continuous-improvement 3.23.0 → 3.25.0

package/plugins/continuous-improvement/lib/config-guard-gate.mjs

@@ -0,0 +1,243 @@
+// config-guard-gate.mts — Pure decision core for the config-guard PreToolUse hook.
+//
+// The guardrails this plugin ships are wired by a handful of files: the
+// Claude Code settings files, the MCP config, hooks.json, the user hooks
+// directory, the installed-plugins cache, and plugin manifests. Nothing stopped
+// an agent from editing those files and switching every gate off, and
+// hooks/gateguard.mjs is designed to be cleared per file, not to hard-deny. This
+// module decides whether a tool call would mutate one of them. No I/O: the hook
+// (src/hooks/config-guard.mts) wires stdin and the mode env var around it, so a
+// table test covers every branch without spawning anything. Lives in lib/ so
+// tests can import it (the test-imports-only invariant forbids hooks/).
+//
+// Idea ported from karanb192/claude-code-hooks `config-guard` (MIT); the code
+// and the pattern list are ours. Fail-open by construction: an unrecognized mode
+// resolves to warn, and a call that names no protected path is always allowed.
+/**
+ * Path patterns, matched case-insensitively on the forward-slash form.
+ * A trailing "/" means a directory component anywhere in the path; otherwise
+ * the pattern must be the whole path or a trailing path segment, so
+ * `hooks.json.md` and `config/settings.json` are not matched.
+ */
+export const PROTECTED_PATTERNS = [
+    ".claude/settings.json",
+    ".claude/settings.local.json",
+    ".mcp.json",
+    "hooks.json",
+    ".claude/hooks/",
+    ".claude/plugins/",
+    ".claude-plugin/",
+];
+const ALLOW = { action: "allow", reason: "" };
+export function parseMode(raw) {
+    const v = (raw ?? "warn").trim().toLowerCase();
+    return v === "block" || v === "off" ? v : "warn";
+}
+function normalizePath(p) {
+    return p.replace(/\\/g, "/").toLowerCase();
+}
+export function matchProtectedPath(filePath) {
+    if (typeof filePath !== "string" || filePath === "")
+        return null;
+    const n = normalizePath(filePath);
+    for (const pattern of PROTECTED_PATTERNS) {
+        const lp = pattern.toLowerCase();
+        if (lp.endsWith("/")) {
+            if (n.includes(lp))
+                return pattern;
+            continue;
+        }
+        if (n === lp || n.endsWith(`/${lp}`))
+            return pattern;
+    }
+    return null;
+}
+// --- file tools ------------------------------------------------------------
+function fileToolPaths(toolInput) {
+    const paths = [];
+    if (typeof toolInput.file_path === "string")
+        paths.push(toolInput.file_path);
+    if (typeof toolInput.notebook_path === "string")
+        paths.push(toolInput.notebook_path);
+    if (Array.isArray(toolInput.edits)) {
+        for (const edit of toolInput.edits) {
+            if (edit && typeof edit === "object" && typeof edit.file_path === "string") {
+                paths.push(edit.file_path);
+            }
+        }
+    }
+    return paths;
+}
+const FILE_MUTATING_TOOLS = new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+// --- Bash --------------------------------------------------------------------
+// Split at shell separators that sit outside single or double quotes.
+function splitSimpleCommands(command) {
+    const segments = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote) {
+            current += ch;
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === "\n" || ch === ";") {
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        if (ch === "|" || ch === "&") {
+            if (command[i + 1] === ch)
+                i++;
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current);
+    return segments.map((s) => s.trim()).filter((s) => s !== "");
+}
+function tokenize(segment) {
+    return segment.split(/\s+/).filter((t) => t !== "");
+}
+function stripQuotes(token) {
+    return token.replace(/^['"]+|['"]+$/g, "");
+}
+function commandWord(tokens) {
+    let i = 0;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (t === "sudo" || t === "env" || t === "command" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+            i++;
+            continue;
+        }
+        break;
+    }
+    return { cmd: (tokens[i] ?? "").toLowerCase(), rest: tokens.slice(i + 1) };
+}
+const COPY_MOVE = new Set(["cp", "mv", "copy-item", "move-item"]);
+const OPERAND_WRITERS = new Set([
+    "rm",
+    "tee",
+    "truncate",
+    "remove-item",
+    "del",
+    "set-content",
+    "out-file",
+    "add-content",
+    "clear-content",
+]);
+// Mutation indicators for the generic scan (a protected path mentioned inside
+// a scripting one-liner such as `node -e "writeFileSync('.claude/settings.json')"`).
