-inflicted defects.
-2. **Fan out** — `superpowers:dispatching-parallel-agents` launches four reviewers, each blind to the others. Every reviewer is instructed to ground each finding in real code, logs, or live queries, and never to assume or fabricate state:
+2. **Fan out** — `superpowers:dispatching-parallel-agents` launches five reviewers, each blind to the others. Every reviewer is instructed to ground each finding in real code, logs, or live queries, and never to assume or fabricate state:
    - **Performance & bundle-size** — hot paths, N+1 queries, unbounded work, regressions.
    - **Security & data-access** (`security-auditor`) — authn/authz, input handling, injection, secret exposure, unsafe data access.
    - **UI/UX correctness** — verified live with Playwright when the MCP is available, else static review of the changed surface.
    - **Test coverage & flaky/stale mocks** (`test-engineer`) — uncovered branches, stale mocks, timing-flaky tests.
+   - **Simplicity & over-engineering** (`simplicity-review`) — code that could reuse an existing file, a stdlib or native feature, or fewer lines; reports trim opportunities via the reuse ladder and never flags input validation, data-loss handling, security, or accessibility.
 3. **Reconcile** — a final pass dedupes findings across reviewers, ranks each CRITICAL / HIGH / MEDIUM / LOW by severity and confidence, and explicitly flags any defect introduced by the changes under review.
 4. **Present** — emit the consolidated punch-list, severity-ranked, with file references. **Stop.**
 
@@ -42,7 +43,7 @@ Pure routing over existing skills and agents. Adds no new code.
 
 ## Composition
 
-Routes through: `reconcile` (scope/ground truth) → `superpowers:dispatching-parallel-agents` (fan-out) → the `security-auditor` and `test-engineer` agents (two of the four dimensions) → a reconciliation pass that ranks and dedupes. Each step falls back to its inline behavior when the preferred skill or agent is not installed.
+Routes through: `reconcile` (scope/ground truth) → `superpowers:dispatching-parallel-agents` (fan-out) → the `security-auditor` and `test-engineer` agents and the `simplicity-review` skill (three of the five dimensions) → a reconciliation pass that ranks and dedupes. Each step falls back to its inline behavior when the preferred skill or agent is not installed.
 
 ## Example
 
@@ -50,4 +51,4 @@ Routes through: `reconcile` (scope/ground truth) → `superpowers:dispatching-pa
 /production-readiness-review #246
 ```
 
-Scopes PR #246's diff, fans four blind reviewers across performance, security, UI/UX, and test coverage, then returns one deduplicated severity-ranked punch-list — flagging anything the PR's own changes introduced — and stops for you to prioritize.
+Scopes PR #246's diff, fans five blind reviewers across performance, security, UI/UX, test coverage, and simplicity, then returns one deduplicated severity-ranked punch-list — flagging anything the PR's own changes introduced — and stops for you to prioritize.

package/plugins/continuous-improvement/commands/simplicity-review.md

@@ -0,0 +1,35 @@
+---
+name: simplicity-review
+description: Review the current diff for over-engineering — flag code that could reuse an existing file, a stdlib or native feature, or fewer lines — and report GO/TRIM findings without touching code. Enforces Law 4 (Verify Before Reporting).
+---
+
+# /simplicity-review — Judge the Diff Before You Ship It
+
+Read the current change like the laziest senior dev in the room: could this have been smaller? Passing tests prove correctness, not minimality. Backed by the `simplicity-review` skill.
+
+## What it does
+
+Takes the working-tree diff (vs HEAD by default; accepts an optional commit range or file list), reads each changed block, and walks a fixed reuse ladder:
+
+```
+1. Does this need to exist?   -> skip it (YAGNI)
+2. Already in this codebase?  -> reuse it
+3. Stdlib does it?            -> use it
+4. Native platform feature?   -> use it
+5. Installed dependency?      -> use it
+6. One line?                  -> one line
+7. Only then:                    the minimum that works
+```
+
+It reports `file:line`, what is over-built, the specific simpler path, and closes with `GO` (already minimal) or `TRIM` (findings to apply). It does not edit code.
+
+## Default skeptical
+
+A finding is a hypothesis. Read the surrounding code and prove the simpler path exists and preserves behavior before asserting it; a wrong trim is worse than the over-build. Never flag input validation, data-loss-preventing error handling, security, or accessibility — lazy, not negligent.
