continuous-improvement 3.24.0 → 3.25.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.24.0",
+      "version": "3.25.0",
       "source": "./plugins/continuous-improvement",
       "author": {
         "name": "naimkatiman"

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to this skill are documented here.
 
 ---
 
+## [3.25.0] — 2026-09-07
+
+### Added
+
+- **Tagged releases now deploy continuous-improvement.dev** — after npm publish, `release.yml` deploys `docs/landing` to the Cloudflare Pages project and re-reads the live domain so a missed deploy fails the release instead of turning `landing-drift.yml` red the next morning. Gated on `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID`: without them the step warns and skips, so a fork still gets a complete publish. Last in the job, so a Cloudflare outage cannot block npm. (#307)
+- **`verify:test-count`** — every surface that states the suite size must agree, and CI tees `npm test` then asserts the claimed count against the real run. The filesystem cannot derive the number (generated cases in loops), so the docs stay the source of truth and the live run is the check. (#306)
+- **`verify:invariant-count`** — derives the invariant list from the `verify:all` script and fails if `CLAUDE.md`, `AGENTS.md`, or `docs/RELEASING.md` claim a different count or a different ordered name list. (#312)
+
+### Changed
+
+- **oh-my-claudecode snapshot 4.13.6 → 5.3.0** — `ultrawork` is gone upstream; the autonomous-run row now routes to `ultragoal`. The never-existent `oh-my-claudecode:retrospective` target is dropped rather than substituted. (#308, #309)
+- **obra/superpowers snapshot 5.1.0 → 6.3.0**. (#304)
+- **`verify:routing-targets` checks the vendored snapshot**, not just the declaration in `optional-companions.json`. A declared `oh-my-claudecode:` / `superpowers:` / `agent-skills:` / `ruflo-swarm:` target must exist at `third-party/<snapshot>/skills/<name>/`. (#311)
+
+### Fixed
+
+- **`refresh-third-party.mjs` keeps `OUR_NOTES.md` and `.fork-only-skills.txt`** across the wipe, and reports how many of ours were preserved. (#310)
+- **Refresh aborts before the wipe** if upstream removed a skill our flat source still routes to, naming the skills and files. Bypass is `--allow-stale-refs`, not `--force`. (#313)
+- **Brainstorming dispatcher wording** now describes the three-path router, not just the architectural path. (#305)
+
 ## [3.24.0] — 2026-09-06
 
 ### Added

package/bin/check-invariant-count.mjs

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+/**
+ * Invariant Count Check
+ *
+ * `CLAUDE.md` and `AGENTS.md` tell an agent, as a hard instruction, to run
+ * `npm run verify:all` and state how many invariants that is plus the full
+ * ordered list. `docs/RELEASING.md` states the count in its release checklist.
+ * All three are hand-maintained prose, and all three drifted: on 2026-09-06
+ * CLAUDE.md and RELEASING.md said 16 against an actual 17, and AGENTS.md — the
+ * file Codex reads as its contract — said **12** and listed an incomplete set,
+ * having missed skill-count-prose, command-count, landing-version and
+ * reconcile-parity entirely.
+ *
+ * That is worse than a stale number. An agent told "12 invariants" that sees 17
+ * OK lines has no way to know whether it ran too much or the doc is wrong, and
+ * an agent reading the list as authoritative will not notice an invariant it was
+ * never told about.
+ *
+ * Source of truth: the `verify:all` script in package.json. Everything before
+ * the first non-`verify:` step is a content invariant; the rest (today just
+ * `typecheck`) is the trailing tail the docs name after the colon. Derived, not
+ * hardcoded, so adding an invariant to the chain is the only edit needed to make
+ * this check demand the docs follow.
+ *
+ * Two claim shapes are recognised:
+ *   long  — "(17 content invariants + typecheck: a, b, …, typecheck)"  count + ordered names
+ *   short — "(17 invariants + typecheck)"                              count only
+ *
+ * Fail-closed: a scanned file with no claim at all is a violation, not a pass.
+ *
+ * Usage:
+ *   node bin/check-invariant-count.mjs              # Check the current repo
+ *   node bin/check-invariant-count.mjs <repo-root>  # Check a specific repo root
+ *
+ * Exit codes:
+ *   0 — every claim matches the verify:all chain
+ *   1 — a count is stale, a name list is wrong or out of order, or a file states none
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { argv, cwd, exit } from "node:process";
+/** Files that carry a verify:all claim. Explicit, so dropping one is deliberate. */
+export const CLAIM_FILES = ["CLAUDE.md", "AGENTS.md", join("docs", "RELEASING.md")];
+const LONG_RE = /\((\d+) content invariants \+ typecheck:\s*([^)]+)\)/g;
+const SHORT_RE = /\((\d+) invariants \+ typecheck\)/g;
+/** Split the verify:all chain into `verify:*` invariants and the trailing steps. */
+export function parseVerifyAllChain(chainScript) {
+    const steps = [...chainScript.matchAll(/npm run ([A-Za-z0-9:_-]+)/g)].map((m) => m[1]);
+    const invariants = [];
+    const trailing = [];
+    for (const step of steps) {
+        if (step.startsWith("verify:"))
+            invariants.push(step.slice("verify:".length));
+        else
+            trailing.push(step);
+    }
+    return { invariants, trailing };
+}
+export function parseClaims(content) {
+    const claims = [];
+    for (const m of content.matchAll(LONG_RE)) {
+        claims.push({
+            count: Number(m[1]),
+            names: m[2].split(",").map((s) => s.trim()).filter(Boolean),
+        });
+    }
+    for (const m of content.matchAll(SHORT_RE)) {
+        claims.push({ count: Number(m[1]), names: null });
+    }
+    return claims;
+}
+export function findViolations(chain, claimsByFile) {
+    const violations = [];
+    const expectedCount = chain.invariants.length;
+    const expectedNames = [...chain.invariants, ...chain.trailing];
+    for (const [file, claims] of Object.entries(claimsByFile)) {
+        if (claims.length === 0) {
+            violations.push(`${file}: states no "verify:all" invariant-count claim. Expected "(${expectedCount} invariants + typecheck)" or the long form with the full list.`);
+            continue;
+        }
+        for (const claim of claims) {
+            if (claim.count !== expectedCount) {
+                violations.push(`${file}: claims ${claim.count} invariants but verify:all runs ${expectedCount}.`);
+            }
+            if (claim.names === null)
+                continue;
+            if (claim.names.length !== expectedNames.length) {
+                const missing = expectedNames.filter((n) => !claim.names.includes(n));
+                const extra = claim.names.filter((n) => !expectedNames.includes(n));
+                violations.push(`${file}: the listed steps do not match verify:all.` +
+                    (missing.length ? ` Missing: ${missing.join(", ")}.` : "") +
+                    (extra.length ? ` Not in the chain: ${extra.join(", ")}.` : ""));
+            }
+            else if (claim.names.some((n, i) => n !== expectedNames[i])) {
+                violations.push(`${file}: the listed steps are out of order. Expected the chain order: ${expectedNames.join(", ")}.`);
+            }
+        }
+    }
+    return violations;
+}
+export function checkInvariantCount(repoRoot) {
+    const pkgRaw = readFileSync(join(repoRoot, "package.json"), "utf8");
+    const pkg = JSON.parse(pkgRaw);
+    const chainScript = pkg.scripts?.["verify:all"];
+    if (typeof chainScript !== "string" || chainScript.length === 0) {
+        return {
+            chain: { invariants: [], trailing: [] },
+            violations: [`package.json has no "verify:all" script, so no claim can be checked.`],
+        };
+    }
+    const chain = parseVerifyAllChain(chainScript);
+    const claimsByFile = {};
+    for (const rel of CLAIM_FILES) {
+        let content;
+        try {
+            content = readFileSync(join(repoRoot, rel), "utf8");
+        }
+        catch {
+            claimsByFile[rel] = [];
+            continue;
+        }
+        claimsByFile[rel] = parseClaims(content);
+    }
+    return { chain, violations: findViolations(chain, claimsByFile) };
+}
+function main() {
+    const repoRoot = argv[2] ?? cwd();
+    const { chain, violations } = checkInvariantCount(repoRoot);
+    if (violations.length === 0) {
+        console.log(`OK invariant-count: all ${CLAIM_FILES.length} doc surface(s) state ${chain.invariants.length} invariants + ${chain.trailing.join(", ")}, matching the verify:all chain.`);
+        exit(0);
+    }
+    console.error(`FAIL invariant-count: ${violations.length} stale claim(s) about verify:all.\n`);
+    for (const v of violations)
+        console.error(`  ${v}`);
+    console.error(`\nFix: verify:all currently runs ${chain.invariants.length} invariants — ` +
+        `${[...chain.invariants, ...chain.trailing].join(", ")}. ` +
+        `Update the claim in each file above to match. The chain in package.json is the source of truth.`);
+    exit(1);
+}
+const invokedDirectly = argv[1] !== undefined && import.meta.url.endsWith(argv[1].replace(/\\/g, "/"));
+if (invokedDirectly || argv[1]?.endsWith("check-invariant-count.mjs")) {
+    main();
+}

