continuous-improvement 3.25.0 → 3.26.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.25.0",
+      "version": "3.26.0",
       "source": "./plugins/continuous-improvement",
       "author": {
         "name": "naimkatiman"

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to this skill are documented here.
 
 ---
 
+## [3.26.0] — 2026-11-14
+
+### Added
+
+- **`CI_ROUTE_PROMPT_DISABLE=1` turns the prompt router off** — `hooks/route-prompt.mjs` had no off switch, so a project with its own plan, test or review skills got a competing `planning-with-files` / `tdd-workflow` hint on every prompt containing those words. Set the variable in that project's `.claude/settings.json` `env` block and the hook emits nothing and writes no telemetry. Default unchanged. (#321)
+
+### Fixed
+
+- **`/ship` no longer falls through to a project's own `ship` skill** — the command forwarded to "the native `ship` skill", and in a repo that defines `.claude/skills/ship` a bare `ship` resolves to that project workflow, which can merge and deploy. The command now names where the native skill lives and stops to ask when the project defines its own. (#321)
+- **gateguard's cleared-files cap no longer stops real multi-slice work** — the 50-file cap halted a session touching source, tests and docs across a few PRs. The default is now 1000, which still bounds a runaway loop, and a positive-integer `GATEGUARD_MAX_CLEARED_FILES` overrides it. (#320)
+
 ## [3.25.0] — 2026-09-07
 
 ### Added

package/README.md

@@ -171,7 +171,7 @@ You should see Claude **blocked** by the bundled `gateguard` PreToolUse hook (`h
 
 The 7 Laws are enforced at **two layers**:
 
-- **Runtime layer (hooks).** `gateguard` ships as a PreToolUse hook (`hooks/gateguard.mjs`) that physically blocks Edit / Write / MultiEdit / destructive Bash on the first mutation per file until the agent presents the facts named in [skills/gateguard.md § Gate Types](skills/gateguard.md). Destructive Bash (`rm -rf`, `git push --force`, `--force-with-lease`, `DROP DATABASE`, Windows `Remove-Item -Recurse`, etc.) is gated on every call, not just first. Read-only and exploratory tools (Read, Grep, Glob, routine Bash like `git status`) bypass the gate. Per-session state at `~/.claude/instincts/<project-hash>/gateguard-session.json` caps cumulative clearances at 50 distinct files to bound stuck-loop damage. A second runtime hook, `goal-drift-stop` (`hooks/goal-drift-stop.mjs`), fires on `Stop`: it scores each turn against the stated `## Goal` and, on a substantive wrap-up that has drifted off-goal, warns by default (or re-prompts under `CLAUDE_GOAL_DRIFT_GATE=block`) — so a drifted session can't quietly declare "done". Fail-open.
+- **Runtime layer (hooks).** `gateguard` ships as a PreToolUse hook (`hooks/gateguard.mjs`) that physically blocks Edit / Write / MultiEdit / destructive Bash on the first mutation per file until the agent presents the facts named in [skills/gateguard.md § Gate Types](skills/gateguard.md). Destructive Bash (`rm -rf`, `git push --force`, `--force-with-lease`, `DROP DATABASE`, Windows `Remove-Item -Recurse`, etc.) is gated on every call, not just first. Read-only and exploratory tools (Read, Grep, Glob, routine Bash like `git status`) bypass the gate. Per-session state at `~/.claude/instincts/<project-hash>/gateguard-session.json` caps cumulative clearances at 1000 distinct files per session by default (`GATEGUARD_MAX_CLEARED_FILES` overrides it) to bound stuck-loop damage. A second runtime hook, `goal-drift-stop` (`hooks/goal-drift-stop.mjs`), fires on `Stop`: it scores each turn against the stated `## Goal` and, on a substantive wrap-up that has drifted off-goal, warns by default (or re-prompts under `CLAUDE_GOAL_DRIFT_GATE=block`) — so a drifted session can't quietly declare "done". Fail-open.
 - **Model layer (skills).** Once the runtime gate clears for a file, the rest of the discipline (`tdd-workflow`, `verification-loop`, `proceed-with-the-recommendation`, etc.) runs model-side — the agent reads each skill and applies it. `observe.sh` / `observe.mjs` records every tool call into the Mulahazah feed for instinct extraction; that surface is observational, not enforcement.
 