+const GENERIC_WRITE_RE = /writefilesync|writefile\(|appendfile|unlink|rename\(|copyfile|rmsync|truncate|set-content|out-file|add-content|remove-item|\bdel\b|\bsed\s+-i\b|\btee\b|>{1,2}/i;
+const CLAUDE_CLI_MUTATIONS = {
+    plugin: new Set(["install", "uninstall", "enable", "disable", "update", "marketplace"]),
+    mcp: new Set(["add", "remove", "add-json", "add-from-claude-desktop", "reset-project-choices"]),
+    config: new Set(["set", "add", "remove", "reset", "rm"]),
+};
+function classifyBashSegment(segment) {
+    const tokens = tokenize(segment);
+    if (tokens.length === 0)
+        return null;
+    const { cmd, rest } = commandWord(tokens);
+    // `claude plugin|mcp|config <mutating-verb>`: the CLI edits the same files.
+    if (cmd === "claude") {
+        const area = (rest[0] ?? "").toLowerCase();
+        const verb = (rest[1] ?? "").toLowerCase();
+        const verbs = CLAUDE_CLI_MUTATIONS[area];
+        if (verbs && verbs.has(verb)) {
+            return { target: `claude ${area} ${verb}`, pattern: "claude-cli", via: "claude-cli" };
+        }
+        return null;
+    }
+    // cp / mv: only the destination (last operand) can be a protected write.
+    if (COPY_MOVE.has(cmd)) {
+        const operands = rest.filter((t) => !t.startsWith("-"));
+        const dest = operands[operands.length - 1];
+        const pattern = dest ? matchProtectedPath(stripQuotes(dest)) : null;
+        return pattern && dest ? { target: stripQuotes(dest), pattern, via: "bash" } : null;
+    }
+    // Redirects: `> path`, `>> path`, `2>path`, `>path`.
+    for (let i = 0; i < tokens.length; i++) {
+        const t = tokens[i];
+        const m = /^(\d?>{1,2})(.*)$/.exec(t);
+        if (!m)
+            continue;
+        const target = m[2] !== "" ? m[2] : (tokens[i + 1] ?? "");
+        const pattern = matchProtectedPath(stripQuotes(target));
+        if (pattern)
+            return { target: stripQuotes(target), pattern, via: "bash" };
+    }
+    // Operand writers: any operand that is a protected path.
+    const sedInPlace = cmd === "sed" && rest.some((t) => /^-[a-zA-Z]*i/.test(t) || t === "--in-place");
+    if (OPERAND_WRITERS.has(cmd) || sedInPlace) {
+        for (const t of rest) {
+            if (t.startsWith("-"))
+                continue;
+            const clean = stripQuotes(t);
+            const pattern = matchProtectedPath(clean);
+            if (pattern)
+                return { target: clean, pattern, via: "bash" };
+        }
+        return null;
+    }
+    // Generic scan: a protected path quoted inside a scripting one-liner, next
+    // to a write indicator. Reads (`cat`, `grep`) carry no indicator and pass.
+    if (GENERIC_WRITE_RE.test(segment)) {
+        const candidates = [];
+        const quoted = /'([^']+)'|"([^"]+)"/g;
+        let q;
+        while ((q = quoted.exec(segment)) !== null)
+            candidates.push((q[1] ?? q[2]));
+        for (const t of tokens)
+            candidates.push(stripQuotes(t));
+        for (const c of candidates) {
+            const inner = /['"]([^'"]*?)['"]/.exec(c);
+            for (const candidate of [c, inner?.[1] ?? ""]) {
+                const pattern = matchProtectedPath(candidate);
+                if (pattern)
+                    return { target: candidate, pattern, via: "bash" };
+            }
+            // A path embedded in a longer expression, e.g. writeFileSync('.claude/settings.json','{}')
+            const embedded = /(?:^|[('"\s=,])([~A-Za-z0-9_./\\:-]*(?:\.claude\/|\.claude-plugin\/|\.mcp\.json|hooks\.json)[A-Za-z0-9_./\\-]*)/i.exec(c);
+            if (embedded) {
+                const pattern = matchProtectedPath(embedded[1]);
+                if (pattern)
+                    return { target: embedded[1], pattern, via: "bash" };
+            }
+        }
+    }
+    return null;
+}
+/** Decide whether a tool call would mutate a guardrail-wiring file. Pure. */
+export function classifyMutation(toolName, toolInput) {
+    if (FILE_MUTATING_TOOLS.has(toolName)) {
+        for (const p of fileToolPaths(toolInput)) {
+            const pattern = matchProtectedPath(p);
+            if (pattern)
+                return { target: p, pattern, via: "file" };
+        }
+        return null;
+    }
+    if (toolName === "Bash" && typeof toolInput.command === "string" && toolInput.command.trim() !== "") {
+        for (const segment of splitSimpleCommands(toolInput.command)) {
+            const hit = classifyBashSegment(segment);
+            if (hit)
+                return hit;
+        }
+    }
+    return null;
+}
+export function decide(mode, gated, reason) {
+    if (!gated || mode === "off")
+        return ALLOW;
+    return { action: mode === "block" ? "block" : "warn", reason };
+}

