continuous-improvement 3.23.0 → 3.25.0

package/bin/reconcile-instinct-hashes.mjs

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+/**
+ * Merge instinct buckets that are the same project under different path
+ * spellings (C:/ vs c:/ vs C:\). observe/gateguard now hash the canonical
+ * root; this CLI copies history into that hash and leaves an alias marker
+ * on the old dir. Idempotent. Never deletes a directory.
+ *
+ * Usage:
+ *   node bin/reconcile-instinct-hashes.mjs --dry-run
+ *   node bin/reconcile-instinct-hashes.mjs --apply
+ *   node bin/reconcile-instinct-hashes.mjs --apply --only 3ef4426c6e15 --only 137f2f54ec70
+ */
+import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { argv, exit } from "node:process";
+import { canonicalizeProjectRoot, hashProjectRoot, resolveInstinctsRoot } from "../lib/gateguard-state.mjs";
+function countJsonl(path) {
+    if (!existsSync(path))
+        return 0;
+    return readFileSync(path, "utf8").split(/\n/).filter((line) => line.trim() !== "").length;
+}
+function isoNow() {
+    return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+export function discoverGroups(instinctsRoot) {
+    const groups = new Map();
+    let entries;
+    try {
+        entries = readdirSync(instinctsRoot);
+    }
+    catch {
+        return [];
+    }
+    for (const name of entries) {
+        if (name === "global")
+            continue;
+        const dir = join(instinctsRoot, name);
+        try {
+            if (!statSync(dir).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (existsSync(join(dir, "alias.json")) && !existsSync(join(dir, "observations.jsonl"))) {
+            continue;
+        }
+        const projectPath = join(dir, "project.json");
+        if (!existsSync(projectPath))
+            continue;
+        let project;
+        try {
+            project = JSON.parse(readFileSync(projectPath, "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (!project.root)
+            continue;
+        const canonicalRoot = canonicalizeProjectRoot(project.root);
+        const canonicalHash = hashProjectRoot(canonicalRoot);
+        const bucket = {
+            hash: name,
+            root: project.root,
+            name: project.name ?? name,
+            rows: countJsonl(join(dir, "observations.jsonl")),
+        };
+        const existing = groups.get(canonicalHash);
+        if (existing) {
+            existing.members.push(bucket);
+        }
+        else {
+            groups.set(canonicalHash, {
+                canonicalHash,
+                canonicalRoot,
+                name: project.name ?? name,
+                members: [bucket],
+            });
+        }
+    }
+    return [...groups.values()].filter((group) => group.members.some((member) => member.hash !== group.canonicalHash && member.rows > 0));
+}
+function parseTs(line) {
+    try {
+        const parsed = JSON.parse(line);
+        const value = Date.parse(parsed.ts ?? "");
+        return Number.isFinite(value) ? value : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+export function mergeJsonl(sources) {
+    const rows = [];
+    const seen = new Set();
+    for (const file of sources) {
+        if (!existsSync(file))
+            continue;
+        for (const line of readFileSync(file, "utf8").split(/\n/)) {
+            const trimmed = line.trim();
+            if (!trimmed || seen.has(trimmed))
+                continue;
+            seen.add(trimmed);
+            rows.push(trimmed);
+        }
+    }
+    rows.sort((a, b) => parseTs(a) - parseTs(b) || a.localeCompare(b));
+    return rows.length === 0 ? "" : `${rows.join("\n")}\n`;
+}
+export function selectGroups(groups, only) {
+    if (only.length === 0)
+        return groups;
+    const wanted = new Set(only);
+    return groups.filter((group) => wanted.has(group.canonicalHash) || group.members.some((member) => wanted.has(member.hash)));
+}
+export function applyGroup(instinctsRoot, group) {
