create-agent-rig 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -11,6 +11,54 @@ Numbering is ordinary semver — **additive is a minor, a fix is a patch** — s
 that "I only take minors" remains a usable policy; 0.3.2 shipped additive
 content as a patch by the owner's call and stays recorded as one.
 
+## 0.6.2
+
+**Patch hardening for the Agent OS shipped by 0.6.1.** This release closes six
+downstream-found governance and transport defects without changing the public
+CLI or adding a dependency.
+
+### Fixed
+
+- **A UTF-8 BOM on a hook's stdin no longer disarms it.** PowerShell prepends
+  one on some Windows hosts, `JSON.parse` throws on a leading U+FEFF, and every
+  hook resolved that to its documented fail-open — so a well-formed refusal
+  became an allow. On such a host all eight hooks failed open together,
+  `guard-bash` among them, which carries the Never tier and the kill switch.
+  They now read through one shared `.claude/hooks/lib/hook-input.mjs`. Pinned in
+  `test/template/hook-stdin.test.ts` › "blocks the same command when PowerShell
+  prepends a UTF-8 BOM" and › "reads stdin through the one shared reader, in
+  every hook that reads it".
+- **Windows 8.3 short paths no longer hide a rulebook edit from the guard.**
+  `realpathSync` normalises separators but leaves a short name (`RUNNER~1`,
+  `SERHII~1`) unexpanded, so a checkout reached by two spellings hashed to two
+  unattended-flag names and compared as two directories. Both
+  `guard-rulebook` and `unattended-flag` now canonicalise with
+  `realpathSync.native`. Pinned in `test/template/unattended-flag.test.ts` ›
+  "scopes the flag by the checkout, so two spellings of one directory arm one
+  file".
+- **Codex hooks carry the canonical repository root in `CLAUDE_PROJECT_DIR` on
+  POSIX and Windows.** A session started in a nested directory therefore judges
+  a rulebook edit against the checkout the hook came from. Pinned in
+  `test/template/codex.test.ts` › "anchors a nested-cwd Codex rulebook edit to
+  the canonical repository root"; the same test file decodes and checks the
+  Windows command.
+- **Jira retry is limited to safe reads and the semantically read-only search
+  POST.** Comment, transition, issue-create and issue-update mutations return
+  the first ambiguous transient failure instead of replaying the write. Pinned
+  in `test/template/queue-jira.test.ts` › "does not retry %s" and › "retries a
+  semantically read-only search POST after a 429".
+- **`.claude/doctor-exemptions.json` is protected as rulebook input.** An
+  unattended edit is refused unless the current item's allow-list names that
+  exact file. Pinned in `test/template/guard-rulebook.test.ts` › "allows doctor
+  exemptions only when the item names that exact rulebook file" and the guarded
+  path table in the same suite.
+- **`lastCompletedTier` is explicitly repository-global across board switches.**
+  A selector change cannot reset the spacing brake and admit a second elevated
+  mechanism change in the same checkout. The ruling is in
+  `docs/decisions/spacing-rations-mechanisms.md`, pinned by
+  `test/template/queue-board.test.ts` › "keeps completed-tier spacing
+  repository-global when the active board switches".
+
 ## 0.6.1
 
 **Security and upgrade hardening for the Agent OS shipped by 0.6.0.** This patch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agent-rig",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Scaffold a new project with an agent operating system (rules, gates, hooks) and a runnable code skeleton",
   "keywords": [
     "create",
@@ -51,6 +51,8 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.1.1",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "eslint": "^10.7.0",
     "eslint-config-prettier": "^10.1.8",
     "globals": "^17.7.0",

package/templates/agent-os/universal/.agents/skills/loop/SKILL.md

@@ -59,7 +59,11 @@ and the `board` command itself refuses a switch while the checkout is unattended
 does not prevent an arbitrary direct shell write to the selector — edit-tool
 hooks cannot see one. `.claude/queue.state.json` stays per config, not per board:
 the tier the last close recorded rations the next selection whichever board it
-lands on.
+lands on. This is repository-risk state, not tracker metadata: switching from
+one independent queue to another must not turn a previous mechanism close into
+permission for a second one in the same checkout. Pinned in the generator's
+`test/template/queue-board.test.ts` (absent in a generated rig) › "keeps
+completed-tier spacing repository-global when the active board switches".
 