package/bin/check-routing-targets.mjs

@@ -8,6 +8,13 @@
  *   (a) ships bundled at plugins/continuous-improvement/skills/<name>/SKILL.md, or
  *   (b) is declared in the root-level optional-companions.json file.
  *
+ * And, for the prefixes we vendor (oh-my-claudecode, superpowers, agent-skills,
+ * ruflo-swarm), that every declared target actually EXISTS in its snapshot under
+ * third-party/<snapshot>/skills/<name>/. Declaring a target only asserted intent;
+ * nothing checked the destination. oh-my-claudecode:ultrawork was declared after
+ * upstream deleted it, and oh-my-claudecode:retrospective was declared for months
+ * having never existed upstream at all — both with this check green.
+ *
  * Catches: a routing-table row that names a skill the bundle does not ship and
  * the maintainer has not declared as an optional companion. Without this gate,
  * such drift only surfaces at runtime when the orchestrator routes to a target
@@ -20,15 +27,60 @@
  *
  * Exit codes:
  *   0 — every routing target is accounted for (bundled or optional-declared)
- *   1 — at least one routing target is unaccounted for
+ *   1 — at least one routing target is unaccounted for, or a declared vendored
+ *       target has no directory in its snapshot
  */
-import { readdirSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { argv, cwd, exit } from "node:process";
 const ORCHESTRATOR_SKILL_PATH = "skills/proceed-with-the-recommendation.md";
 const OPTIONAL_COMPANIONS_PATH = "optional-companions.json";
 const PLUGIN_SKILLS_DIR = "plugins/continuous-improvement/skills";
 const SECTION_HEADER = "### Routing Table (with Inline Fallbacks)";
+/**
+ * Routing-target prefix -> vendored snapshot directory under third-party/.
+ *
+ * Declaring a target in optional-companions.json only asserted that we MEANT to
+ * route somewhere; nothing checked the destination existed. So when
+ * oh-my-claudecode 5.x deleted `ultrawork`, this check stayed green while the
+ * routing table named a skill upstream no longer ships (#308, fixed in #309) —
+ * and `oh-my-claudecode:retrospective` had been declared for months without ever
+ * existing upstream at all. For prefixes we vendor, the snapshot is ground truth.
+ *
+ * Prefixes NOT listed here (host built-ins, `frontend-design:`, `commit-commands:`)
+ * are deliberately unchecked: we have no local copy to check them against, and
+ * guessing would make this fail closed on things it cannot see.
+ */
+export const VENDORED_PREFIXES = {
+    "oh-my-claudecode": "oh-my-claudecode",
+    superpowers: "superpowers",
+    "agent-skills": "addy-agent-skills",
+    "ruflo-swarm": "ruflo-swarm",
+};
+/** Repo-relative skill path a vendored target must resolve to, or null if unvendored. */
+export function resolveVendoredSkillPath(target) {
+    const idx = target.indexOf(":");
+    if (idx < 0)
+        return null;
+    const dir = VENDORED_PREFIXES[target.slice(0, idx)];
+    if (!dir)
+        return null;
+    // Everything after the FIRST colon is the skill name, colons included.
+    return `third-party/${dir}/skills/${target.slice(idx + 1)}`;
+}
+/** Vendored targets with no directory in their snapshot. */
+export function findMissingVendoredTargets(repoRoot, targets) {
+    const missing = [];
+    for (const target of targets) {
+        const rel = resolveVendoredSkillPath(target);
+        if (rel === null)
+            continue;
+        const abs = join(repoRoot, rel);
+        if (!existsSync(abs))
+            missing.push({ target, expectedPath: abs });
+    }
+    return missing;
+}
 export function discoverBundledSkills(repoRoot) {
     const dir = join(repoRoot, PLUGIN_SKILLS_DIR);
     let entries;
@@ -119,19 +171,37 @@ export function checkRoutingTargets(repoRoot) {
             continue;
         drifts.push(t);
     }
+    // Declared is not the same as existing: for prefixes we vendor, the snapshot
+    // is ground truth. Checks the declared companion set, so a target that is
+    // declared but never referenced is still caught.
+    const missingVendored = findMissingVendoredTargets(repoRoot, optional);
     return {
         targets,
         drifts,
         bundledCount: bundled.size,
         optionalCount: optional.size,
+        missingVendored,
     };
 }
 function main() {
     const repoRoot = argv[2] ?? cwd();
-    const { targets, drifts, bundledCount, optionalCount } = checkRoutingTargets(repoRoot);
+    const { targets, drifts, bundledCount, optionalCount, missingVendored } = checkRoutingTargets(repoRoot);
+    if (missingVendored.length > 0) {
+        console.error(`FAIL routing-targets: ${missingVendored.length} declared target(s) do not exist in the vendored snapshot.\n`);
+        for (const m of missingVendored) {
+            console.error(`  - "${m.target}"`);
+            console.error(`      Declared in ${OPTIONAL_COMPANIONS_PATH}, but no directory at:`);
+            console.error(`      ${m.expectedPath}`);
+        }
+        console.error(`\nEither upstream removed or renamed the skill (retarget the routing rows and this ` +
+            `declaration), or the snapshot is stale (refresh it with ` +
+            `'node bin/refresh-third-party.mjs <name>'). Declaring a target does not make it exist.`);
+        exit(1);
+    }
     if (drifts.length === 0) {
         console.log(`OK routing-targets: all ${targets.length} routing target(s) accounted for ` +
-            `(${bundledCount} bundled skill(s), ${optionalCount} optional companion(s) declared).`);
+            `(${bundledCount} bundled skill(s), ${optionalCount} optional companion(s) declared, ` +
+            `every vendored target present in its snapshot).`);
         exit(0);
     }
     console.error(`FAIL routing-targets: ${drifts.length} unaccounted target(s) in ${ORCHESTRATOR_SKILL_PATH}.\n`);