+    const destDir = join(instinctsRoot, group.canonicalHash);
+    mkdirSync(destDir, { recursive: true });
+    const destObs = join(destDir, "observations.jsonl");
+    const sources = group.members
+        .map((member) => join(instinctsRoot, member.hash, "observations.jsonl"))
+        .filter((path) => existsSync(path));
+    const merged = mergeJsonl(sources);
+    writeFileSync(destObs, merged, "utf8");
+    let createdAt = isoNow();
+    const destProject = join(destDir, "project.json");
+    if (existsSync(destProject)) {
+        try {
+            const existing = JSON.parse(readFileSync(destProject, "utf8"));
+            if (existing.created_at)
+                createdAt = existing.created_at;
+        }
+        catch {
+            // rewrite below
+        }
+    }
+    writeFileSync(destProject, `${JSON.stringify({
+        id: group.canonicalHash,
+        name: group.name,
+        root: group.canonicalRoot,
+        created_at: createdAt,
+    })}\n`, "utf8");
+    const aliases = [];
+    for (const member of group.members) {
+        if (member.hash === group.canonicalHash)
+            continue;
+        const srcDir = join(instinctsRoot, member.hash);
+        try {
+            for (const file of readdirSync(srcDir)) {
+                if (!file.endsWith(".yaml"))
+                    continue;
+                const dest = join(destDir, file);
+                if (!existsSync(dest))
+                    copyFileSync(join(srcDir, file), dest);
+            }
+        }
+        catch {
+            // missing dir is non-fatal
+        }
+        const srcObs = join(srcDir, "observations.jsonl");
+        if (existsSync(srcObs)) {
+            renameSync(srcObs, join(srcDir, `observations.migrated-to-${group.canonicalHash}.jsonl`));
+        }
+        writeFileSync(join(srcDir, "alias.json"), `${JSON.stringify({
+            canonical: group.canonicalHash,
+            canonical_root: group.canonicalRoot,
+            migrated_at: isoNow(),
+            rows: member.rows,
+        })}\n`, "utf8");
+        aliases.push(member.hash);
+    }
+    const copiedRows = merged === "" ? 0 : merged.trim().split("\n").length;
+    return { copiedRows, aliases };
+}
+function printPlan(groups) {
+    if (groups.length === 0) {
+        console.log("No alias observation buckets to merge.");
+        return;
+    }
+    console.log(`Alias groups: ${groups.length}`);
+    for (const group of groups) {
+        console.log(`  ${group.name} → ${group.canonicalHash} (${group.canonicalRoot})`);
+        for (const member of group.members) {
+            const mark = member.hash === group.canonicalHash ? "canonical" : "alias";
+            console.log(`    ${member.hash}  ${member.rows} rows  ${mark}  root=${member.root}`);
+        }
+    }
+}
+function parseOnly(args) {
+    const only = [];
+    for (let i = 0; i < args.length; i += 1) {
+        if (args[i] === "--only" && args[i + 1]) {
+            only.push(args[i + 1]);
+            i += 1;
+        }
+    }
+    return only;
+}
+function main() {
+    const args = argv.slice(2);
+    const apply = args.includes("--apply");
+    const dryRun = args.includes("--dry-run") || !apply;
+    const instinctsRoot = resolveInstinctsRoot();
+    const groups = selectGroups(discoverGroups(instinctsRoot), parseOnly(args));
+    printPlan(groups);
+    if (dryRun) {
+        if (groups.length > 0)
+            console.log("\nRe-run with --apply to merge.");
+        return;
+    }
+    for (const group of groups) {
+        const result = applyGroup(instinctsRoot, group);
+        console.log(`merged ${result.copiedRows} rows into ${group.canonicalHash}; aliases ${result.aliases.join(",") || "(none)"}`);
+    }
+}
+const invokedDirectly = argv[1]?.endsWith("reconcile-instinct-hashes.mjs");
+if (invokedDirectly) {
+    try {
+        main();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(message);
+        exit(1);
+    }
+}