 Adding a fourth is an adapter, not a rewrite: `core.mjs` holds every selection
 decision and each adapter only maps its tracker's records onto the neutral shape.

package/templates/agent-os/universal/.claude/hooks/block-no-verify.mjs

@@ -12,15 +12,11 @@
 // to tokenise: it owns exactly one invariant and stays readable because of it
 // (see .claude/rules/invariants.md, "One invariant per hook"). Use a file rather
 // than a heredoc, or quote the example.
-import { readFileSync } from 'node:fs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0;
-  }
+  const input = readHookInput();
+  if (input === null) return 0;
   if (input.tool_name !== 'Bash') return 0;
   const raw = String(input.tool_input?.command ?? '');
 

package/templates/agent-os/universal/.claude/hooks/gate-stop-dod.mjs

@@ -66,6 +66,7 @@ import { readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 
 import { withoutGitLocation } from '../scripts/git-env.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 // 🔴 The tree this gate measures is the project the hook BELONGS to — the
 // directory above `.claude/hooks/` — never the directory the session happens
@@ -166,12 +167,8 @@ function budgetMs(env) {
 }
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch (error) {
-    return failOpen(`the Stop payload could not be read: ${error.message}`);
-  }
+  const input = readHookInput();
+  if (input === null) return failOpen('the Stop payload could not be read');
   if (input.hook_event_name !== 'Stop' && input.hook_event_name !== 'SubagentStop') return 0;
   if (input.stop_hook_active) return 0;
 

package/templates/agent-os/universal/.claude/hooks/guard-bash.mjs

@@ -77,9 +77,10 @@
 // Contract (Claude Code): JSON on stdin; exit 0 = allow, exit 2 = block, and
 // stderr is shown to the agent as the reason. Fails open on anything it cannot
 // parse — a crashed guard must never make the session unusable.
-import { readFileSync, realpathSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { brakeIsOn } from '../scripts/stop-flag.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 /** Branches that are shared by definition. */
 const PROTECTED_BRANCH = /^(main|master|develop|development|trunk)$/;
@@ -804,12 +805,8 @@ export const inspect = (raw, brake, depth = 0) => {
 };
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0;
-  }
+  const input = readHookInput();
+  if (input === null) return 0;
   if (input.tool_name !== 'Bash') return 0;
   const commandValue = input.tool_input?.command;
   if (typeof commandValue !== 'string') return 0;

package/templates/agent-os/universal/.claude/hooks/guard-core-purity.mjs

@@ -8,8 +8,8 @@
 // Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
 // codex.test.ts › "$guard blocks with a neutral, actionable size-limit refusal"; generated
 // projects do not carry that suite, and a downstream edit requires a local replacement test.
-import { readFileSync } from 'node:fs';
 import { editFragments } from './lib/edit-input.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 /** The only non-relative import the core may use: its schema/validation library. */
 const ALLOWED_PACKAGES = ['zod'];
@@ -29,12 +29,8 @@ const BANNED = [
 ];
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
   const fragments = editFragments(input);
   const blocked = fragments.find(
     ({ inspectionRefusal, appliesToAll }) => appliesToAll && inspectionRefusal,

package/templates/agent-os/universal/.claude/hooks/guard-rulebook.mjs

@@ -4,8 +4,9 @@
 //
 // The rulebook is the set of files that decide what this session may do — hooks
 // and settings wiring, the queue config and selector, all scripts, rules, skills
-// and agents, the `.codex/` configuration, the integrity manifest, `AGENTS.md`
-// and `CLAUDE.md`. Every one of them was editable by the run it governs: a
+// and agents, the `.codex/` configuration, the integrity manifest,
+// `.claude/doctor-exemptions.json`, `AGENTS.md` and `CLAUDE.md`. Every one of
+// them was editable by the run it governs: a
 // Write to `.claude/hooks/dod-checks.json` with `[]` switched the stop gate
 // off, and nothing refused it until the merge sweep, long after.
 //
@@ -60,10 +61,11 @@
 //     adversary.
 //
 // The rule it enforces is stated in `.claude/rules/autonomy.md`, "Never".
-import { readFileSync, realpathSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
 import { editFragments } from './lib/edit-input.mjs';
 import { RULEBOOK_PREFIXES, isRulebookPath, readUnattended } from '../scripts/unattended-flag.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 export { RULEBOOK_PREFIXES, isRulebookPath };
 