package/bin/check-test-count.mjs

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+/**
+ * Test Count Check
+ *
+ * The landing page states the size of the test suite in two places: the spec
+ * strip ("1,271 / Tests in the suite") and the verification-loop panel
+ * ("tests      PASS  1271/1271"). Both are hand-maintained and both drifted
+ * twice in a single day on 2026-09-06 — 1,137 to 1,249 to 1,271 — because every
+ * PR that adds a test moves the real number and nothing guarded the claim. The
+ * skill and command counts are guarded (check-skill-count, check-command-count);
+ * this closes the same hole for tests.
+ *
+ * Unlike skills and commands, the real number cannot be derived from the
+ * filesystem: 45 test files generate cases in loops, so counting `it(` / `test(`
+ * declarations reports 1,066 against an actual 1,271. Node's runner has no
+ * collect-without-running mode either — filtering by name pattern reports the
+ * file count, not the test count. The only honest source is an actual run.
+ *
+ * So the check runs in two layers, and the docs are the source of truth:
+ *
+ *   1. Locally, inside `verify:all`, it asserts that every surface states the
+ *      SAME number. Fast, no suite run, and it catches the two-surfaces-disagree
+ *      case that a single-number edit produces.
+ *   2. In CI, after `npm test` has already run, `--actual-from <file>` parses
+ *      the runner's "tests N" summary out of the captured output and asserts the
+ *      claimed number equals reality. No second suite run.
+ *
+ * A claim that drifts from reality fails CI; two claims that drift apart fail
+ * locally. Fail-closed: a missing surface is a violation, not a silent pass.
+ *
+ * Usage:
+ *   node bin/check-test-count.mjs                        # Claims agree with each other
+ *   node bin/check-test-count.mjs --actual-from out.txt  # ...and with an actual run
+ *   node bin/check-test-count.mjs <repo-root> [--actual-from out.txt]
+ *
+ * Exit codes:
+ *   0 — every stated test count agrees (and matches the run, when supplied)
+ *   1 — a surface is missing, surfaces disagree, or a claim is stale
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { argv, cwd, exit } from "node:process";
+const LANDING = join("docs", "landing", "index.html");
+/** The spec strip cell: <span class="v">1,271</span><span class="k">Tests in the suite</span> */
+const STRIP_RE = /<span\b[^>]*class=["'][^"']*\bv\b[^"']*["'][^>]*>\s*([\d,]+)\s*<\/span>\s*<span\b[^>]*class=["'][^"']*\bk\b[^"']*["'][^>]*>\s*Tests in the suite\s*<\/span>/gi;
+/** The verification-loop panel line: tests      PASS  1271/1271 */
+const LADDER_RE = /^tests\s+PASS\s+([\d,]+)\/([\d,]+)\s*$/gim;
+/** The node test runner summary: "ℹ tests 1271" */
+const ACTUAL_RE = /^\W*tests\s+(\d+)\s*$/im;
+const toNumber = (raw) => Number(raw.replace(/,/g, ""));
+export function extractClaims(html) {
+    const strip = [...html.matchAll(STRIP_RE)].map((m) => toNumber(m[1]));
+    const ladder = [...html.matchAll(LADDER_RE)].flatMap((m) => [toNumber(m[1]), toNumber(m[2])]);
+    return { strip, ladder };
+}
+export function parseActualCount(runOutput) {
+    const m = ACTUAL_RE.exec(runOutput);
+    return m ? Number(m[1]) : null;
+}
+export function findViolations(claims, actual) {
+    const violations = [];
+    if (claims.strip.length === 0) {
+        violations.push(`the spec strip states no test count (expected a <span class="v">N</span> cell labelled "Tests in the suite").`);
+    }
+    if (claims.ladder.length === 0) {
+        violations.push(`the verification-loop ladder states no test count (expected a "tests      PASS  N/N" line).`);
+    }
+    if (violations.length > 0)
+        return violations;
+    const stated = [...claims.strip, ...claims.ladder];
+    const distinct = [...new Set(stated)].sort((a, b) => a - b);
+    if (distinct.length > 1) {
+        // Surfaces disagree with each other. Comparing a contested number to the run
+        // would emit a second, derivative violation; fix the disagreement first.
+        return [`the stated test counts disagree with each other: ${distinct.join(" vs ")}.`];
+    }
+    const claimed = distinct[0];
+    if (actual !== null && actual !== claimed) {
+        violations.push(`every surface states ${claimed} tests but the suite actually ran ${actual}.`);
+    }
+    return violations;
+}
+function main() {
+    const args = argv.slice(2);
+    const actualIdx = args.indexOf("--actual-from");
+    const actualPath = actualIdx === -1 ? null : args[actualIdx + 1];
+    if (actualIdx !== -1 && !actualPath) {
+        console.error("FAIL test-count: --actual-from needs a path to a captured test run.");
+        exit(1);
+    }
+    const repoRoot = args.find((a) => !a.startsWith("--") && a !== actualPath) ?? cwd();
+    let html;
+    try {
+        html = readFileSync(join(repoRoot, LANDING), "utf8");
+    }
+    catch {
+        console.error(`FAIL test-count: cannot read ${LANDING} at ${repoRoot}.`);
+        exit(1);
+    }
+    let actual = null;
+    if (actualPath) {
+        let runOutput;
+        try {
+            runOutput = readFileSync(actualPath, "utf8");
+        }
+        catch {
+            console.error(`FAIL test-count: cannot read the captured test run at ${actualPath}.`);
+            exit(1);
+        }
+        actual = parseActualCount(runOutput);
+        if (actual === null) {
+            console.error(`FAIL test-count: ${actualPath} has no "tests N" summary line, so the claim cannot be checked against a real run.`);
+            exit(1);
+        }
+    }
+    const claims = extractClaims(html);
+    const violations = findViolations(claims, actual);
+    if (violations.length === 0) {
+        const claimed = [...claims.strip, ...claims.ladder][0];
+        const against = actual === null ? "each other" : `each other and the actual run`;
+        console.log(`OK test-count: all ${claims.strip.length + claims.ladder.length} claim(s) state ${claimed} tests, matching ${against}.`);
+        exit(0);
+    }
+    console.error(`FAIL test-count: ${violations.length} issue(s) with the stated test count.`);
+    console.error("");
+    for (const v of violations)
+        console.error(`  ${v}`);
+    console.error("");
+    console.error(`Fix: run the suite, take the "tests N" total, and update both surfaces in ${LANDING} (the spec strip and the verification-loop panel).`);
+    exit(1);
+}
+const invokedDirectly = argv[1] !== undefined && import.meta.url.endsWith(argv[1].replace(/\\/g, "/"));
+if (invokedDirectly || argv[1]?.endsWith("check-test-count.mjs")) {
+    main();
+}