package/bin/refresh-third-party.mjs

@@ -22,7 +22,10 @@
  *       wipe the local path, recreate it, copy the selective surface
  *       verbatim, strip every CLAUDE.md inside the snapshot, print a diff
  *       stat. Aborts if the local snapshot path has uncommitted changes
- *       unless --force is passed.
+ *       unless --force is passed, and aborts BEFORE the wipe if upstream
+ *       removed a skill this repo still routes to, unless --allow-stale-refs
+ *       is passed. The two flags are separate on purpose: a dirty-tree
+ *       refresh must not silently disable the stale-reference gate.
  *
  *   node bin/refresh-third-party.mjs --all
  *   node bin/refresh-third-party.mjs --all --check
@@ -38,8 +41,9 @@
  */
 import { spawnSync } from "node:child_process";
 import { cp, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { readdirSync, readFileSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import { argv, exit, stderr, stdout } from "node:process";
 import { fileURLToPath } from "node:url";
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
@@ -56,6 +60,7 @@ const SNAPSHOTS = [
         manifestHeading: "oh-my-claudecode",
         upstream: "https://github.com/Yeachan-Heo/oh-my-claudecode.git",
         localPath: "third-party/oh-my-claudecode",
+        routingPrefix: "oh-my-claudecode",
         selectiveDirs: [
             "agents",
             "skills",
@@ -94,6 +99,7 @@ const SNAPSHOTS = [
         manifestHeading: "obra/superpowers",
         upstream: "https://github.com/obra/superpowers.git",
         localPath: "third-party/superpowers",
+        routingPrefix: "superpowers",
         selectiveDirs: ["skills", "hooks", "docs", "assets", ".claude-plugin"],
         selectiveFiles: [
             "LICENSE",
@@ -116,7 +122,7 @@ function usage() {
         "Usage:",
         "  node bin/refresh-third-party.mjs --list",
         "  node bin/refresh-third-party.mjs <name> --check",
-        "  node bin/refresh-third-party.mjs <name> [--force]",
+        "  node bin/refresh-third-party.mjs <name> [--force] [--allow-stale-refs]",
         "  node bin/refresh-third-party.mjs --all [--check] [--force]",
         "  node bin/refresh-third-party.mjs --help",
         "",
@@ -198,6 +204,7 @@ function localPathDirty(relPath) {
 }
 async function deleteClaudeMdRecursive(root) {
     // Node-only equivalent of `find <root> -name CLAUDE.md -type f -delete`.
+    // (helpers for our own in-snapshot annotations are defined below)
     const { readdir } = await import("node:fs/promises");
     const stack = [root];
     let deleted = 0;
@@ -239,7 +246,130 @@ async function checkOne(snapshot) {
         await rm(dir, { recursive: true, force: true });
     }
 }
-async function refreshOne(snapshot, { force }) {
+/**
+ * Flat-source files and directories that can name a companion skill. Deliberately
+ * excludes `third-party/` — scanning the snapshot being replaced would match the
+ * very copy we are about to overwrite and report every removal as still-referenced.
+ * The `plugins/` tree is excluded too: it is a build mirror of these files.
+ */
+export const REFERENCE_SOURCES = [
+    "optional-companions.json",
+    "skills",
+    "commands",
+    "scripts",
+    join("src", "hooks"),
+];
+/** Skill directory names inside a snapshot, sorted. Empty if there is no skills/ dir. */
+export function listSkillDirs(snapshotRoot) {
+    try {
+        return readdirSync(join(snapshotRoot, "skills"), { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/** Skills the old snapshot had that the incoming one does not. */
+export function findRemovedSkills(oldSkills, newSkills) {
+    const incoming = new Set(newSkills);
+    return oldSkills.filter((s) => !incoming.has(s));
+}
+function walkFiles(abs, out) {
+    let entries;
+    try {
+        entries = readdirSync(abs, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        const full = join(abs, e.name);
+        if (e.isDirectory())
+            walkFiles(full, out);
+        else
+            out.push(full);
+    }
+}
+/**
+ * Removed skills that our own source still routes to, with the files naming them.