@@ -71,9 +73,20 @@ const EDIT_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply
 
 const toPosix = (value) => String(value ?? '').replaceAll('\\', '/');
 
+// RP-54: `.native`, never plain `realpathSync`. Both resolve symlinks and
+// normalise separators; only the native one expands a Windows 8.3 short name,
+// so `C:\Users\RUNNER~1\…` and `C:\Users\runneradmin\…` otherwise survive as
+// two spellings of one directory. The root arrives from
+// `git rev-parse --show-toplevel` (long) while a payload path arrives however
+// the tool spelled it (short under an 8.3 temp or home), and a root that
+// matches no spelling of the payload makes this fail-open guard allow the
+// rulebook edit it exists to refuse. Both sites take the same canonicaliser or
+// the comparison is between two different normalisations. Measured on Windows
+// by codex.test.ts (absent in a generated rig) › "anchors a nested-cwd Windows
+// Codex rulebook edit to the canonical repository root".
 const canonicalRoot = (root) => {
   try {
-    return realpathSync(root);
+    return realpathSync.native(root);
   } catch {
     return root;
   }
@@ -85,7 +98,7 @@ const canonicalPath = (filePath) => {
   const tail = [];
   for (;;) {
     try {
-      return join(realpathSync(cursor), ...tail);
+      return join(realpathSync.native(cursor), ...tail);
     } catch {
       const parent = dirname(cursor);
       if (parent === cursor) return filePath;
@@ -112,12 +125,8 @@ const protectedRelative = (roots, filePath) =>
     .find(isRulebookPath);
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
   if (!EDIT_TOOLS.has(input?.tool_name)) return 0;
 
   const selectedRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();

package/templates/agent-os/universal/.claude/hooks/guard-secret-file.mjs

@@ -82,10 +82,10 @@
 // by an explicit per-line candidate cap rather than running to exhaustion. Any
 // unbounded work in a fail-open guard is a total bypass of every rule at once,
 // not just of this one.
-import { readFileSync } from 'node:fs';
 
 import { findSecretValues, isCredentialPath } from '../scripts/lib/secrets.mjs';
 import { editFragments } from './lib/edit-input.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 /** Where a refusal points the agent, so the block is actionable rather than a wall. */
 const WHERE_CREDENTIALS_BELONG =
@@ -93,12 +93,8 @@ const WHERE_CREDENTIALS_BELONG =
   'and reach the process through the environment — see .claude/rules/autonomy.md, "Never".';
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
 
   const editTools = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'apply_patch']);
   if (!editTools.has(input?.tool_name)) return 0;

package/templates/agent-os/universal/.claude/hooks/guard-web-boundary.mjs

@@ -8,8 +8,8 @@
 // Generator-owned coverage for the neutral bounded-inspection refusal lives upstream in
 // codex.test.ts › "$guard blocks with a neutral, actionable size-limit refusal"; generated
 // projects do not carry that suite, and a downstream edit requires a local replacement test.
-import { readFileSync } from 'node:fs';
 import { editFragments } from './lib/edit-input.mjs';
+import { readHookInput } from './lib/hook-input.mjs';
 
 const WEB_PATH = /(^|\/)apps\/web\//;
 const CODE_FILE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
@@ -20,12 +20,8 @@ const FORBIDDEN_WORKSPACE = /^@[^/]+\/(db|api|worker)$/;
 const FORBIDDEN_RELATIVE = /(^|\/)(packages\/db|services)(\/|$)/;
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0; // unparseable payload: not ours to judge
-  }
+  const input = readHookInput();
+  if (input === null) return 0; // unparseable payload: not ours to judge
   const violations = [];
   const importRe =
     /(?:\bfrom\s*|\bimport\s*\(\s*|\brequire\s*\(\s*|^\s*import\s+)['"]([^'"]+)['"]/gm;

package/templates/agent-os/universal/.claude/hooks/inject-rules.mjs

@@ -30,6 +30,7 @@
 // is why every ambiguity resolves toward injecting more.
 import { readFileSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { readHookInput } from './lib/hook-input.mjs';
 