+
+## Pairs with
+
+- **`simplicity-review`** skill — the discipline this command runs.
+- **`proceed-with-the-recommendation`** — apply the trims under the 7 Laws.
+- **`verification-loop`** — the ladder to re-run on whatever you trim.
+- **`production-readiness-review`** — the sibling diff review for performance, security, UI, and test coverage.

package/plugins/continuous-improvement/commands/verify-install.md

@@ -40,8 +40,8 @@ The observation hook appends one row per tool call to
 `<project-hash>` from the current repo, or check `~/.claude/instincts/global/`).
 
 - If it exists and has at least one row — capture is recording. Record `observe: ✓`.
-- If it is missing or empty — record `observe: ✗ (observation hook not recording —
-  on Windows confirm Git Bash is installed before WSL Bash on PATH, then re-run the installer)`.
+- If it is missing or empty, record `observe: ✗ (observation hook not recording; re-run
+  the installer to migrate legacy Bash hook rows to the Node observer)`.
 
 ## Report
 

package/plugins/continuous-improvement/hooks/hooks.json

@@ -1,5 +1,4 @@
 {
-  "description": "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, opt-in query-cost Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
   "hooks": {
     "PreToolUse": [
       {
@@ -7,12 +6,12 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gateguard.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/companion-preference.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       },
@@ -22,7 +21,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       }
@@ -32,8 +31,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/observe.sh\"",
-            "timeout": 5
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/observe.mjs\"",
+            "timeout": 30
           }
         ]
       }
@@ -44,12 +43,12 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/recall-briefing.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       }
@@ -59,8 +58,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session.sh\"",
-            "timeout": 5
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\"",
+            "timeout": 30
           }
         ]
       }
@@ -70,8 +69,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session.sh\"",
-            "timeout": 5
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\"",
+            "timeout": 30
           }
         ]
       }
@@ -82,17 +81,17 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/three-section-close.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/goal-drift-stop.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
@@ -102,7 +101,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/query-cost-nudge.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       }

package/plugins/continuous-improvement/hooks/session.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { resolveHomeDir } from "../lib/resolve-home-dir.mjs";
+function read(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function eventFromStdin() {
+    const raw = read(0);
+    if (!raw)
+        return null;
+    try {
+        const payload = JSON.parse(raw);
+        if (!payload || typeof payload !== "object" || Array.isArray(payload))
+            return null;
+        const event = payload.hook_event_name ?? payload.hook_type ?? payload.event_type;
+        return event === "SessionStart" || event === "SessionEnd" ? event : "unknown";
+    }
+    catch {
+        return null;
+    }
+}
+function projectRoot() {
+    if (process.env.CLAUDE_PROJECT_DIR)
+        return process.env.CLAUDE_PROJECT_DIR;
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim() || "global";
+    }
+    catch {
+        return "global";
+    }
+}
+function yamlFiles(dir) {
+    try {
+        return readdirSync(dir)
+            .filter((name) => name.endsWith(".yaml"))
+            .map((name) => join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
+function main() {
+    const event = eventFromStdin();
+    if (event === null)
+        return;
+    if (event === "SessionEnd") {
+        process.stderr.write("[continuous-improvement] Session ending. Run /continuous-improvement to reflect and capture learnings.\n");
+        return;
+    }
+    const home = resolveHomeDir();
+    if (!home)
+        return;
+    const instinctsRoot = join(home, ".claude", "instincts");
+    const hash = createHash("sha256").update(projectRoot()).digest("hex").slice(0, 12);
+    const projectDir = join(instinctsRoot, hash);
+    const files = [...yamlFiles(projectDir), ...yamlFiles(join(instinctsRoot, "global"))];
+    const observations = read(join(projectDir, "observations.jsonl")).split(/\r?\n/).filter(Boolean).length;
+    let level = observations >= 20 || files.length > 0 ? "ANALYZE" : "CAPTURE";
+    for (const file of files) {
+        const value = Number(read(file).match(/^confidence:\s*([0-9]*\.?[0-9]+)/m)?.[1]);
+        if (Number.isFinite(value) && value >= 0.7) {
+            level = "AUTO-APPLY";
+            break;
+        }
+        if (Number.isFinite(value) && value >= 0.5)
+            level = "SUGGEST";
+    }
+    process.stderr.write(`[continuous-improvement] Level: ${level} | Observations: ${observations} | Instincts: ${files.length}\n`);
+}
+try {
+    main();
+}
+catch {
+}

package/plugins/continuous-improvement/lib/plugin-metadata.mjs

@@ -26,7 +26,7 @@ const KEYWORDS = [
     "transcript-linter",
 ];
 const CLAUDE_PLUGIN_CATEGORY = "productivity";
-const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
+const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
 // Four vendored upstream companions registered alongside the CI plugin.