+ *
+ * This is the check that turns a refresh into a loud failure instead of a silent
+ * one: when OMC 5.x deleted `ultrawork`, the snapshot became honest while our
+ * routing table kept pointing at it, and every gate stayed green. Matching is on
+ * the prefixed `<plugin>:<skill>` form with a boundary, so a bare English word
+ * ("release", "review") in prose is not a false positive and `omc:ultrawork-plus`
+ * does not match `omc:ultrawork`.
+ */
+export function findStaleReferences(repoRoot, routingPrefix, removedSkills) {
+    if (removedSkills.length === 0)
+        return [];
+    const files = [];
+    for (const rel of REFERENCE_SOURCES) {
+        const abs = join(repoRoot, rel);
+        let isDir = false;
+        try {
+            isDir = statSync(abs).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (isDir)
+            walkFiles(abs, files);
+        else
+            files.push(abs);
+    }
+    const stale = [];
+    for (const skill of removedSkills) {
+        const re = new RegExp(`${escapeRegExp(routingPrefix)}:${escapeRegExp(skill)}(?![A-Za-z0-9_-])`);
+        const hits = [];
+        for (const file of files) {
+            let text;
+            try {
+                text = readFileSync(file, "utf8");
+            }
+            catch {
+                continue;
+            }
+            if (re.test(text))
+                hits.push(relative(repoRoot, file));
+        }
+        if (hits.length > 0)
+            stale.push({ skill, files: hits.sort() });
+    }
+    return stale;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Files inside a snapshot directory that we author, not upstream. The refresh
+ * wipes the directory wholesale, so these have to be carried across it by hand.
+ * `OUR_NOTES.md` is the drift radar the vendoring contract requires;
+ * `.fork-only-skills.txt` is the allowlist the Skills Drift Check subtracts.
+ */
+export const OUR_FILES = ["OUR_NOTES.md", ".fork-only-skills.txt"];
+/** Read whichever of OUR_FILES exist under `localAbs`. Absent files are skipped. */
+export async function readOurFiles(localAbs) {
+    const saved = new Map();
+    for (const name of OUR_FILES) {
+        try {
+            saved.set(name, await readFile(join(localAbs, name)));
+        }
+        catch {
+            // Not every snapshot carries every one of these; absence is normal.
+        }
+    }
+    return saved;
+}
+/** Write the captured files back under `localAbs`. Returns how many were restored. */
+export async function restoreOurFiles(localAbs, saved) {
+    for (const [name, body] of saved)
+        await writeFile(join(localAbs, name), body);
+    return saved.size;
+}
+async function refreshOne(snapshot, { force, allowStaleRefs }) {
     const pinned = await readPinnedSha(snapshot);
     const localAbs = join(REPO_ROOT, snapshot.localPath);
     if (!force && (await pathExists(localAbs))) {
@@ -254,6 +384,31 @@ async function refreshOne(snapshot, { force }) {
             throw new Error(`[${snapshot.name}] upstream HEAD ${headSha} != pinned ${pinned}; ` +
                 `bump the pinned SHA in third-party/MANIFEST.md first`);
         }
+        // Refuse to land a snapshot that would make our own routing table lie.
+        // When OMC 5.x deleted `ultrawork`, refreshing made the snapshot honest while
+        // optional-companions.json, two skills/superpowers.md tables and the
+        // companion-preference OVERRIDES map kept naming it — and every gate stayed
+        // green, because nothing compared the two. Checked BEFORE the wipe, so a
+        // failure leaves the snapshot untouched and the operator retargets first.
+        const removedSkills = findRemovedSkills(listSkillDirs(localAbs), listSkillDirs(dir));
+        const staleRefs = findStaleReferences(REPO_ROOT, snapshot.routingPrefix, removedSkills);
+        if (staleRefs.length > 0) {
+            const detail = staleRefs
+                .map((r) => `    ${snapshot.routingPrefix}:${r.skill}\n      ${r.files.join("\n      ")}`)
+                .join("\n");