 // Regions the rule file marks as not worth injecting. The marker is explicit
 // and lives in the rule file itself, where the person editing it can see it —
@@ -150,12 +151,8 @@ function invokedDirectly() {
 }
 
 function main() {
-  let input;
-  try {
-    input = JSON.parse(readFileSync(0, 'utf8'));
-  } catch {
-    return 0;
-  }
+  const input = readHookInput();
+  if (input === null) return 0;
   if (input.hook_event_name !== 'SessionStart') return 0;
 
   let rules;

package/templates/agent-os/universal/.claude/hooks/lib/hook-input.mjs

@@ -0,0 +1,55 @@
+// The one place a hook reads its payload — `invariants.md`, "One mechanism,
+// one implementation". Eight hooks each parsing stdin is eight chances for one
+// of them to keep a defect the others fixed, and the one nobody looks at is the
+// one that will.
+//
+// 🔴 Why this module exists at all (RP-54). A hook that cannot parse its
+// payload allows the tool call — that is the documented fail-open, and it is
+// correct: a crashed guard must not make the session unusable. But it means an
+// unreadable payload silently disarms EVERY rule the hook carries, so what
+// counts as unreadable has to be as narrow as the format honestly allows.
+//
+// Measured on the hosted `windows-unit` runner, through the generated Codex
+// `commandWindows` wrapper (CI run 33281160544): the wrapper delivers stdin and
+// propagates the child's exit code, but the guard received **290 bytes for a
+// 287-byte payload**. PowerShell prepends a UTF-8 BOM on that host. `JSON.parse`
+// throws on a leading U+FEFF, so every guard resolved a well-formed payload to
+// "not ours to judge" and allowed the edit — including `guard-bash`, which
+// carries the Never tier and the kill switch. A Windows host whose PowerShell
+// does not add the BOM parses the same payload fine, which is why this looked
+// like a runner-only mystery for two days.
+//
+// A BOM is a byte-order mark, not content: stripping one leading U+FEFF is what
+// the format means, not a tolerance added to get a test green.
+//
+// Bounded work, because a fail-open reader is a total bypass if it can throw or
+// spin: one read, one character comparison, one slice, one parse. No loop, no
+// recursion, no rescanning.
+//
+// Limits, stated rather than implied:
+// - Only a BOM at position 0 is stripped. A payload with other leading bytes is
+//   still unreadable, and still resolves to `null`.
+// - `null` means "no payload this hook can judge" and every caller keeps its own
+//   fail-open on it. This module does not decide policy; it only removes the
+//   spelling difference between two hosts.
+// Pinned in hook-stdin.test.ts (absent in a generated rig) ›
+// "blocks the same command when PowerShell prepends a UTF-8 BOM" and ›
+// "reads stdin through the one shared reader, in every hook that reads it".
+
+import { readFileSync } from 'node:fs';
+
+/** The hook payload as an object, or `null` when there is none this hook can read. */
+export const readHookInput = () => {
+  let raw;
+  try {
+    raw = readFileSync(0, 'utf8');
+  } catch {
+    return null;
+  }
+  if (raw.charCodeAt(0) === 0xfeff) raw = raw.slice(1);
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+};