 // Each entry points at a pinned-SHA snapshot under third-party/<name>/.
 // See third-party/MANIFEST.md for refresh recipes and per-snapshot
@@ -457,76 +457,74 @@ export function getClaudePluginManifest() {
     };
 }
 export function getPluginHooksConfig() {
+    // Cold Node startup on loaded Windows hosts has exceeded five seconds.
+    const hookTimeoutSeconds = 30;
     const gateguardCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gateguard.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const companionPreferenceCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/companion-preference.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const hookPackCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const observeCommand = {
         type: "command",
-        command: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/observe.sh\"",
-        timeout: 5,
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/bin/observe.mjs\"",
+        timeout: hookTimeoutSeconds,
     };
     const sessionCommand = {
         type: "command",
-        command: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session.sh\"",
-        timeout: 5,
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\"",
+        timeout: hookTimeoutSeconds,
     };
     const threeSectionCloseCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/three-section-close.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const goalDriftStopCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/goal-drift-stop.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const workflowDistillCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const typecheckStopCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/typecheck-stop.mjs\"",
-        // Longer than the 5s hooks: tsc is slower. Opt-in via CLAUDE_TYPECHECK_GATE
-        // (off by default) and near-zero cost when off / no TS file changed; on an
-        // internal timeout it fails open (allow) rather than blocking.
-        timeout: 30,
+        timeout: hookTimeoutSeconds,
     };
     const queryCostNudgeCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/query-cost-nudge.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const routePromptCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const recallBriefingCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/recall-briefing.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     return {
-        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, opt-in query-cost Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
         hooks: {
             // gateguard runs FIRST on PreToolUse so its block decision short-circuits
             // before companion-preference sees the call. companion-preference runs
             // second on Skill tool calls; it is a no-op under ci-first (the default)
-            // and never blocks under companions-first. observe.sh only runs on
+            // and never blocks under companions-first. The observer only runs on
             // PostToolUse: gateguard-blocked calls are intentionally not observed so
             // PreToolUse stays at two subprocesses on the hot path. route-prompt
             // fires on UserPromptSubmit and emits a system-reminder when a prompt

package/plugins/continuous-improvement/skills/README.md

@@ -34,6 +34,7 @@ skill set on disk.
 - `recovery-classification` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. After any failure in the verification ladder or auto-loop, classify the failure class before retrying — provider, tool-schema, deterministic-policy, git, worktree, runtime — so retry-vs-pause-vs-self-heal-vs-stop is an intentional decision, not a generic 'try again'.
 - `roast` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Convene a 5-persona adversarial council (Contrarian, Expansionist, Logician, Researcher, Buyer) that attacks an idea from every angle, then a Judge returns one GO / RESHAPE / KILL verdict plus the cheapest 48-hour test to de-risk it — so you pressure-test an idea before sinking time into building the wrong thing.
 - `safety-guard` — Enforces Law 3 (One Thing at a Time) of the 7 Laws of AI Agent Discipline by scoping edits to a directory and blocking destructive shell commands. Use this skill to prevent destructive operations when working on production systems or running agents autonomously.
+- `simplicity-review` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Reviews the current diff for over-engineering (code that could reuse an existing file, a stdlib or native feature, or fewer lines) and reports trim findings without touching code, so 'it works' is never mistaken for 'it is the minimum that works'.
 - `skill-distillation` — Enforces Law 7 (Learn From Every Session) of the 7 Laws of AI Agent Discipline. Distills repeated successful tool sequences into reusable draft instincts, so a pattern that worked three times becomes a captured recipe instead of being re-derived from scratch every session.