package/bin/refresh-third-party.mjs

@@ -22,7 +22,10 @@
  *       wipe the local path, recreate it, copy the selective surface
  *       verbatim, strip every CLAUDE.md inside the snapshot, print a diff
  *       stat. Aborts if the local snapshot path has uncommitted changes
- *       unless --force is passed.
+ *       unless --force is passed, and aborts BEFORE the wipe if upstream
+ *       removed a skill this repo still routes to, unless --allow-stale-refs
+ *       is passed. The two flags are separate on purpose: a dirty-tree
+ *       refresh must not silently disable the stale-reference gate.
  *
  *   node bin/refresh-third-party.mjs --all
  *   node bin/refresh-third-party.mjs --all --check
@@ -38,8 +41,9 @@
  */
 import { spawnSync } from "node:child_process";
 import { cp, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { readdirSync, readFileSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, relative, resolve } from "node:path";
 import { argv, exit, stderr, stdout } from "node:process";
 import { fileURLToPath } from "node:url";
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
@@ -56,6 +60,7 @@ const SNAPSHOTS = [
         manifestHeading: "oh-my-claudecode",
         upstream: "https://github.com/Yeachan-Heo/oh-my-claudecode.git",
         localPath: "third-party/oh-my-claudecode",
+        routingPrefix: "oh-my-claudecode",
         selectiveDirs: [
             "agents",
             "skills",
@@ -94,6 +99,7 @@ const SNAPSHOTS = [
         manifestHeading: "obra/superpowers",
         upstream: "https://github.com/obra/superpowers.git",
         localPath: "third-party/superpowers",
+        routingPrefix: "superpowers",
         selectiveDirs: ["skills", "hooks", "docs", "assets", ".claude-plugin"],
         selectiveFiles: [
             "LICENSE",
@@ -116,7 +122,7 @@ function usage() {
         "Usage:",
         "  node bin/refresh-third-party.mjs --list",
         "  node bin/refresh-third-party.mjs <name> --check",
-        "  node bin/refresh-third-party.mjs <name> [--force]",
+        "  node bin/refresh-third-party.mjs <name> [--force] [--allow-stale-refs]",
         "  node bin/refresh-third-party.mjs --all [--check] [--force]",
         "  node bin/refresh-third-party.mjs --help",
         "",
@@ -198,6 +204,7 @@ function localPathDirty(relPath) {
 }
 async function deleteClaudeMdRecursive(root) {
     // Node-only equivalent of `find <root> -name CLAUDE.md -type f -delete`.
+    // (helpers for our own in-snapshot annotations are defined below)
     const { readdir } = await import("node:fs/promises");
     const stack = [root];
     let deleted = 0;
@@ -239,7 +246,130 @@ async function checkOne(snapshot) {
         await rm(dir, { recursive: true, force: true });
     }
 }
-async function refreshOne(snapshot, { force }) {
+/**
+ * Flat-source files and directories that can name a companion skill. Deliberately
+ * excludes `third-party/` — scanning the snapshot being replaced would match the
+ * very copy we are about to overwrite and report every removal as still-referenced.
+ * The `plugins/` tree is excluded too: it is a build mirror of these files.
+ */
+export const REFERENCE_SOURCES = [
+    "optional-companions.json",
+    "skills",
+    "commands",
+    "scripts",
+    join("src", "hooks"),
+];
+/** Skill directory names inside a snapshot, sorted. Empty if there is no skills/ dir. */
+export function listSkillDirs(snapshotRoot) {
+    try {
+        return readdirSync(join(snapshotRoot, "skills"), { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name)
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/** Skills the old snapshot had that the incoming one does not. */
+export function findRemovedSkills(oldSkills, newSkills) {
+    const incoming = new Set(newSkills);
+    return oldSkills.filter((s) => !incoming.has(s));
+}
+function walkFiles(abs, out) {
+    let entries;
+    try {
+        entries = readdirSync(abs, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        const full = join(abs, e.name);
+        if (e.isDirectory())
+            walkFiles(full, out);
+        else
+            out.push(full);
+    }
+}
+/**
+ * Removed skills that our own source still routes to, with the files naming them.
+ *
+ * This is the check that turns a refresh into a loud failure instead of a silent
+ * one: when OMC 5.x deleted `ultrawork`, the snapshot became honest while our
+ * routing table kept pointing at it, and every gate stayed green. Matching is on
+ * the prefixed `<plugin>:<skill>` form with a boundary, so a bare English word
+ * ("release", "review") in prose is not a false positive and `omc:ultrawork-plus`
+ * does not match `omc:ultrawork`.
+ */
+export function findStaleReferences(repoRoot, routingPrefix, removedSkills) {
+    if (removedSkills.length === 0)
+        return [];
+    const files = [];
+    for (const rel of REFERENCE_SOURCES) {
+        const abs = join(repoRoot, rel);
+        let isDir = false;
+        try {
+            isDir = statSync(abs).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (isDir)
+            walkFiles(abs, files);
+        else
+            files.push(abs);
+    }
+    const stale = [];
+    for (const skill of removedSkills) {
+        const re = new RegExp(`${escapeRegExp(routingPrefix)}:${escapeRegExp(skill)}(?![A-Za-z0-9_-])`);
+        const hits = [];
+        for (const file of files) {
+            let text;
+            try {
+                text = readFileSync(file, "utf8");
+            }
+            catch {
+                continue;
+            }
+            if (re.test(text))
+                hits.push(relative(repoRoot, file));
+        }
+        if (hits.length > 0)
+            stale.push({ skill, files: hits.sort() });
+    }
+    return stale;
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Files inside a snapshot directory that we author, not upstream. The refresh
+ * wipes the directory wholesale, so these have to be carried across it by hand.
+ * `OUR_NOTES.md` is the drift radar the vendoring contract requires;
+ * `.fork-only-skills.txt` is the allowlist the Skills Drift Check subtracts.
+ */
+export const OUR_FILES = ["OUR_NOTES.md", ".fork-only-skills.txt"];
+/** Read whichever of OUR_FILES exist under `localAbs`. Absent files are skipped. */
+export async function readOurFiles(localAbs) {
+    const saved = new Map();
+    for (const name of OUR_FILES) {
+        try {
+            saved.set(name, await readFile(join(localAbs, name)));
+        }
+        catch {
+            // Not every snapshot carries every one of these; absence is normal.
+        }
+    }
+    return saved;
+}
+/** Write the captured files back under `localAbs`. Returns how many were restored. */
+export async function restoreOurFiles(localAbs, saved) {
+    for (const [name, body] of saved)
+        await writeFile(join(localAbs, name), body);
+    return saved.size;
+}
+async function refreshOne(snapshot, { force, allowStaleRefs }) {
     const pinned = await readPinnedSha(snapshot);
     const localAbs = join(REPO_ROOT, snapshot.localPath);
     if (!force && (await pathExists(localAbs))) {
@@ -254,6 +384,31 @@ async function refreshOne(snapshot, { force }) {
             throw new Error(`[${snapshot.name}] upstream HEAD ${headSha} != pinned ${pinned}; ` +
                 `bump the pinned SHA in third-party/MANIFEST.md first`);
         }
+        // Refuse to land a snapshot that would make our own routing table lie.
+        // When OMC 5.x deleted `ultrawork`, refreshing made the snapshot honest while
+        // optional-companions.json, two skills/superpowers.md tables and the
+        // companion-preference OVERRIDES map kept naming it — and every gate stayed
+        // green, because nothing compared the two. Checked BEFORE the wipe, so a
+        // failure leaves the snapshot untouched and the operator retargets first.
+        const removedSkills = findRemovedSkills(listSkillDirs(localAbs), listSkillDirs(dir));
+        const staleRefs = findStaleReferences(REPO_ROOT, snapshot.routingPrefix, removedSkills);
+        if (staleRefs.length > 0) {
+            const detail = staleRefs
+                .map((r) => `    ${snapshot.routingPrefix}:${r.skill}\n      ${r.files.join("\n      ")}`)
+                .join("\n");
+            const message = `[${snapshot.name}] upstream removed ${staleRefs.length} skill(s) this repo still routes to:\n${detail}\n` +
+                `  Retarget or drop these references first, then re-run the refresh. ` +
+                `Pass --allow-stale-refs to land the snapshot anyway and fix them afterwards.`;
+            if (!allowStaleRefs)
+                throw new Error(message);
+            err(`  WARNING: ${message}`);
+        }
+        // Our own annotations live inside the snapshot directory, so the wipe below
+        // destroys them along with the upstream copy. That silently deleted
+        // OUR_NOTES.md on both the superpowers (#304) and oh-my-claudecode (#308)
+        // refreshes — the drift radar, removed by the tool whose drift it records.
+        // Capture before the wipe, put back after the copy.
+        const ourFiles = await readOurFiles(localAbs);
         // Wipe + recreate destination.
         await rm(localAbs, { recursive: true, force: true });
         await mkdir(localAbs, { recursive: true });
@@ -279,6 +434,10 @@ async function refreshOne(snapshot, { force }) {
         }
         // Strip every CLAUDE.md (auto-loads as session context).
         const stripped = await deleteClaudeMdRecursive(localAbs);
+        // Put our annotations back. After the CLAUDE.md strip, so a snapshot that
+        // ever carries an OUR_* named CLAUDE.md is not re-deleted; before the diff
+        // stat, so the printed diff reflects what actually landed on disk.
+        const preserved = await restoreOurFiles(localAbs, ourFiles);
         // Defense in depth: forcibly delete excludePostCopy paths from the
         // local snapshot, regardless of whether they were copied. Guards
         // against silent regressions if selectiveDirs is later edited to
@@ -322,7 +481,7 @@ async function refreshOne(snapshot, { force }) {
         log(`  upstream     : ${snapshot.upstream}`);
         log(`  pinned SHA   : ${pinned}`);
         log(`  upstream HEAD: ${headSha}`);
-        log(`  status       : updated (${copiedDirs} dirs, ${copiedFiles} files, ${stripped} CLAUDE.md stripped, ${excluded} excluded paths removed, ${patchedKeys} json keys patched)`);
+        log(`  status       : updated (${copiedDirs} dirs, ${copiedFiles} files, ${stripped} CLAUDE.md stripped, ${preserved} of ours preserved, ${excluded} excluded paths removed, ${patchedKeys} json keys patched)`);
         if (String(diffStat.stdout).trim()) {
             log("  diff --stat  :");
             for (const line of String(diffStat.stdout).trimEnd().split(/\r?\n/)) {
@@ -368,6 +527,10 @@ async function main() {
         exit(0);
     }
     const force = args.includes("--force");
+    // Deliberately NOT --force: that means "my tree is dirty, proceed", and a
+    // routine dirty-tree refresh must not silently switch off the stale-reference
+    // gate as a side effect.
+    const allowStaleRefs = args.includes("--allow-stale-refs");
     const check = args.includes("--check");
     const all = args.includes("--all");
     const positional = args.filter((a) => !a.startsWith("--"));
@@ -397,7 +560,7 @@ async function main() {
                     allUpToDate = false;
             }
             else {
-                await refreshOne(snap, { force });
+                await refreshOne(snap, { force, allowStaleRefs });
             }
         }
         catch (e) {
@@ -412,7 +575,14 @@ async function main() {
         exit(1);
     exit(0);
 }
-main().catch((e) => {
-    err(`fatal: ${e.stack || e.message}`);
-    exit(1);
-});
+// Only run the CLI when invoked as one. Without this, importing the module to
+// test its helpers would start a refresh. Same shape as the other bin/ scripts:
+// the endsWith fallback covers Windows, where argv[1] is a backslash path and
+// never equals the forward-slash file:// URL.
+const invokedDirectly = argv[1] !== undefined && import.meta.url.endsWith(argv[1].replace(/\\/g, "/"));
+if (invokedDirectly || argv[1]?.endsWith("refresh-third-party.mjs")) {
+    main().catch((e) => {
+        err(`fatal: ${e.stack || e.message}`);
+        exit(1);
+    });
+}