package/plugins/continuous-improvement/lib/destructive-bash.mjs

@@ -0,0 +1,216 @@
+/**
+ * Destructive-Bash classifier for hooks/gateguard.mjs.
+ *
+ * Two layers, pure and dependency-free so a table test and a future
+ * `gateguard-explain` CLI can drive it without spawning the hook:
+ *
+ *   1. Structured rules: the command is split at unquoted separators
+ *      (`|`, `||`, `&&`, `;`, newline) and each simple command is tokenized,
+ *      so flag order and spelling stop mattering. `rm -r -f`, `rm -Rf` and
+ *      `rm --recursive --force` are the same command; `git clean -fdx` and
+ *      `git clean --force -d` are the same command. Each rule has a stable id
+ *      the deny reason prints, so a block is explainable.
+ *   2. The original substring list, kept verbatim as the fallback so nothing
+ *      that was caught before stops being caught.
+ *
+ * What is deliberately NOT here: plain file writes through Bash (`cat > x`,
+ * `sed -i`). Gating those would break the operator workflow that uses Bash
+ * precisely to write files; that limit is disclosed on the site and README.
+ *
+ * Message-flag carve-out: the VALUE of a commit message, PR body, title, or
+ * note is prose, never a command. It is blanked before any rule runs, so
+ * `git commit -m "rm -rf the old helper"` stays allowed. `-c` is not a message
+ * flag: `bash -c "rm -rf /"` carries a real command and still gates.
+ */
+export const DESTRUCTIVE_PATTERNS = [
+    "rm -rf",
+    "rm -fr",
+    "git reset --hard",
+    "git push --force",
+    "git push -f",
+    "--force-with-lease",
+    "git branch -D",
+    "drop table",
+    "drop database",
+    "drop schema",
+    "truncate ",
+    "mkfs",
+    "dd if=",
+    "format ",
+    "rmdir /s",
+    "del /f /q",
+    "del /q /f",
+    "Remove-Item -Recurse",
+    "Remove-Item -Force",
+];
+// Flags whose VALUE is human prose (a commit message, a PR body) or a filename —
+// never a command to execute. Their contents must not trip the destructive scan.
+const MESSAGE_FLAG_RE = /(^|\s)(-m|--message|-F|--file|--body|--body-file|--title|--notes|-C|--reuse-message)(=|\s+)('[^']*'|"[^"]*"|\S+)/g;
+/** Blank the value of every message/body flag; the flag itself is preserved. */
+export function stripMessageArgs(command) {
+    return command.replace(MESSAGE_FLAG_RE, (_match, lead, flag) => `${lead}${flag} `);
+}
+// Split at shell separators that sit outside single or double quotes.
+function splitSimpleCommands(command) {
+    const segments = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote) {
+            current += ch;
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            current += ch;
+            continue;
+        }
+        if (ch === "\n" || ch === ";") {
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        if (ch === "|" || ch === "&") {
+            // `||`, `&&`, `|`, `&` all end the simple command; collapse a doubled char.
+            if (command[i + 1] === ch)
+                i++;
+            segments.push(current);
+            current = "";
+            continue;
+        }
+        current += ch;
+    }
+    segments.push(current);
+    return segments.map((s) => s.trim()).filter((s) => s !== "");
+}
+function tokenize(segment) {
+    return segment.split(/\s+/).filter((t) => t !== "");
+}
+// Drop `sudo`, `env`, and leading VAR=value assignments so the command word is
+// the first token the rules look at.
+function commandTokens(segment) {
+    const tokens = tokenize(segment);
+    let i = 0;
+    while (i < tokens.length) {
+        const t = tokens[i];
+        if (t === "sudo" || t === "env" || t === "command" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(t)) {
+            i++;
+            continue;
+        }
+        break;
+    }
+    return tokens.slice(i);
+}
+// For `git`, skip global options (`-C <dir>`, `-c k=v`, `--git-dir=…`) to find
+// the subcommand and its own arguments.
+function gitSubcommand(tokens) {
+    if (tokens[0] !== "git")
+        return null;
+    let i = 1;
+    while (i < tokens.length && tokens[i].startsWith("-")) {