+            const message = `[${snapshot.name}] upstream removed ${staleRefs.length} skill(s) this repo still routes to:\n${detail}\n` +
+                `  Retarget or drop these references first, then re-run the refresh. ` +
+                `Pass --allow-stale-refs to land the snapshot anyway and fix them afterwards.`;
+            if (!allowStaleRefs)
+                throw new Error(message);
+            err(`  WARNING: ${message}`);
+        }
+        // Our own annotations live inside the snapshot directory, so the wipe below
+        // destroys them along with the upstream copy. That silently deleted
+        // OUR_NOTES.md on both the superpowers (#304) and oh-my-claudecode (#308)
+        // refreshes — the drift radar, removed by the tool whose drift it records.
+        // Capture before the wipe, put back after the copy.
+        const ourFiles = await readOurFiles(localAbs);
         // Wipe + recreate destination.
         await rm(localAbs, { recursive: true, force: true });
         await mkdir(localAbs, { recursive: true });
@@ -279,6 +434,10 @@ async function refreshOne(snapshot, { force }) {
         }
         // Strip every CLAUDE.md (auto-loads as session context).
         const stripped = await deleteClaudeMdRecursive(localAbs);
+        // Put our annotations back. After the CLAUDE.md strip, so a snapshot that
+        // ever carries an OUR_* named CLAUDE.md is not re-deleted; before the diff
+        // stat, so the printed diff reflects what actually landed on disk.
+        const preserved = await restoreOurFiles(localAbs, ourFiles);
         // Defense in depth: forcibly delete excludePostCopy paths from the
         // local snapshot, regardless of whether they were copied. Guards
         // against silent regressions if selectiveDirs is later edited to
@@ -322,7 +481,7 @@ async function refreshOne(snapshot, { force }) {
         log(`  upstream     : ${snapshot.upstream}`);
         log(`  pinned SHA   : ${pinned}`);
         log(`  upstream HEAD: ${headSha}`);
-        log(`  status       : updated (${copiedDirs} dirs, ${copiedFiles} files, ${stripped} CLAUDE.md stripped, ${excluded} excluded paths removed, ${patchedKeys} json keys patched)`);
+        log(`  status       : updated (${copiedDirs} dirs, ${copiedFiles} files, ${stripped} CLAUDE.md stripped, ${preserved} of ours preserved, ${excluded} excluded paths removed, ${patchedKeys} json keys patched)`);
         if (String(diffStat.stdout).trim()) {
             log("  diff --stat  :");
             for (const line of String(diffStat.stdout).trimEnd().split(/\r?\n/)) {
@@ -368,6 +527,10 @@ async function main() {
         exit(0);
     }
     const force = args.includes("--force");
+    // Deliberately NOT --force: that means "my tree is dirty, proceed", and a
+    // routine dirty-tree refresh must not silently switch off the stale-reference
+    // gate as a side effect.
+    const allowStaleRefs = args.includes("--allow-stale-refs");
     const check = args.includes("--check");
     const all = args.includes("--all");
     const positional = args.filter((a) => !a.startsWith("--"));
@@ -397,7 +560,7 @@ async function main() {
                     allUpToDate = false;
             }
             else {
-                await refreshOne(snap, { force });
+                await refreshOne(snap, { force, allowStaleRefs });
             }
         }
         catch (e) {
@@ -412,7 +575,14 @@ async function main() {
         exit(1);
     exit(0);
 }
-main().catch((e) => {
-    err(`fatal: ${e.stack || e.message}`);
-    exit(1);
-});
+// Only run the CLI when invoked as one. Without this, importing the module to
+// test its helpers would start a refresh. Same shape as the other bin/ scripts:
+// the endsWith fallback covers Windows, where argv[1] is a backslash path and
+// never equals the forward-slash file:// URL.
+const invokedDirectly = argv[1] !== undefined && import.meta.url.endsWith(argv[1].replace(/\\/g, "/"));
+if (invokedDirectly || argv[1]?.endsWith("refresh-third-party.mjs")) {
+    main().catch((e) => {
+        err(`fatal: ${e.stack || e.message}`);
+        exit(1);
+    });
+}