package/commands/superpowers.md

@@ -17,7 +17,7 @@ The 7 Laws define *what* discipline must be applied. `/superpowers` decides *whi
 | `obra/superpowers` (Jesse Vincent) | vendored at `third-party/superpowers/`, pinned SHA `f2cbfbe` (v5.1.0) | `superpowers:brainstorming`, `:writing-plans`, `:executing-plans`, `:test-driven-development`, `:systematic-debugging`, `:requesting-code-review`, `:receiving-code-review`, `:verification-before-completion`, `:dispatching-parallel-agents`, `:using-git-worktrees`, `:finishing-a-development-branch`, `:subagent-driven-development`, `:writing-skills`, `:using-superpowers` |
 | `addyosmani/agent-skills` | vendored at `third-party/addy-agent-skills/`, pinned SHA `742dca5` (v1.0.0) | `spec-driven-development`, `source-driven-development`, `context-engineering`, `idea-refine`, `incremental-implementation`, `code-review-and-quality`, `code-simplification`, `security-and-hardening`, `debugging-and-error-recovery`, `performance-optimization`, `api-and-interface-design`, `frontend-ui-engineering`, `browser-testing-with-devtools`, `ci-cd-and-automation`, `deprecation-and-migration`, `documentation-and-adrs`, `git-workflow-and-versioning`, `planning-and-task-breakdown`, `shipping-and-launch` |
 | `ruflo-swarm` (ruvnet) | vendored at `third-party/ruflo-swarm/`, pinned SHA `addb5cd` (v0.2.0) | `swarm-init`, `monitor-stream`; `swarm_*` and `agent_*` MCP tools; `/swarm`, `/watch` |
-| `oh-my-claudecode` (Yeachan-Heo) | vendored at `third-party/oh-my-claudecode/`, pinned SHA `aacde3e` (v4.13.6) | 38 skills + 19 agents — `release`, `ultrawork`, `ultraqa`, `team`, `trace`, `visual-verdict`, `debug`, `deep-dive`, `deep-interview`, `autopilot`, `autoresearch`, plus a separate `ralph` (overlaps with our `/ralph` — see "Distinct variants" below) |
+| `oh-my-claudecode` (Yeachan-Heo) | vendored at `third-party/oh-my-claudecode/`, pinned SHA `4820f56` (v5.3.0) | 37 skills + 19 agents — `release`, `ultragoal`, `launch`, `team`, `trace`, `visual-verdict`, `debug`, `review`, `research`, `deep-interview`, `autopilot`, `autoresearch`, plus a separate `ralph` (overlaps with our `/ralph` — see "Distinct variants" below) |
 