+        const t = tokens[i];
+        i += t === "-C" || t === "-c" || t === "--git-dir" || t === "--work-tree" ? 2 : 1;
+    }
+    const sub = tokens[i];
+    if (!sub)
+        return null;
+    return { sub, args: tokens.slice(i + 1) };
+}
+const isShortFlag = (t) => /^-[A-Za-z]+$/.test(t);
+const hasShortLetter = (t, letters) => isShortFlag(t) && letters.test(t.slice(1));
+const STRUCTURED_RULES = [
+    {
+        id: "rm-recursive-force",
+        test: (tokens) => {
+            if (tokens[0] !== "rm")
+                return false;
+            const flags = tokens.slice(1).filter((t) => t.startsWith("-"));
+            const recursive = flags.some((t) => t === "--recursive" || hasShortLetter(t, /[rR]/));
+            const force = flags.some((t) => t === "--force" || hasShortLetter(t, /f/));
+            return recursive && force;
+        },
+    },
+    {
+        id: "git-clean-force",
+        test: (tokens) => {
+            const git = gitSubcommand(tokens);
+            if (!git || git.sub !== "clean")
+                return false;
+            const dryRun = git.args.some((t) => t === "--dry-run" || hasShortLetter(t, /n/));
+            const force = git.args.some((t) => t === "--force" || hasShortLetter(t, /f/));
+            return force && !dryRun;
+        },
+    },
+    {
+        id: "git-checkout-discard",
+        test: (tokens) => {
+            const git = gitSubcommand(tokens);
+            if (!git || git.sub !== "checkout")
+                return false;
+            const dash = git.args.indexOf("--");
+            if (dash !== -1)
+                return git.args.length > dash + 1; // `git checkout -- <pathspec>` discards
+            const first = git.args.find((t) => !t.startsWith("-"));
+            return first === "." || first === "./";
+        },
+    },
+    {
+        id: "git-restore-discard",
+        test: (tokens) => {
+            const git = gitSubcommand(tokens);
+            if (!git || git.sub !== "restore")
+                return false;
+            const pathspec = git.args.some((t) => !t.startsWith("-"));
+            if (!pathspec)
+                return false;
+            const staged = git.args.some((t) => t === "--staged" || hasShortLetter(t, /S/));
+            const worktree = git.args.some((t) => t === "--worktree" || hasShortLetter(t, /W/));
+            return !staged || worktree; // `--staged` alone only unstages
+        },
+    },
+    {
+        id: "find-delete",
+        test: (tokens) => tokens[0] === "find" && tokens.includes("-delete"),
+    },
+    {
+        id: "git-push-plus-refspec",
+        test: (tokens) => {
+            const git = gitSubcommand(tokens);
+            if (!git || git.sub !== "push")
+                return false;
+            return git.args.some((t) => t.startsWith("+") && t.length > 1);
+        },
+    },
+    {
+        id: "git-stash-drop",
+        test: (tokens) => {
+            const git = gitSubcommand(tokens);
+            if (!git || git.sub !== "stash")
+                return false;
+            return git.args[0] === "drop" || git.args[0] === "clear";
+        },
+    },
+];
+/** Classify one Bash command string. Pure; never throws on odd input. */
+export function classifyDestructiveBash(command) {
+    if (typeof command !== "string" || command.trim() === "")
+        return { destructive: false, rule: null };
+    const stripped = stripMessageArgs(command);
+    for (const segment of splitSimpleCommands(stripped)) {
+        const tokens = commandTokens(segment);
+        if (tokens.length === 0)
+            continue;
+        for (const rule of STRUCTURED_RULES) {
+            if (rule.test(tokens))
+                return { destructive: true, rule: rule.id };
+        }
+    }
+    const lower = stripped.toLowerCase();
+    const hit = DESTRUCTIVE_PATTERNS.find((p) => lower.includes(p.toLowerCase()));
+    if (hit !== undefined)
+        return { destructive: true, rule: `substring:${hit}` };
+    return { destructive: false, rule: null };
+}