 - `state-reconciliation` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Pre-dispatch invariant: reconcile DB-vs-disk-vs-memory state before any unit runs, so a stale flag, missing artifact, or out-of-sync row never re-dispatches a unit that already completed or never started.
 - `strategic-compact` — Enforces Law 5 (Reflect After Every Session) of the 7 Laws of AI Agent Discipline at phase boundaries. Suggests manual context compaction at logical intervals to preserve context through task phases rather than arbitrary auto-compaction.

package/plugins/continuous-improvement/skills/proceed-with-the-recommendation/SKILL.md

@@ -213,6 +213,7 @@ Rows whose **Preferred skill** is not bundled with the `continuous-improvement`
 | Fix bug / investigate failure | `superpowers:systematic-debugging` | Hypothesis → add logs/tests → reproduce → smallest fix → verify with the failing repro. (Reference behavior — does not require `superpowers:systematic-debugging`.) |
 | Write tests / add coverage | `superpowers:test-driven-development` or `tdd-workflow` | RED (failing test) → GREEN (minimal code) → REFACTOR; one test, one behavior |
 | Refactor / dead code cleanup | `simplify` | Find dupes/unused exports, delete in place, re-run type check and smallest test. (Reference behavior — does not require `simplify`.) |
+| Over-engineering check on a diff | `simplicity-review` (bundled) | Walk the reuse ladder (existing file, stdlib, native feature, one line) over the current diff and report GO/TRIM without editing; apply trims, then re-run the smallest check. Never flags input validation, data-loss handling, security, or accessibility. |
 | Security review / auth audit | `security-review` | Scan for hardcoded secrets, unsanitized input, missing authz, SQL string concat, open CORS. (Reference behavior — does not require `security-review`.) |
 | Code review before merge | `superpowers:requesting-code-review` or `code-review` | Read diff top-to-bottom, flag CRITICAL / HIGH / MEDIUM. (Reference behavior — does not require `code-review`.) |
 | Verify before shipping | `superpowers:verification-before-completion` | Smallest check that proves correctness: typecheck + one test + one curl. (Reference behavior — does not require `superpowers:verification-before-completion`.) |

package/plugins/continuous-improvement/skills/simplicity-review/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: simplicity-review
+tier: "2"
+description: Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Reviews the current diff for over-engineering (code that could reuse an existing file, a stdlib or native feature, or fewer lines) and reports trim findings without touching code, so 'it works' is never mistaken for 'it is the minimum that works'.
+origin: continuous-improvement
+user-invocable: true
+---
+
+# Simplicity Review — Flag the Over-Build Before It Ships
+
+Law 4 says verify before reporting. "It compiles and the test passes" is a claim about correctness, not about whether the change is the minimum that works. This skill runs a diff-scoped review with one question: could this have been smaller? It reads the change like the laziest senior dev in the room, walks a fixed reuse ladder, and reports what to trim. It never edits code. The best code is the code you never wrote.
+
+## When to Activate
+
+- After writing a feature or fix, before opening a PR, when the diff feels larger than the task warranted.
+- When you reached for a new file, a new dependency, or a wrapper component and a native or existing option might already cover it.
+- As a routed step from `proceed-with-the-recommendation` at the "Refactor / dead code cleanup" line, as the repo-owned alternative to the built-in `simplify`.
+- Before a release cut, over the diff since the last tag, as a last pass on accreted complexity.
+
+## The Ladder
+
+Read each added or changed block and stop at the first rung that holds:
+
+```
+1. Does this need to exist?   -> skip it (YAGNI)
+2. Already in this codebase?  -> reuse it
+3. Stdlib does it?            -> use it
+4. Native platform feature?   -> use it
+5. Installed dependency?      -> use it
+6. One line?                  -> one line
+7. Only then:                    the minimum that works
+```
+
+Most real cuts come from rungs 2 to 4: a hand-rolled helper that duplicates an existing one, a component built where a native input, a stdlib call, or a platform primitive already does the job.
+
+## Read Before You Cut
+
+Lazy about the solution, never about the reading. The ladder shortens the solution, not the investigation. Trace the whole change and what it touches first. A "simpler" path proposed without reading the surrounding code is a guess, and a wrong trim is worse than the over-build.
+
+## Safety Carve-Out (Never Flag)
+
+Lazy, not negligent. These are never on the chopping block, no matter how many lines they cost:
+
+- Input validation at trust boundaries.