 V1 honest limitations: the runtime gate is honor-system once the agent flips `_gateguard_facts_presented: true` (the hook can't verify the investigation actually happened); the state file is deletable and parallel hook invocations can race. Documented in `src/hooks/gateguard.mts` and `src/lib/gateguard-state.mts` headers.
@@ -226,6 +226,7 @@ The framework has documented operator-level modes that change hook behavior with
 | `CI_GATEGUARD_EXCLUDE` | Comma-separated path fragments that `hooks/gateguard.mjs` skips for Edit / Write / MultiEdit (case-insensitive substring match on the forward-slash path). Meant for a prose wiki or a generated scratch dir. The hook prints one stderr line naming the fragment whenever an exclusion fires, and a catch-all fragment such as `/` or `.` matches every path and is reported as the file gate being off. Destructive Bash is never excluded. Unset (default) changes nothing. | bash/zsh: `export CI_GATEGUARD_EXCLUDE=docs/wiki,scratch/`. PowerShell: `$env:CI_GATEGUARD_EXCLUDE='docs/wiki,scratch/'` (session). |
 | `CI_GATEGUARD_TARGET_LOCK=block` | `hooks/gateguard.mjs` refuses any Edit / Write / MultiEdit whose absolute target canonicalizes outside the session project root, before the fact gate and independent of clearance, so a wrong-repo or wrong-worktree write is denied even with perfect facts. Off by default. | bash/zsh: `export CI_GATEGUARD_TARGET_LOCK=block`. PowerShell: `$env:CI_GATEGUARD_TARGET_LOCK='block'` (session). |
 | `CI_CONFIG_GUARD` | `hooks/config-guard.mjs` (a PreToolUse hook on Bash / Edit / Write / MultiEdit / NotebookEdit) watches the files that wire the guardrails: `.claude/settings*.json`, `.mcp.json`, `hooks.json`, `.claude/hooks/`, `.claude/plugins/`, `.claude-plugin/`, and the `claude plugin\|mcp\|config` CLI forms that edit them. `warn` (default) prints one stderr line and never blocks; `block` denies the call with the reason and the bypass; `off` disables it. Reads never trigger it. One-call bypass: `CI_CONFIG_GUARD_ALLOW=true`. Fails open. | bash/zsh: `export CI_CONFIG_GUARD=block` in `~/.bashrc` / `~/.zshrc`. PowerShell: `$env:CI_CONFIG_GUARD='block'` (session) or `[Environment]::SetEnvironmentVariable('CI_CONFIG_GUARD','block','User')` (persistent). |
+| `CI_ROUTE_PROMPT_DISABLE=1` | `hooks/route-prompt.mjs` (a UserPromptSubmit hook) emits no skill suggestion and writes no telemetry. Use it in a project that routes plan, test or review prompts to its own skills, so the generic hints do not compete with them. Set it per project in that project's `.claude/settings.json` `env` block. `true` also works; unset or any other value changes nothing. | Per project: `"env": { "CI_ROUTE_PROMPT_DISABLE": "1" }` in `.claude/settings.json`. bash/zsh: `export CI_ROUTE_PROMPT_DISABLE=1`. PowerShell: `$env:CI_ROUTE_PROMPT_DISABLE=1` (session). |
 | `CLAUDE_QUERY_COST_NUDGE=on` | `hooks/query-cost-nudge.mjs` (a `Stop` hook) guards against surprise DB bills: when the working tree has changed DB/query files (`.sql`, `.prisma`, `migrations/`, `/db/`, `schema.*`, `drizzle`) at turn end, it injects a once-per-session `additionalContext` reminder to run a D1-aware cost audit — dispatch the `database-reviewer` agent or check EXPLAIN QUERY PLAN, index coverage, N+1, and D1 `rows_read` billing before finishing. `on` enables it; default (unset) is off. Opt-in amplifier, never a gate; dedupes per session and fails open. | bash/zsh: `export CLAUDE_QUERY_COST_NUDGE=on` in `~/.bashrc` / `~/.zshrc`. PowerShell: `$env:CLAUDE_QUERY_COST_NUDGE='on'` (session) or `[Environment]::SetEnvironmentVariable('CLAUDE_QUERY_COST_NUDGE','on','User')` (persistent). |
 