package/plugins/continuous-improvement/lib/gateguard-state.mjs

@@ -45,7 +45,7 @@ export function resolveSessionDir(sessionId) {
     if (fromEnv)
         return fromEnv;
     const projectRoot = resolveProjectRoot();
-    const projectHash = createHash("sha256").update(canonicalizeProjectRoot(projectRoot)).digest("hex").slice(0, 12);
+    const projectHash = hashProjectRoot(projectRoot);
     const base = join(resolveInstinctsRoot(), projectHash);
     const scoped = sanitizeSessionId(sessionId);
     return scoped ? join(base, "sessions", scoped) : base;
@@ -160,6 +160,10 @@ export function canonicalizeProjectRoot(p) {
 export function canonicalizeFileKey(p) {
     return canonicalizePath(p);
 }
+/** SHA-256[:12] of the canonical project root. C:/x, c:/x, and C:\\x share a bucket. */
+export function hashProjectRoot(projectRoot) {
+    return createHash("sha256").update(canonicalizeProjectRoot(projectRoot)).digest("hex").slice(0, 12);
+}
 export function isFileCleared(state, filePath) {
     return canonicalizeFileKey(filePath) in state.cleared_files;
 }

package/plugins/continuous-improvement/lib/plugin-metadata.mjs

@@ -26,7 +26,7 @@ const KEYWORDS = [
     "transcript-linter",
 ];
 const CLAUDE_PLUGIN_CATEGORY = "productivity";
-const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 29 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
+const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
 // Four vendored upstream companions registered alongside the CI plugin.
 // Each entry points at a pinned-SHA snapshot under third-party/<name>/.
 // See third-party/MANIFEST.md for refresh recipes and per-snapshot
@@ -474,6 +474,11 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
         timeout: hookTimeoutSeconds,
     };
+    const configGuardCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/config-guard.mjs\"",
+        timeout: hookTimeoutSeconds,
+    };
     const observeCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/bin/observe.mjs\"",
@@ -538,6 +543,12 @@ export function getPluginHooksConfig() {
                 // Edit/Read/etc. Warn-default (CLAUDE_CI_HOOKPACK_GATE) — never blocks
                 // until the operator opts in.
                 { matcher: "Bash", hooks: [hookPackCommand] },
+                // config-guard watches the files that wire the guardrails
+                // (.claude/settings*.json, .mcp.json, hooks.json, .claude/hooks/,
+                // .claude/plugins/, .claude-plugin/) and the `claude plugin|mcp|config`
+                // CLI forms. Matcher keeps read-only tools off the hot path.
+                // Warn-default (CI_CONFIG_GUARD) — denies only under block.
+                { matcher: "Bash|Edit|MultiEdit|Write|NotebookEdit", hooks: [configGuardCommand] },
             ],
             PostToolUse: [{ hooks: [observeCommand] }],
             UserPromptSubmit: [{ hooks: [routePromptCommand, recallBriefingCommand] }],

package/plugins/continuous-improvement/scripts/route-recommendation.routes.json

@@ -191,14 +191,14 @@
     {
       "name": "Multi-session retrospective across a sprint",
       "patterns": ["retrospective", "sprint review", "multi.session review", "what worked.*what failed"],
-      "preferred": ["oh-my-claudecode:retrospective", "learn-eval"],
+      "preferred": ["learn-eval"],
       "fallback": "What worked / what failed / what to do differently / 3 ranked next moves.",
       "marker": "oh-my-claudecode"
     },
     {
       "name": "Long autonomous run with quality gates",
       "patterns": ["long autonomous", "ultrawork", "quality gates? (between|per) iteration"],
-      "preferred": ["oh-my-claudecode:ultrawork", "ralph"],
+      "preferred": ["oh-my-claudecode:ultragoal", "ralph"],
       "fallback": "PRD-shaped autonomous loop with verify-between-iterations.",
       "marker": "oh-my-claudecode"
     },