+- Error handling that prevents data loss.
+- Security controls (authz checks, escaping, secret handling).
+- Accessibility.
+
+This aligns with `rules/common/security.md` and `rules/common/coding-style.md`. If a trim would weaken any of the above, it is not a finding.
+
+## Output
+
+A findings list. For each item:
+
+- `file:line`
+- `over-built:` what the code does the long way
+- `simpler:` the specific shorter path (reuse existing `X` / stdlib `Y` / native `Z` / one line / delete)
+- one-line rationale
+
+Close with a verdict:
+
+- `GO` — the diff is already at or near minimal; nothing to trim.
+- `TRIM` — findings listed above; apply, then re-verify.
+
+No score, no line-count target. A net-negative diff is a nice side effect, not the goal. Optimizing for fewer lines invites golfing and deletion of things that earn their keep; the ladder, not a number, decides.
+
+## Review Only
+
+This skill reports; it does not edit. Apply the trims yourself or route them through `proceed-with-the-recommendation`, then run the `verification-loop` ladder on what changed. This mirrors `audit`'s confirm-before-fix: a finding is a hypothesis until the simpler path is proven to exist and to preserve behavior.
+
+## Overlap With `simplify`
+
+The Claude Code built-in `simplify` and this skill share intent but differ in kind. `simplify` auto-applies broad reuse, efficiency, and altitude cleanups across changed code. `simplicity-review` is a repo-owned, Law-4-tagged, review-only lens scoped to over-engineering in the current diff, with an explicit safety carve-out, that feeds its findings into the 7-Laws flow. Use `simplify` when you want the fixes applied; use `simplicity-review` when you want the diff judged first.
+
+## Pairs With
+
+- **`verification-loop`** (Law 4) — the build/test/lint ladder you run after applying a trim.
+- **`gateguard`** (Law 1) — the write-time reuse gate ("confirm no existing file serves the same purpose"); this skill catches at review time what slipped past it.
+- **`proceed-with-the-recommendation`** — applies the trims under the 7 Laws.
+- **`wild-risa-balance`** (Law 2) — the recommendation-layer analog: the same anti-padding instinct applied to advice instead of code.

package/plugins/expert.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.4",
+  "version": "3.21.0",
   "mode": "expert",
   "description": "Expert mode: tune confidence, manage instincts, and persist plans on disk. Adds safety, token-budget, and strategic-compact skills plus the /learn-eval command so long sessions stay sharp and learnings survive context resets.",
   "tools": [

package/skills/proceed-with-the-recommendation.md

@@ -213,6 +213,7 @@ Rows whose **Preferred skill** is not bundled with the `continuous-improvement`
 | Fix bug / investigate failure | `superpowers:systematic-debugging` | Hypothesis → add logs/tests → reproduce → smallest fix → verify with the failing repro. (Reference behavior — does not require `superpowers:systematic-debugging`.) |
 | Write tests / add coverage | `superpowers:test-driven-development` or `tdd-workflow` | RED (failing test) → GREEN (minimal code) → REFACTOR; one test, one behavior |
 | Refactor / dead code cleanup | `simplify` | Find dupes/unused exports, delete in place, re-run type check and smallest test. (Reference behavior — does not require `simplify`.) |
+| Over-engineering check on a diff | `simplicity-review` (bundled) | Walk the reuse ladder (existing file, stdlib, native feature, one line) over the current diff and report GO/TRIM without editing; apply trims, then re-run the smallest check. Never flags input validation, data-loss handling, security, or accessibility. |
 | Security review / auth audit | `security-review` | Scan for hardcoded secrets, unsanitized input, missing authz, SQL string concat, open CORS. (Reference behavior — does not require `security-review`.) |
 | Code review before merge | `superpowers:requesting-code-review` or `code-review` | Read diff top-to-bottom, flag CRITICAL / HIGH / MEDIUM. (Reference behavior — does not require `code-review`.) |
 | Verify before shipping | `superpowers:verification-before-completion` | Smallest check that proves correctness: typecheck + one test + one curl. (Reference behavior — does not require `superpowers:verification-before-completion`.) |

package/skills/simplicity-review.md

@@ -0,0 +1,80 @@
+---
+name: simplicity-review
+tier: "2"
+description: Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Reviews the current diff for over-engineering (code that could reuse an existing file, a stdlib or native feature, or fewer lines) and reports trim findings without touching code, so 'it works' is never mistaken for 'it is the minimum that works'.