 </details>

package/commands/ship.md

@@ -10,4 +10,6 @@ Invoke the native `ship` skill with this complete defect request:
 
 $ARGUMENTS
 
+The native skill is the one continuous-improvement installs: `skills/ship.md` in the plugin, or `~/.claude/skills/ship/SKILL.md` from the npm installer. If the current project defines its own `.claude/skills/ship`, that is a different workflow with its own merge and deploy rules, and a bare `ship` resolves to it. In that case stop and ask the operator which workflow they meant before doing anything.
+
 Follow that skill exactly. Do not reconstruct or duplicate its Git, worktree, TDD, return, cleanup, merge, or deploy rules here. If the native skill is unavailable, stop and tell the operator to update or reinstall `continuous-improvement`.

package/hooks/route-prompt.mjs

@@ -13,6 +13,10 @@
  *          OR empty when there is no match.
  * Exit   : 0 always — routing decisions live in stdout, never in exit code.
  *
+ * Opt-out: CI_ROUTE_PROMPT_DISABLE=1 (or `true`) emits nothing and writes no
+ * telemetry. Set it in a project's `.claude/settings.json` `env` block when
+ * that project routes plan / test / review prompts to its own skills.
+ *
  * Fail-open: any unexpected error reading stdin / parsing the route table /
  * compiling a pattern → emit nothing and exit 0. The hook never blocks a
  * prompt on its own bugs.
@@ -44,6 +48,10 @@ function readStdin() {
         return "";
     }
 }
+function isRouterDisabled() {
+    const value = (process.env.CI_ROUTE_PROMPT_DISABLE ?? "").trim().toLowerCase();
+    return value === "1" || value === "true";
+}
 function resolveHome() {
     return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
 }
@@ -129,6 +137,10 @@ function emit(output) {
     process.exit(0);
 }
 function main() {
+    if (isRouterDisabled()) {
+        emit(null);
+        return;
+    }
     const raw = readStdin();
     let payload;
     try {

package/lib/gateguard-state.mjs

@@ -27,7 +27,18 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
-export const MAX_CLEARED_FILES = 50;
+const DEFAULT_MAX_CLEARED_FILES = 1000;
+/**
+ * The per-session cap. 50 stopped real multi-slice work mid-task (a session that
+ * touches a few dozen source, test and doc files hit it); 1000 still bounds a
+ * runaway loop. GATEGUARD_MAX_CLEARED_FILES (a positive integer) overrides it.
+ */
+export function resolveMaxClearedFiles(env) {
+    const raw = env.GATEGUARD_MAX_CLEARED_FILES ?? "";
+    const n = /^\d+$/.test(raw.trim()) ? Number(raw.trim()) : Number.NaN;
+    return Number.isSafeInteger(n) && n > 0 ? n : DEFAULT_MAX_CLEARED_FILES;
+}
+export const MAX_CLEARED_FILES = resolveMaxClearedFiles(process.env);
 // A clearance file whose created_at is older than this self-heals to empty on
 // the next load, so a stale gate never needs a manual rm. Long enough not to
 // reset an active session mid-work; the real cross-session fix is the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.25.0",
+  "version": "3.26.0",
   "description": "Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
   "keywords": [
     "claude-code",

package/plugins/beginner.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.25.0",
+  "version": "3.26.0",
   "mode": "beginner",
   "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles the ship fast path plus grounding skills (gateguard, tdd-workflow, verification-loop) so one-defect delivery, research, tests, and verification happen by default — every edit starts from facts, not guesses.",
   "tools": [

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.25.0",
+      "version": "3.26.0",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.25.0",
+  "version": "3.26.0",
   "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",

package/plugins/continuous-improvement/commands/ship.md

@@ -10,4 +10,6 @@ Invoke the native `ship` skill with this complete defect request:
 