package/commands/discipline.md

@@ -19,6 +19,8 @@ Print this card and check yourself against each law.
 | 6 | **Iterate One Change** | Am I changing one thing at a time? | "And also..." |
 | 7 | **Learn From Every Session** | Did I capture this as an instinct? | "Next time I'll..." |
 
+Read the seven as three moments around every act. **Before** (Laws 1, 2): set the terms. **During** (Laws 3, 6): watch yourself. **After** (Laws 4, 5, 7): settle the account and carry it forward. Every check is an audit you run on yourself; every red flag is you hoping instead. The sentence this comes from, and its sources: `docs/philosophy.md`.
+
 ## Operator Stakes
 
 The Laws above are the *how*. These five principles are the *why*: code ships from your account, the incident lands on your pager, the bill hits your budget. Each one pairs with the Law that prevents it from going wrong.
@@ -31,7 +33,7 @@ The Laws above are the *how*. These five principles are the *why*: code ships fr
 | 4 | **Problem framing** | Builds the websocket chat the ticket asked for | Finds out users wanted faster support replies, not chat | 1 |
 | 5 | **Constraints management** | Calls the $0.02/image model on every upload | Does the math, adds client-side validation + caching + cheaper triage model | 2 |
 
-Code is a liability, not an asset. Speed without these five turns into someone else's incident at 3am — except the someone is you.
+Code is a liability, not an asset. Speed without these five turns into someone else's incident at 3am — except the someone is you. The other half of the why is not fear: the session ends and the context is gone, so the only work that survives is what you verified and wrote down for the one who comes after, whether that is tomorrow's session or the engineer who inherits the repo.
 
 ## Goal-Driven Execution maps onto the Laws
 
@@ -61,5 +63,6 @@ Before saying "Done", verify ALL:
 - [ ] I checked the **actual** result (not assumed)
 - [ ] Build passes
 - [ ] I can explain the change in one sentence
+- [ ] For each item above I checked, not hoped
 
-If you're skipping a step, that's the step you need most.
+If you're skipping a step, that's the step you need most. The step you skip is the one you are hoping through.

package/commands/reconcile.md

@@ -95,7 +95,7 @@ git branch -d <type>/<slug>            # delete the merged feature branch (safe
 ## Pairs with
 
 - **`reconcile`** skill — the discipline this command runs.
-- **`gateguard`** / **`safety-guard`** — runtime + destructive-op guardrails.
+- **`gateguard`** — the runtime gate for mutating tool calls and destructive shell.
 - **`recall`** — recall whether the same git op failed here before.
 - **`audit`** — the loop that often produces the fix `/reconcile` then ships.
 - **`/ship`** — the TDD-gated single-defect variant; `commit-commands:commit-push-pr` is the external-plugin equivalent of the commit → PR tail.

package/commands/superpowers.md

@@ -13,11 +13,11 @@ The 7 Laws define *what* discipline must be applied. `/superpowers` decides *whi
 
 | Source | Where it lives | Examples of what it routes to |
 |---|---|---|
-| `continuous-improvement` (this plugin) | bundled — always present | `gateguard` (Law 1), `tdd-workflow` (Law 3+4), `verification-loop` (Law 4), `wild-risa-balance` (Law 2), `safety-guard` (Law 3), `proceed-with-the-recommendation` (all 7), `ralph` (Law 6), `workspace-surface-audit` (Law 1) |
+| `continuous-improvement` (this plugin) | bundled — always present | `gateguard` (Law 1), `tdd-workflow` (Law 3+4), `verification-loop` (Law 4), `wild-risa-balance` (Law 2), `proceed-with-the-recommendation` (all 7), `ralph` (Law 6), `workspace-surface-audit` (Law 1) |
 | `obra/superpowers` (Jesse Vincent) | vendored at `third-party/superpowers/`, pinned SHA `f2cbfbe` (v5.1.0) | `superpowers:brainstorming`, `:writing-plans`, `:executing-plans`, `:test-driven-development`, `:systematic-debugging`, `:requesting-code-review`, `:receiving-code-review`, `:verification-before-completion`, `:dispatching-parallel-agents`, `:using-git-worktrees`, `:finishing-a-development-branch`, `:subagent-driven-development`, `:writing-skills`, `:using-superpowers` |
 | `addyosmani/agent-skills` | vendored at `third-party/addy-agent-skills/`, pinned SHA `742dca5` (v1.0.0) | `spec-driven-development`, `source-driven-development`, `context-engineering`, `idea-refine`, `incremental-implementation`, `code-review-and-quality`, `code-simplification`, `security-and-hardening`, `debugging-and-error-recovery`, `performance-optimization`, `api-and-interface-design`, `frontend-ui-engineering`, `browser-testing-with-devtools`, `ci-cd-and-automation`, `deprecation-and-migration`, `documentation-and-adrs`, `git-workflow-and-versioning`, `planning-and-task-breakdown`, `shipping-and-launch` |
 | `ruflo-swarm` (ruvnet) | vendored at `third-party/ruflo-swarm/`, pinned SHA `addb5cd` (v0.2.0) | `swarm-init`, `monitor-stream`; `swarm_*` and `agent_*` MCP tools; `/swarm`, `/watch` |
-| `oh-my-claudecode` (Yeachan-Heo) | vendored at `third-party/oh-my-claudecode/`, pinned SHA `aacde3e` (v4.13.6) | 38 skills + 19 agents — `release`, `ultrawork`, `ultraqa`, `team`, `trace`, `visual-verdict`, `debug`, `deep-dive`, `deep-interview`, `autopilot`, `autoresearch`, plus a separate `ralph` (overlaps with our `/ralph` — see "Distinct variants" below) |
+| `oh-my-claudecode` (Yeachan-Heo) | vendored at `third-party/oh-my-claudecode/`, pinned SHA `4820f56` (v5.3.0) | 37 skills + 19 agents — `release`, `ultragoal`, `launch`, `team`, `trace`, `visual-verdict`, `debug`, `review`, `research`, `deep-interview`, `autopilot`, `autoresearch`, plus a separate `ralph` (overlaps with our `/ralph` — see "Distinct variants" below) |
 