package/plugins/continuous-improvement/skills/README.md

@@ -34,7 +34,6 @@ skill set on disk.
 - `reconcile` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Establishes git ground truth — branch, status, stashes, worktrees, ahead/behind — before any mutation, halts on protected or destructive operations, then carries the known-good state through to a landed PR: stage by filename, commit one concern, push the feature branch, verify the push landed, open the PR, and after the PR merges fast-forward the default branch and check it out.
 - `recovery-classification` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. After any failure in the verification ladder or auto-loop, classify the failure class before retrying — provider, tool-schema, deterministic-policy, git, worktree, runtime — so retry-vs-pause-vs-self-heal-vs-stop is an intentional decision, not a generic 'try again'.
 - `roast` — Enforces Law 1 (Research Before Executing) of the 7 Laws of AI Agent Discipline. Convene a 5-persona adversarial council (Contrarian, Expansionist, Logician, Researcher, Buyer) that attacks an idea from every angle, then a Judge returns one GO / RESHAPE / KILL verdict plus the cheapest 48-hour test to de-risk it — so you pressure-test an idea before sinking time into building the wrong thing.
-- `safety-guard` — Enforces Law 3 (One Thing at a Time) of the 7 Laws of AI Agent Discipline by scoping edits to a directory and blocking destructive shell commands. Use this skill to prevent destructive operations when working on production systems or running agents autonomously.
 - `simplicity-review` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Reviews the current diff for over-engineering (code that could reuse an existing file, a stdlib or native feature, or fewer lines) and reports trim findings without touching code, so 'it works' is never mistaken for 'it is the minimum that works'.
 - `skill-distillation` — Enforces Law 7 (Learn From Every Session) of the 7 Laws of AI Agent Discipline. Distills repeated successful tool sequences into reusable draft instincts, so a pattern that worked three times becomes a captured recipe instead of being re-derived from scratch every session.
 - `state-reconciliation` — Enforces Law 4 (Verify Before Reporting) of the 7 Laws of AI Agent Discipline. Pre-dispatch invariant: reconcile DB-vs-disk-vs-memory state before any unit runs, so a stale flag, missing artifact, or out-of-sync row never re-dispatches a unit that already completed or never started.

package/plugins/continuous-improvement/skills/continuous-improvement/SKILL.md

@@ -42,6 +42,8 @@ Before executing, state:
 - Build passes
 - You can explain what changed in one sentence
 
+"Done" is an audit, not a hope: settle the actual result against the Verification you stipulated in Law 2.
+
 ## Law 5: Reflect After Every Session
 
 After non-trivial tasks:
@@ -59,6 +61,8 @@ After non-trivial tasks:
 
 The "Rule to add" field feeds Law 7 — it becomes an instinct with 0.6 starting confidence.
 
+This block is the ledger: what worked and what failed are the session's gains and losses; the rule to add is what you carry into the session you will not be in.
+
 The "Iteration — Next best recommendations" field feeds Law 6. List the **top 3 ranked** core-development moves based on the current code state — what to build, fix, refactor, or investigate next so the feature/system advances. Item #1 is the strongest recommendation; #2 and #3 are alternative directions the user can pick from. NOT git plumbing (commit, push, PR), NOT pure CI ceremony (run tests, type-check), NOT deploy steps. Those belong in the end-of-run summary, not here.
 
 Format per item: `<verb> <object at path:line> (<why, one clause grounded in current context>)`.

package/plugins/continuous-improvement/skills/deploy-receipt/SKILL.md

@@ -157,7 +157,7 @@ The rollback command is **printed**, not run. The skill's job is to give the ope
 - `finishing-a-development-branch` (vendored, third-party/superpowers/) — runs first; reports the merge. This skill runs after.
 - `verification-loop` — same Law 4 family; this skill is the deploy-seam specialization
 - `proceed-with-the-recommendation` — routing-table row for "Merge / close branch" should pair `finishing-a-development-branch` with this skill when the project is auto-deploy
-- `safety-guard` — orthogonal; safety-guard prevents destructive ops, this verifies post-deploy state
+- `gateguard` — orthogonal; gateguard gates the destructive op, this verifies post-deploy state
 
 ## Close-the-Loop Rule
 

package/plugins/continuous-improvement/skills/gateguard/SKILL.md

@@ -77,7 +77,7 @@ Before creating {file_path}, present these facts:
 