+origin: continuous-improvement
+user-invocable: true
+---
+
+# Simplicity Review — Flag the Over-Build Before It Ships
+
+Law 4 says verify before reporting. "It compiles and the test passes" is a claim about correctness, not about whether the change is the minimum that works. This skill runs a diff-scoped review with one question: could this have been smaller? It reads the change like the laziest senior dev in the room, walks a fixed reuse ladder, and reports what to trim. It never edits code. The best code is the code you never wrote.
+
+## When to Activate
+
+- After writing a feature or fix, before opening a PR, when the diff feels larger than the task warranted.
+- When you reached for a new file, a new dependency, or a wrapper component and a native or existing option might already cover it.
+- As a routed step from `proceed-with-the-recommendation` at the "Refactor / dead code cleanup" line, as the repo-owned alternative to the built-in `simplify`.
+- Before a release cut, over the diff since the last tag, as a last pass on accreted complexity.
+
+## The Ladder
+
+Read each added or changed block and stop at the first rung that holds:
+
+```
+1. Does this need to exist?   -> skip it (YAGNI)
+2. Already in this codebase?  -> reuse it
+3. Stdlib does it?            -> use it
+4. Native platform feature?   -> use it
+5. Installed dependency?      -> use it
+6. One line?                  -> one line
+7. Only then:                    the minimum that works
+```
+
+Most real cuts come from rungs 2 to 4: a hand-rolled helper that duplicates an existing one, a component built where a native input, a stdlib call, or a platform primitive already does the job.
+
+## Read Before You Cut
+
+Lazy about the solution, never about the reading. The ladder shortens the solution, not the investigation. Trace the whole change and what it touches first. A "simpler" path proposed without reading the surrounding code is a guess, and a wrong trim is worse than the over-build.
+
+## Safety Carve-Out (Never Flag)
+
+Lazy, not negligent. These are never on the chopping block, no matter how many lines they cost:
+
+- Input validation at trust boundaries.
+- Error handling that prevents data loss.
+- Security controls (authz checks, escaping, secret handling).
+- Accessibility.
+
+This aligns with `rules/common/security.md` and `rules/common/coding-style.md`. If a trim would weaken any of the above, it is not a finding.
+
+## Output
+
+A findings list. For each item:
+
+- `file:line`
+- `over-built:` what the code does the long way
+- `simpler:` the specific shorter path (reuse existing `X` / stdlib `Y` / native `Z` / one line / delete)
+- one-line rationale
+
+Close with a verdict:
+
+- `GO` — the diff is already at or near minimal; nothing to trim.
+- `TRIM` — findings listed above; apply, then re-verify.
+
+No score, no line-count target. A net-negative diff is a nice side effect, not the goal. Optimizing for fewer lines invites golfing and deletion of things that earn their keep; the ladder, not a number, decides.
+
+## Review Only
+
+This skill reports; it does not edit. Apply the trims yourself or route them through `proceed-with-the-recommendation`, then run the `verification-loop` ladder on what changed. This mirrors `audit`'s confirm-before-fix: a finding is a hypothesis until the simpler path is proven to exist and to preserve behavior.
+
+## Overlap With `simplify`
+
+The Claude Code built-in `simplify` and this skill share intent but differ in kind. `simplify` auto-applies broad reuse, efficiency, and altitude cleanups across changed code. `simplicity-review` is a repo-owned, Law-4-tagged, review-only lens scoped to over-engineering in the current diff, with an explicit safety carve-out, that feeds its findings into the 7-Laws flow. Use `simplify` when you want the fixes applied; use `simplicity-review` when you want the diff judged first.
+
+## Pairs With
+
+- **`verification-loop`** (Law 4) — the build/test/lint ladder you run after applying a trim.
+- **`gateguard`** (Law 1) — the write-time reuse gate ("confirm no existing file serves the same purpose"); this skill catches at review time what slipped past it.
+- **`proceed-with-the-recommendation`** — applies the trims under the 7 Laws.
+- **`wild-risa-balance`** (Law 2) — the recommendation-layer analog: the same anti-padding instinct applied to advice instead of code.