 $ARGUMENTS
 
+The native skill is the one continuous-improvement installs: `skills/ship.md` in the plugin, or `~/.claude/skills/ship/SKILL.md` from the npm installer. If the current project defines its own `.claude/skills/ship`, that is a different workflow with its own merge and deploy rules, and a bare `ship` resolves to it. In that case stop and ask the operator which workflow they meant before doing anything.
+
 Follow that skill exactly. Do not reconstruct or duplicate its Git, worktree, TDD, return, cleanup, merge, or deploy rules here. If the native skill is unavailable, stop and tell the operator to update or reinstall `continuous-improvement`.

package/plugins/continuous-improvement/hooks/route-prompt.mjs

@@ -13,6 +13,10 @@
  *          OR empty when there is no match.
  * Exit   : 0 always — routing decisions live in stdout, never in exit code.
  *
+ * Opt-out: CI_ROUTE_PROMPT_DISABLE=1 (or `true`) emits nothing and writes no
+ * telemetry. Set it in a project's `.claude/settings.json` `env` block when
+ * that project routes plan / test / review prompts to its own skills.
+ *
  * Fail-open: any unexpected error reading stdin / parsing the route table /
  * compiling a pattern → emit nothing and exit 0. The hook never blocks a
  * prompt on its own bugs.
@@ -44,6 +48,10 @@ function readStdin() {
         return "";
     }
 }
+function isRouterDisabled() {
+    const value = (process.env.CI_ROUTE_PROMPT_DISABLE ?? "").trim().toLowerCase();
+    return value === "1" || value === "true";
+}
 function resolveHome() {
     return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
 }
@@ -129,6 +137,10 @@ function emit(output) {
     process.exit(0);
 }
 function main() {
+    if (isRouterDisabled()) {
+        emit(null);
+        return;
+    }
     const raw = readStdin();
     let payload;
     try {

package/plugins/continuous-improvement/lib/gateguard-state.mjs

@@ -27,7 +27,18 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join } from "node:path";
-export const MAX_CLEARED_FILES = 50;
+const DEFAULT_MAX_CLEARED_FILES = 1000;
+/**
+ * The per-session cap. 50 stopped real multi-slice work mid-task (a session that
+ * touches a few dozen source, test and doc files hit it); 1000 still bounds a
+ * runaway loop. GATEGUARD_MAX_CLEARED_FILES (a positive integer) overrides it.
+ */
+export function resolveMaxClearedFiles(env) {
+    const raw = env.GATEGUARD_MAX_CLEARED_FILES ?? "";
+    const n = /^\d+$/.test(raw.trim()) ? Number(raw.trim()) : Number.NaN;
+    return Number.isSafeInteger(n) && n > 0 ? n : DEFAULT_MAX_CLEARED_FILES;
+}
+export const MAX_CLEARED_FILES = resolveMaxClearedFiles(process.env);
 // A clearance file whose created_at is older than this self-heals to empty on
 // the next load, so a stale gate never needs a manual rm. Long enough not to
 // reset an active session mid-work; the real cross-session fix is the

package/plugins/continuous-improvement/skills/gateguard/SKILL.md

@@ -136,7 +136,7 @@ This gate is what catches the squash-merge / ahead-of-origin trap recorded in th
 
 ### Today: runtime hook + skill (zero install beyond the plugin)
 
-`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/sessions/<session-id>/gateguard-session.json` — scoped by the stdin `session_id` so the cap never bleeds across concurrent sessions (it falls back to the unscoped `<project-hash>/` dir when no session id is present, and `GATEGUARD_SESSION_DIR` overrides it for tests). The cap is `MAX_CLEARED_FILES = 50` per session, and the state self-heals after `STATE_TTL_MS` so a stale gate never needs a manual `rm`.
+`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/sessions/<session-id>/gateguard-session.json` — scoped by the stdin `session_id` so the cap never bleeds across concurrent sessions (it falls back to the unscoped `<project-hash>/` dir when no session id is present, and `GATEGUARD_SESSION_DIR` overrides it for tests). The cap is `MAX_CLEARED_FILES`, 1000 distinct files per session by default (set `GATEGUARD_MAX_CLEARED_FILES` to a positive integer to change it), and the state self-heals after `STATE_TTL_MS` so a stale gate never needs a manual `rm`.
 