 PM coverage (product-management skills) lives **outside** this marketplace. If you need it, install [`phuryn/pm-skills`](https://github.com/phuryn/pm-skills) separately via Claude Code's host marketplace; the dispatcher names it as a routing target without pre-resolving the namespace. See [docs/THIRD_PARTY.md § Routing in /superpowers](../docs/THIRD_PARTY.md#routing-in-superpowers).
 

package/hooks/companion-preference.mjs

@@ -48,11 +48,7 @@ const OVERRIDES = {
         plugin: "agent-skills",
     },
     ralph: {
-        companion: "oh-my-claudecode:ultrawork",
-        plugin: "oh-my-claudecode",
-    },
-    "learn-eval": {
-        companion: "oh-my-claudecode:retrospective",
+        companion: "oh-my-claudecode:ultragoal",
         plugin: "oh-my-claudecode",
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.24.0",
+  "version": "3.25.0",
   "description": "Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
   "keywords": [
     "claude-code",
@@ -52,6 +52,8 @@
     "verify:skill-count": "node bin/check-skill-count.mjs",
     "verify:skill-count-prose": "node bin/check-skill-count-prose.mjs",
     "verify:command-count": "node bin/check-command-count.mjs",
+    "verify:test-count": "node bin/check-test-count.mjs",
+    "verify:invariant-count": "node bin/check-invariant-count.mjs",
     "verify:docs-substrings": "node bin/check-docs-substrings.mjs",
     "verify:everything-mirror": "node bin/check-everything-mirror.mjs",
     "verify:routing-targets": "node bin/check-routing-targets.mjs",
@@ -62,7 +64,7 @@
     "verify:third-party-shape": "node bin/check-third-party-shape.mjs",
     "verify:tool-count": "node bin/check-tool-count.mjs",
     "verify:reconcile-parity": "node bin/check-reconcile-parity.mjs",
-    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:landing-version && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run verify:reconcile-parity && npm run typecheck"
+    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:test-count && npm run verify:invariant-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:landing-version && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run verify:reconcile-parity && npm run typecheck"
   },
   "files": [
     ".claude-plugin/",

package/plugins/beginner.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.24.0",
+  "version": "3.25.0",
   "mode": "beginner",
   "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles the ship fast path plus grounding skills (gateguard, tdd-workflow, verification-loop) so one-defect delivery, research, tests, and verification happen by default — every edit starts from facts, not guesses.",
   "tools": [

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.24.0",
+      "version": "3.25.0",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.24.0",
+  "version": "3.25.0",
   "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",

package/plugins/continuous-improvement/commands/superpowers.md

@@ -17,7 +17,7 @@ The 7 Laws define *what* discipline must be applied. `/superpowers` decides *whi
 | `obra/superpowers` (Jesse Vincent) | vendored at `third-party/superpowers/`, pinned SHA `f2cbfbe` (v5.1.0) | `superpowers:brainstorming`, `:writing-plans`, `:executing-plans`, `:test-driven-development`, `:systematic-debugging`, `:requesting-code-review`, `:receiving-code-review`, `:verification-before-completion`, `:dispatching-parallel-agents`, `:using-git-worktrees`, `:finishing-a-development-branch`, `:subagent-driven-development`, `:writing-skills`, `:using-superpowers` |
 | `addyosmani/agent-skills` | vendored at `third-party/addy-agent-skills/`, pinned SHA `742dca5` (v1.0.0) | `spec-driven-development`, `source-driven-development`, `context-engineering`, `idea-refine`, `incremental-implementation`, `code-review-and-quality`, `code-simplification`, `security-and-hardening`, `debugging-and-error-recovery`, `performance-optimization`, `api-and-interface-design`, `frontend-ui-engineering`, `browser-testing-with-devtools`, `ci-cd-and-automation`, `deprecation-and-migration`, `documentation-and-adrs`, `git-workflow-and-versioning`, `planning-and-task-breakdown`, `shipping-and-launch` |
 | `ruflo-swarm` (ruvnet) | vendored at `third-party/ruflo-swarm/`, pinned SHA `addb5cd` (v0.2.0) | `swarm-init`, `monitor-stream`; `swarm_*` and `agent_*` MCP tools; `/swarm`, `/watch` |
-| `oh-my-claudecode` (Yeachan-Heo) | vendored at `third-party/oh-my-claudecode/`, pinned SHA `aacde3e` (v4.13.6) | 38 skills + 19 agents — `release`, `ultrawork`, `ultraqa`, `team`, `trace`, `visual-verdict`, `debug`, `deep-dive`, `deep-interview`, `autopilot`, `autoresearch`, plus a separate `ralph` (overlaps with our `/ralph` — see "Distinct variants" below) |
+| `oh-my-claudecode` (Yeachan-Heo) | vendored at `third-party/oh-my-claudecode/`, pinned SHA `4820f56` (v5.3.0) | 37 skills + 19 agents — `release`, `ultragoal`, `launch`, `team`, `trace`, `visual-verdict`, `debug`, `review`, `research`, `deep-interview`, `autopilot`, `autoresearch`, plus a separate `ralph` (overlaps with our `/ralph` — see "Distinct variants" below) |
 
 PM coverage (product-management skills) lives **outside** this marketplace. If you need it, install [`phuryn/pm-skills`](https://github.com/phuryn/pm-skills) separately via Claude Code's host marketplace; the dispatcher names it as a routing target without pre-resolving the namespace. See [docs/THIRD_PARTY.md § Routing in /superpowers](../docs/THIRD_PARTY.md#routing-in-superpowers).
 

package/plugins/continuous-improvement/hooks/companion-preference.mjs

@@ -48,11 +48,7 @@ const OVERRIDES = {
         plugin: "agent-skills",
     },
     ralph: {
-        companion: "oh-my-claudecode:ultrawork",
-        plugin: "oh-my-claudecode",
-    },
-    "learn-eval": {
-        companion: "oh-my-claudecode:retrospective",
+        companion: "oh-my-claudecode:ultragoal",
         plugin: "oh-my-claudecode",
     },
 };

package/plugins/continuous-improvement/scripts/route-recommendation.routes.json

@@ -191,14 +191,14 @@
     {
       "name": "Multi-session retrospective across a sprint",
       "patterns": ["retrospective", "sprint review", "multi.session review", "what worked.*what failed"],
-      "preferred": ["oh-my-claudecode:retrospective", "learn-eval"],
+      "preferred": ["learn-eval"],
       "fallback": "What worked / what failed / what to do differently / 3 ranked next moves.",
       "marker": "oh-my-claudecode"
     },
     {
       "name": "Long autonomous run with quality gates",
       "patterns": ["long autonomous", "ultrawork", "quality gates? (between|per) iteration"],
-      "preferred": ["oh-my-claudecode:ultrawork", "ralph"],
+      "preferred": ["oh-my-claudecode:ultragoal", "ralph"],
       "fallback": "PRD-shaped autonomous loop with verify-between-iterations.",
       "marker": "oh-my-claudecode"
     },

package/plugins/continuous-improvement/skills/proceed-with-the-recommendation/SKILL.md