 ### Destructive Bash Gate (every destructive command)
 
-Triggers on: `rm -rf`, `git reset --hard`, `git push --force`, `drop table`, etc.
+Triggers on structured rules that ignore flag order and spelling — `rm` with any recursive plus any force flag (`rm -r -f`, `rm -Rf`, `rm --recursive --force`), `git clean` with a force flag and no dry run, `git checkout -- <path>` or `git checkout .`, `git restore <path>` unless it is `--staged` only, `find … -delete`, `git push` with a `+refspec`, `git stash drop|clear` — plus the original substring list (`rm -rf`, `git reset --hard`, `git push --force`, `git branch -D`, `drop table`, `truncate `, `Remove-Item -Recurse`, etc.). Each command is judged after `&&`, `||`, `|`, `;` splitting, and a commit message, PR body or title value is blanked first so prose never trips it. The deny reason prints `Matched rule: <id>` so a block is explainable; the classifier is `lib/destructive-bash.mjs`. Plain file writes through Bash (`cat > file`, `sed -i`) are deliberately not gated.
 
 ```
 1. List all files/data this command will modify or delete
@@ -154,10 +154,24 @@ The inline `_gateguard_facts_presented: true` retry still works on harnesses tha
 
 Set the `CI_GATEGUARD_EXCLUDE` environment variable to opt specific low-risk paths out of the gate entirely — an LLM-maintained prose wiki, a generated scratch directory, anything where the fact-forcing pause costs more than it saves. The value is a comma-separated list of path substrings, each matched case-insensitively against the forward-slash-normalized file path, so `/mywiki/` excludes `D:\Vault\MyWiki\notes\x.md`. Unset or empty (the default) changes nothing: every mutating file call is gated exactly as before, and a call that touches a mix of excluded and non-excluded paths still gates the non-excluded ones. Set it per project in `.claude/settings.json` under `env`, or globally in `~/.claude/settings.json`.
 
+An exclusion is never silent. When every target of a call is excluded, `hooks/gateguard.mjs` still allows it but prints one stderr line naming the fragment that matched (`gateguard: skipped by CI_GATEGUARD_EXCLUDE (fragment "docs/wiki" matched docs/wiki/page.md)`). A catch-all fragment that every path contains (`/`, `.`, any single character) is honoured too, but the line says what it really is: the file gate is off for this session. Destructive Bash is never excluded. If `/verify-install` reports the probe write went through, check this variable before concluding the hook is not wired.
+
 ### Locking edits to the current repo
 
 A fact-list can't catch a wrong-repo or wrong-worktree write — you can present perfect facts about the wrong file, in the wrong checkout. Set `CI_GATEGUARD_TARGET_LOCK=block` to make the runtime hook (`hooks/gateguard.mjs`) refuse any mutating call whose **absolute** target canonicalizes outside the session project root (`CLAUDE_PROJECT_DIR`, or the git toplevel). Relative paths resolve under the current directory (= the root) and always pass; only an absolute path into a different tree is denied, and the deny reason names both the stray target and the expected root. This runs before the fact gate and independent of clearance — a wrong-repo write is wrong even with facts. Unset (the default) checks nothing, so legitimate out-of-root edits (`~/.claude`, a `/tmp` scratch file, a sibling repo) are unaffected; turn it on per session in a multi-worktree or headless run where cross-repo writes are the real risk. Paths already covered by `CI_GATEGUARD_EXCLUDE` are never target-locked.
 
+### Migrating from `safety-guard` (retired 2026-08-07)
+
+`safety-guard` was a prose-only tier-2 skill describing three "modes" it never implemented — no hook, no command, no logger ever shipped with it. Every mode it described is already enforced here by the runtime hook (`hooks/gateguard.mjs`):
+
+| Retired `safety-guard` mode | What enforces it now |
+|---|---|
+| Careful — warn on `rm -rf`, `git push --force`, `git reset --hard`, `DROP TABLE`, `chmod 777`, `--no-verify` … | [Destructive Bash Gate](#destructive-bash-gate-every-destructive-command). Its pattern set is a superset of the retired watch list, and it blocks rather than warns. |
+| Freeze — restrict writes to one directory tree | `CI_GATEGUARD_TARGET_LOCK=block` (above). Canonicalizes the absolute target against the session project root and refuses strays — before the fact gate, independent of clearance. |