 Smoke-test the runtime gate after install: ask Claude to write a throwaway file with no research first. The hook should return a `block` decision with a fact-list reason; Claude should pause rather than write.
 
@@ -174,7 +174,7 @@ If you previously opted into `safety-guard` for autonomous or production-adjacen
 
 ### Limitations and guarantees
 
-- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap — counted per session — bounds damage from stuck loops or rogue agents.
+- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the per-session file cap (1000 by default) bounds damage from stuck loops or rogue agents.
 - **State-file deletion / self-heal.** `rm`-ing the session state resets every gate. Because state is scoped per session (`sessions/<session-id>/`), the session is a real trust boundary, not one shared across concurrent runs. A stale state file also self-heals once its `created_at` ages past `STATE_TTL_MS`, so a manual `rm` is rarely needed.
 - **Parallel-hook race.** Two simultaneous hook invocations can race the read+write of the state file. Acceptable trade-off vs Windows atomic-rename complexity.
 

package/plugins/expert.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.25.0",
+  "version": "3.26.0",
   "mode": "expert",
   "description": "Expert mode: tune confidence, manage instincts, and persist plans on disk. Adds safety, token-budget, and strategic-compact skills plus the /learn-eval command so long sessions stay sharp and learnings survive context resets.",
   "tools": [

package/skills/gateguard.md

@@ -136,7 +136,7 @@ This gate is what catches the squash-merge / ahead-of-origin trap recorded in th
 
 ### Today: runtime hook + skill (zero install beyond the plugin)
 
-`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/sessions/<session-id>/gateguard-session.json` — scoped by the stdin `session_id` so the cap never bleeds across concurrent sessions (it falls back to the unscoped `<project-hash>/` dir when no session id is present, and `GATEGUARD_SESSION_DIR` overrides it for tests). The cap is `MAX_CLEARED_FILES = 50` per session, and the state self-heals after `STATE_TTL_MS` so a stale gate never needs a manual `rm`.
+`hooks/gateguard.mjs` is bundled with this plugin and wired as the first PreToolUse hook in `plugins/continuous-improvement/hooks/hooks.json`. When you install the plugin, the runtime gate is live — no extra config, no opt-in. The hook reads tool input from stdin, classifies it through a data-driven routing table (Read/Grep/Glob → allow, Write/Edit/MultiEdit → mutating-file gate, Bash → destructive-pattern check), and emits `{decision, reason?}` on stdout. Per-session state lives at `~/.claude/instincts/<project-hash>/sessions/<session-id>/gateguard-session.json` — scoped by the stdin `session_id` so the cap never bleeds across concurrent sessions (it falls back to the unscoped `<project-hash>/` dir when no session id is present, and `GATEGUARD_SESSION_DIR` overrides it for tests). The cap is `MAX_CLEARED_FILES`, 1000 distinct files per session by default (set `GATEGUARD_MAX_CLEARED_FILES` to a positive integer to change it), and the state self-heals after `STATE_TTL_MS` so a stale gate never needs a manual `rm`.
 
 Smoke-test the runtime gate after install: ask Claude to write a throwaway file with no research first. The hook should return a `block` decision with a fact-list reason; Claude should pause rather than write.
 
@@ -174,7 +174,7 @@ If you previously opted into `safety-guard` for autonomous or production-adjacen
 
 ### Limitations and guarantees
 
-- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the 50-file cap — counted per session — bounds damage from stuck loops or rogue agents.
+- **Honor system.** Clearance is recorded by `ci_gateguard_clear`, the `gateguard-clear.mjs` CLI, a manual state-file write, or the inline `_gateguard_facts_presented` flag where the harness allows it (see "Clearing the gate" above). The hook can't verify the investigation actually happened; the per-session file cap (1000 by default) bounds damage from stuck loops or rogue agents.
 - **State-file deletion / self-heal.** `rm`-ing the session state resets every gate. Because state is scoped per session (`sessions/<session-id>/`), the session is a real trust boundary, not one shared across concurrent runs. A stale state file also self-heals once its `created_at` ages past `STATE_TTL_MS`, so a manual `rm` is rarely needed.
 - **Parallel-hook race.** Two simultaneous hook invocations can race the read+write of the state file. Acceptable trade-off vs Windows atomic-rename complexity.