@@ -235,8 +235,8 @@ Rows whose **Preferred skill** is not bundled with the `continuous-improvement`
 | Fan out N agents on isolated worktrees with shared contract | `superpowers:dispatching-parallel-agents` → `ruflo-swarm:swarm-init` | Use the swarm contract: fixed roles + base ref + shared contract test; reconcile results after. (Reference behavior — does not require `ruflo-swarm`.) |
 | Stream live observation of long agent runs | `ruflo-swarm:monitor-stream` | Push-based event log; poll fallback if the MCP server is offline. (Reference behavior — does not require `ruflo-swarm`.) |
 | Visual regression / browser-level diff | `oh-my-claudecode:visual-verdict` | Playwright screenshot diff against staging baseline. (Reference behavior — does not require `oh-my-claudecode`.) |
-| Multi-session retrospective across a sprint | `oh-my-claudecode:retrospective` → `learn-eval` | What worked / what failed / what to do differently / 3 ranked next moves. (Reference behavior — does not require `oh-my-claudecode`.) |
-| Long autonomous run with quality gates | `oh-my-claudecode:ultrawork` → `ralph` | PRD-shaped autonomous loop with verify-between-iterations. (Reference behavior — does not require `oh-my-claudecode`.) |
+| Multi-session retrospective across a sprint | `learn-eval` | What worked / what failed / what to do differently / 3 ranked next moves. (Reference behavior — does not require `oh-my-claudecode`.) |
+| Long autonomous run with quality gates | `oh-my-claudecode:ultragoal` → `ralph` | PRD-shaped autonomous loop with verify-between-iterations. (Reference behavior — does not require `oh-my-claudecode`.) |
 | Product-management work (PRD, user stories, acceptance criteria, OKRs, experiments, personas, JTBD, lean canvas, market sizing, competitive analysis, meetings family, launch checklist) | Install phuryn/pm-skills via Claude Code marketplace — see docs/THIRD_PARTY.md | Out-of-band install (`claude plugin marketplace add phuryn/pm-skills` + the eight `pm-*@pm-skills` plugins). Inline fallback: keep the work shape (problem → user → goal → metric → scope; Given/When/Then per story; objective + 3-5 measurable KRs; we-believe / we'll-know hypothesis; TAM/SAM/SOM bottom-up; cross-cutting meetings agenda/brief/recap/synthesize) without depending on a specific routing target. |
 
 ## Phase 4: Verify (Law 4 — Verify Before Reporting)

package/plugins/continuous-improvement/skills/superpowers/SKILL.md

@@ -46,7 +46,7 @@ See `docs/THIRD_PARTY.md` for plugin-by-plugin scope.
 
 | Order | Skill | When It Activates |
 |-------|-------|-------------------|
-| 1 | **brainstorming** | Before writing code. Refines rough ideas through questions, explores alternatives, presents design in sections for validation. |
+| 1 | **brainstorming** | Before writing code. Classifies the request as spike, bounded or architectural, then scales the ceremony to it: a 2-3 sentence probe, a short design in chat, or questions plus alternatives plus a sectioned design and a written spec. Approval is required before implementation on all three paths. |
 | 2 | **using-git-worktrees** | After design approval. Creates isolated workspace on new branch, runs project setup, verifies clean test baseline. |
 | 3 | **writing-plans** | With approved design. Breaks work into bite-sized tasks (2-5 minutes each). Every task has exact file paths, complete code, verification steps. |
 | 4 | **subagent-driven-development** or **executing-plans** | With plan. Dispatches fresh subagent per task with two-stage review (spec compliance, then code quality), or executes in batches with human checkpoints. |
@@ -87,8 +87,8 @@ When a task trigger fires, the dispatcher resolves to the first available skill
 | Simplify code, remove duplication | 6 | `agent-skills:code-simplification` → `simplify` |
 | Security review for auth/input/secrets | 4 | `agent-skills:security-and-hardening` → `security-review` |
 | Browser-level visual regression | 4 | `oh-my-claudecode:visual-verdict` (only source) |
-| Reflect after session, extract patterns | 5+7 | `ci:learn-eval` → `oh-my-claudecode:retrospective` |
-| Long autonomous run with quality gates | 6 | `oh-my-claudecode:ultrawork` → `ci:ralph` |
+| Reflect after session, extract patterns | 5+7 | `ci:learn-eval` |
+| Long autonomous run with quality gates | 6 | `oh-my-claudecode:ultragoal` → `ci:ralph` |
 | Coordinator role for staged hand-off | 3 | `ruflo-swarm:agents/coordinator` (when ruflo installed) |
 | Product-management work (PRD, OKRs, personas, GTM, growth, market research, analytics) | 1+2+5 | Install `phuryn/pm-skills` via Claude Code marketplace — see docs/THIRD_PARTY.md. Eight installable plugins (`pm-toolkit`, `pm-product-strategy`, `pm-product-discovery`, `pm-market-research`, `pm-data-analytics`, `pm-marketing-growth`, `pm-go-to-market`, `pm-execution`) cover the full lifecycle. Out of band — not a `/plugin install <name>@continuous-improvement` target. |
 
@@ -122,15 +122,14 @@ Valid values:
 
 ### Which rows the override affects
 
-These are the routing rows where the override changes the resolved target. Rows not listed here are CI-only or companion-only and route the same under any setting.
+These are the routing rows where the override changes the resolved target. Rows not listed here are CI-only or companion-only and route the same under any setting. `ci:learn-eval` was listed here until OMC 5.x: its companion `oh-my-claudecode:retrospective` never existed upstream, so the row is CI-only and the override cannot change it.
 
 | Trigger | `ci-first` (default) | `companions-first` |
 |---|---|---|
 | Write a failing test before code | `ci:tdd-workflow` | `superpowers:test-driven-development`, then `agent-skills:test-driven-development` |
 | Verify before declaring done | `ci:verification-loop` | `superpowers:verification-before-completion` |
 | Curate the right context window | `ci:context-budget` | `agent-skills:context-engineering` |
-| Long autonomous run with quality gates | `ci:ralph` | `oh-my-claudecode:ultrawork`, then `ci:ralph` |
-| Reflect after session, extract patterns | `ci:learn-eval` | `oh-my-claudecode:retrospective` |
+| Long autonomous run with quality gates | `ci:ralph` | `oh-my-claudecode:ultragoal`, then `ci:ralph` |
 
 `superpowers:writing-plans` already wins the planning chain under both settings — it is the first entry, with `ci:planning-with-files` as the third fallback — so that row is unchanged.
 