+| Guard — careful + freeze together | Both of the above; they compose. Narrow the surface further with `CI_GATEGUARD_EXCLUDE`. |
+
+If you previously opted into `safety-guard` for autonomous or production-adjacent runs, set `CI_GATEGUARD_TARGET_LOCK=block` for that session instead. That is a real refusal, not a checklist the agent can talk itself out of.
+
 ### Limitations and guarantees
 
 - **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap — counted per session — bounds damage from stuck loops or rogue agents.
@@ -188,5 +202,6 @@ The standalone `gateguard-ai` Python/CLI package referenced in earlier drafts of
 
 ## Related Skills
 
-- `safety-guard` — Runtime safety checks (complementary, not overlapping)
+- `worktree-safety` — validates the worktree root before a source write; this skill gates the write itself
+- `reconcile` — git ground truth before a destructive git action
 - `code-reviewer` — Post-edit review (GateGuard is pre-edit investigation)

package/plugins/continuous-improvement/skills/proceed-with-the-recommendation/SKILL.md

@@ -235,8 +235,8 @@ Rows whose **Preferred skill** is not bundled with the `continuous-improvement`
 | Fan out N agents on isolated worktrees with shared contract | `superpowers:dispatching-parallel-agents` → `ruflo-swarm:swarm-init` | Use the swarm contract: fixed roles + base ref + shared contract test; reconcile results after. (Reference behavior — does not require `ruflo-swarm`.) |
 | Stream live observation of long agent runs | `ruflo-swarm:monitor-stream` | Push-based event log; poll fallback if the MCP server is offline. (Reference behavior — does not require `ruflo-swarm`.) |
 | Visual regression / browser-level diff | `oh-my-claudecode:visual-verdict` | Playwright screenshot diff against staging baseline. (Reference behavior — does not require `oh-my-claudecode`.) |
-| Multi-session retrospective across a sprint | `oh-my-claudecode:retrospective` → `learn-eval` | What worked / what failed / what to do differently / 3 ranked next moves. (Reference behavior — does not require `oh-my-claudecode`.) |
-| Long autonomous run with quality gates | `oh-my-claudecode:ultrawork` → `ralph` | PRD-shaped autonomous loop with verify-between-iterations. (Reference behavior — does not require `oh-my-claudecode`.) |
+| Multi-session retrospective across a sprint | `learn-eval` | What worked / what failed / what to do differently / 3 ranked next moves. (Reference behavior — does not require `oh-my-claudecode`.) |
+| Long autonomous run with quality gates | `oh-my-claudecode:ultragoal` → `ralph` | PRD-shaped autonomous loop with verify-between-iterations. (Reference behavior — does not require `oh-my-claudecode`.) |
 | Product-management work (PRD, user stories, acceptance criteria, OKRs, experiments, personas, JTBD, lean canvas, market sizing, competitive analysis, meetings family, launch checklist) | Install phuryn/pm-skills via Claude Code marketplace — see docs/THIRD_PARTY.md | Out-of-band install (`claude plugin marketplace add phuryn/pm-skills` + the eight `pm-*@pm-skills` plugins). Inline fallback: keep the work shape (problem → user → goal → metric → scope; Given/When/Then per story; objective + 3-5 measurable KRs; we-believe / we'll-know hypothesis; TAM/SAM/SOM bottom-up; cross-cutting meetings agenda/brief/recap/synthesize) without depending on a specific routing target. |
 
 ## Phase 4: Verify (Law 4 — Verify Before Reporting)

package/plugins/continuous-improvement/skills/reconcile/SKILL.md

@@ -177,6 +177,5 @@ git branch -d <type>/<slug>            # delete the merged feature branch (safe
 
 - **`recall`** (Law 1) — before a risky git op, recall whether the same operation failed on this repo before.
 - **`gateguard`** (Law 1) — the runtime gate (`hooks/gateguard.mjs`); `reconcile` is the procedure you run once a destructive git action is in play.
-- **`safety-guard`** — destructive-operation guardrails for production and autonomous runs.
 - **`audit`** (Law 4) — when an audit ends in a fix, `reconcile` is the safe path from branch to landed PR.
 - **`commit-commands:commit-push-pr`** — the external-plugin equivalent of the commit → push → PR tail; `reconcile` reimplements it inline so the flow works with no companion installed. For a TDD-gated single-defect variant, use `/ship`.