 PM coverage (product-management skills) lives **outside** this marketplace. If you need it, install [`phuryn/pm-skills`](https://github.com/phuryn/pm-skills) separately via Claude Code's host marketplace; the dispatcher names it as a routing target without pre-resolving the namespace. See [docs/THIRD_PARTY.md § Routing in /superpowers](../docs/THIRD_PARTY.md#routing-in-superpowers).
 

package/commands/verify-install.md

@@ -29,9 +29,14 @@ with the text `probe`) **without presenting any research first**.
 
 - If the hook **blocks** the write with a fact-list reason — the runtime layer is
   wired. Record `gateguard: ✓`. Do not retry the write; the block is the pass.
-- If the write **goes through** with no pause — the hook did not load. Record
-  `gateguard: ✗ (hooks/gateguard.mjs not wired — see README → Troubleshooting install)`.
-  Delete the probe file if it was created.
+- If the write **goes through** with no pause — either the hook did not load, or
+  `CI_GATEGUARD_EXCLUDE` is set to a fragment that matches the probe path (a
+  catch-all such as `/` or `.` matches every path and switches the file gate off;
+  the hook prints a one-line stderr notice when an exclusion fires). Run
+  `echo "$CI_GATEGUARD_EXCLUDE"` first. If it is empty, record
+  `gateguard: ✗ (hooks/gateguard.mjs not wired — see README → Troubleshooting install)`;
+  if it is set, record `gateguard: ✗ (excluded by CI_GATEGUARD_EXCLUDE=<value>; unset it or
+  narrow the fragment)`. Delete the probe file if it was created.
 
 ## Check 3 — observation capture recording
 

package/hooks/companion-preference.mjs

@@ -30,10 +30,10 @@
  * suite or a follow-up audit walks the table against this map.
  */
 import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { hashProjectRoot } from "../lib/gateguard-state.mjs";
 const OVERRIDES = {
     "tdd-workflow": {
         companion: "superpowers:test-driven-development",
@@ -48,11 +48,7 @@ const OVERRIDES = {
         plugin: "agent-skills",
     },
     ralph: {
-        companion: "oh-my-claudecode:ultrawork",
-        plugin: "oh-my-claudecode",
-    },
-    "learn-eval": {
-        companion: "oh-my-claudecode:retrospective",
+        companion: "oh-my-claudecode:ultragoal",
         plugin: "oh-my-claudecode",
     },
 };
@@ -125,10 +121,7 @@ function resolveProjectRoot() {
     return "global";
 }
 function telemetryPath(home) {
-    const hash = createHash("sha256")
-        .update(resolveProjectRoot())
-        .digest("hex")
-        .slice(0, 12);
+    const hash = hashProjectRoot(resolveProjectRoot());
     return join(home, ".claude", "instincts", hash, "companion-preference.jsonl");
 }
 /**