package/plugins/expert.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.24.0",
+  "version": "3.25.0",
   "mode": "expert",
   "description": "Expert mode: tune confidence, manage instincts, and persist plans on disk. Adds safety, token-budget, and strategic-compact skills plus the /learn-eval command so long sessions stay sharp and learnings survive context resets.",
   "tools": [

package/scripts/route-recommendation.routes.json

@@ -191,14 +191,14 @@
     {
       "name": "Multi-session retrospective across a sprint",
       "patterns": ["retrospective", "sprint review", "multi.session review", "what worked.*what failed"],
-      "preferred": ["oh-my-claudecode:retrospective", "learn-eval"],
+      "preferred": ["learn-eval"],
       "fallback": "What worked / what failed / what to do differently / 3 ranked next moves.",
       "marker": "oh-my-claudecode"
     },
     {
       "name": "Long autonomous run with quality gates",
       "patterns": ["long autonomous", "ultrawork", "quality gates? (between|per) iteration"],
-      "preferred": ["oh-my-claudecode:ultrawork", "ralph"],
+      "preferred": ["oh-my-claudecode:ultragoal", "ralph"],
       "fallback": "PRD-shaped autonomous loop with verify-between-iterations.",
       "marker": "oh-my-claudecode"
     },

package/skills/proceed-with-the-recommendation.md

@@ -235,8 +235,8 @@ Rows whose **Preferred skill** is not bundled with the `continuous-improvement`
 | Fan out N agents on isolated worktrees with shared contract | `superpowers:dispatching-parallel-agents` → `ruflo-swarm:swarm-init` | Use the swarm contract: fixed roles + base ref + shared contract test; reconcile results after. (Reference behavior — does not require `ruflo-swarm`.) |
 | Stream live observation of long agent runs | `ruflo-swarm:monitor-stream` | Push-based event log; poll fallback if the MCP server is offline. (Reference behavior — does not require `ruflo-swarm`.) |
 | Visual regression / browser-level diff | `oh-my-claudecode:visual-verdict` | Playwright screenshot diff against staging baseline. (Reference behavior — does not require `oh-my-claudecode`.) |
-| Multi-session retrospective across a sprint | `oh-my-claudecode:retrospective` → `learn-eval` | What worked / what failed / what to do differently / 3 ranked next moves. (Reference behavior — does not require `oh-my-claudecode`.) |
-| Long autonomous run with quality gates | `oh-my-claudecode:ultrawork` → `ralph` | PRD-shaped autonomous loop with verify-between-iterations. (Reference behavior — does not require `oh-my-claudecode`.) |
+| Multi-session retrospective across a sprint | `learn-eval` | What worked / what failed / what to do differently / 3 ranked next moves. (Reference behavior — does not require `oh-my-claudecode`.) |
+| Long autonomous run with quality gates | `oh-my-claudecode:ultragoal` → `ralph` | PRD-shaped autonomous loop with verify-between-iterations. (Reference behavior — does not require `oh-my-claudecode`.) |
 | Product-management work (PRD, user stories, acceptance criteria, OKRs, experiments, personas, JTBD, lean canvas, market sizing, competitive analysis, meetings family, launch checklist) | Install phuryn/pm-skills via Claude Code marketplace — see docs/THIRD_PARTY.md | Out-of-band install (`claude plugin marketplace add phuryn/pm-skills` + the eight `pm-*@pm-skills` plugins). Inline fallback: keep the work shape (problem → user → goal → metric → scope; Given/When/Then per story; objective + 3-5 measurable KRs; we-believe / we'll-know hypothesis; TAM/SAM/SOM bottom-up; cross-cutting meetings agenda/brief/recap/synthesize) without depending on a specific routing target. |
 
 ## Phase 4: Verify (Law 4 — Verify Before Reporting)

package/skills/superpowers.md

@@ -46,7 +46,7 @@ See `docs/THIRD_PARTY.md` for plugin-by-plugin scope.
 
 | Order | Skill | When It Activates |
 |-------|-------|-------------------|
-| 1 | **brainstorming** | Before writing code. Refines rough ideas through questions, explores alternatives, presents design in sections for validation. |
+| 1 | **brainstorming** | Before writing code. Classifies the request as spike, bounded or architectural, then scales the ceremony to it: a 2-3 sentence probe, a short design in chat, or questions plus alternatives plus a sectioned design and a written spec. Approval is required before implementation on all three paths. |
 | 2 | **using-git-worktrees** | After design approval. Creates isolated workspace on new branch, runs project setup, verifies clean test baseline. |
 | 3 | **writing-plans** | With approved design. Breaks work into bite-sized tasks (2-5 minutes each). Every task has exact file paths, complete code, verification steps. |
 | 4 | **subagent-driven-development** or **executing-plans** | With plan. Dispatches fresh subagent per task with two-stage review (spec compliance, then code quality), or executes in batches with human checkpoints. |
@@ -87,8 +87,8 @@ When a task trigger fires, the dispatcher resolves to the first available skill
 | Simplify code, remove duplication | 6 | `agent-skills:code-simplification` → `simplify` |
 | Security review for auth/input/secrets | 4 | `agent-skills:security-and-hardening` → `security-review` |
 | Browser-level visual regression | 4 | `oh-my-claudecode:visual-verdict` (only source) |
-| Reflect after session, extract patterns | 5+7 | `ci:learn-eval` → `oh-my-claudecode:retrospective` |
-| Long autonomous run with quality gates | 6 | `oh-my-claudecode:ultrawork` → `ci:ralph` |
+| Reflect after session, extract patterns | 5+7 | `ci:learn-eval` |
+| Long autonomous run with quality gates | 6 | `oh-my-claudecode:ultragoal` → `ci:ralph` |
 | Coordinator role for staged hand-off | 3 | `ruflo-swarm:agents/coordinator` (when ruflo installed) |
 | Product-management work (PRD, OKRs, personas, GTM, growth, market research, analytics) | 1+2+5 | Install `phuryn/pm-skills` via Claude Code marketplace — see docs/THIRD_PARTY.md. Eight installable plugins (`pm-toolkit`, `pm-product-strategy`, `pm-product-discovery`, `pm-market-research`, `pm-data-analytics`, `pm-marketing-growth`, `pm-go-to-market`, `pm-execution`) cover the full lifecycle. Out of band — not a `/plugin install <name>@continuous-improvement` target. |
 
@@ -122,15 +122,14 @@ Valid values:
 
 ### Which rows the override affects
 
-These are the routing rows where the override changes the resolved target. Rows not listed here are CI-only or companion-only and route the same under any setting.
+These are the routing rows where the override changes the resolved target. Rows not listed here are CI-only or companion-only and route the same under any setting. `ci:learn-eval` was listed here until OMC 5.x: its companion `oh-my-claudecode:retrospective` never existed upstream, so the row is CI-only and the override cannot change it.
 
 | Trigger | `ci-first` (default) | `companions-first` |
 |---|---|---|
 | Write a failing test before code | `ci:tdd-workflow` | `superpowers:test-driven-development`, then `agent-skills:test-driven-development` |
 | Verify before declaring done | `ci:verification-loop` | `superpowers:verification-before-completion` |
 | Curate the right context window | `ci:context-budget` | `agent-skills:context-engineering` |
-| Long autonomous run with quality gates | `ci:ralph` | `oh-my-claudecode:ultrawork`, then `ci:ralph` |
-| Reflect after session, extract patterns | `ci:learn-eval` | `oh-my-claudecode:retrospective` |
+| Long autonomous run with quality gates | `ci:ralph` | `oh-my-claudecode:ultragoal`, then `ci:ralph` |
 
 `superpowers:writing-plans` already wins the planning chain under both settings — it is the first entry, with `ci:planning-with-files` as the third fallback — so that row is unchanged.