package/templates/agent-os/universal/.claude/scripts/queue/jira.mjs

@@ -286,22 +286,32 @@ const retryDelayMs = (response, attempt) => {
  * - a timeout (`timeoutMs`, default 20 s) through an AbortController — a stalled
  *   connection used to block selection forever, and a loop that cannot read its
  *   queue must stop, not hang;
- * - a retry on 429/502/503/504, at most `MAX_ATTEMPTS`, honouring `Retry-After`;
- *   401/403/404 and every other status fail at once — a bad credential is not
- *   transient, and retrying it only delays the diagnosis;
+ * - safe reads retry 429/502/503/504 at most `MAX_ATTEMPTS`, honouring
+ *   `Retry-After`; mutating calls do not retry an ambiguous response, because
+ *   Jira may have applied the write before a proxy returned the error. The
+ *   search endpoint opts in explicitly: it is a POST at the transport layer and
+ *   a read at the operation layer;
  * - `retry.sleep` injectable, so a test measures the delay it would have waited
  *   instead of waiting it.
  *
  * Pinned in the generator's `test/template/queue-jira.test.ts` (absent in a
  * generated rig) › "hands fetch an AbortSignal", › "rejects naming the timeout
- * and the route when fetch never resolves", › "a 429 followed by a 200 yields
- * the 200 body", › "sleeps for the Retry-After the 429 carried, in
+ * and the route when fetch never resolves", › "retries a semantically read-only
+ * search POST after a 429", › "keeps bounded retry for a safe issue GET", ›
+ * "does not retry %s", › "sleeps for the Retry-After the 429 carried, in
  * milliseconds", › "gives up after four consecutive 503s, naming the status and
  * the attempts" and › "does not retry a 401 — a bad credential is not transient".
  */
 const request = async (
   route,
-  { method = 'GET', body = null, env = process.env, timeoutMs = DEFAULT_TIMEOUT_MS, retry = {} } = {},
+  {
+    method = 'GET',
+    body = null,
+    env = process.env,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    retry = {},
+    retryTransient = method === 'GET',
+  } = {},
 ) => {
   const { baseUrl, email, token } = requireCredentials(env);
   const sleep = retry.sleep ?? defaultSleep;
@@ -334,13 +344,14 @@ const request = async (
       clearTimeout(timer);
     }
     if (response.ok) return payload;
-    if (TRANSIENT.has(response.status) && attempt < MAX_ATTEMPTS) {
+    const retryable = retryTransient && TRANSIENT.has(response.status);
+    if (retryable && attempt < MAX_ATTEMPTS) {
       await sleep(retryDelayMs(response, attempt));
       continue;
     }
     // The status alone; never echo the response body, which can carry the token
     // back in an error envelope.
-    const attempts = TRANSIENT.has(response.status) ? ` after ${attempt} attempts` : '';
+    const attempts = retryable ? ` after ${attempt} attempts` : '';
     throw new Error(`jira ${method} ${route} failed: ${response.status} ${response.statusText}${attempts}`);
   }
 };
@@ -443,6 +454,7 @@ export const search = async ({
     pages += 1;
     const page = await request('/rest/api/3/search/jql', {
       method: 'POST',
+      retryTransient: true,
       body: {
         jql: query,
         maxResults: limit,

package/templates/agent-os/universal/.claude/scripts/unattended-flag.mjs

@@ -80,6 +80,7 @@ export const MAX_ALLOW_ENTRIES = 64;
 export const RULEBOOK_PREFIXES = Object.freeze([
   '.agents/',
   '.claude/.rig-manifest.json',
+  '.claude/doctor-exemptions.json',
   '.claude/agents/',
   '.claude/hooks/',
   '.claude/settings.json',
@@ -116,16 +117,38 @@ export const isWidening = (entry) =>
   entry === '.codex/' ||
   RULEBOOK_PREFIXES.some((prefix) => prefix !== entry && prefix.startsWith(entry));
 
-const canonicalCheckout = (env) => {
-  const declared = typeof env.CLAUDE_PROJECT_DIR === 'string' ? env.CLAUDE_PROJECT_DIR.trim() : '';
-  if (declared === '') return null;
+/**
+ * One spelling for one directory — the single canonicaliser this file compares
+ * and hashes with (`invariants.md`, "One mechanism, one implementation").
+ *
+ * RP-54: it is `realpathSync.native`, not `realpathSync`, and on Windows those
+ * differ. Both normalise separators; only the native one expands an 8.3 short
+ * name, so `C:\Users\RUNNER~1\…` and `C:\Users\runneradmin\…` survive
+ * `realpathSync` as two strings for one directory. The flag is named by a hash
+ * of this value while the generated Codex Windows hook supplies
+ * `git rev-parse --show-toplevel` — a different spelling of the same checkout —
+ * so the guard looked for a file nobody wrote and, being fail-open, allowed the
+ * rulebook edit it exists to refuse. Proven by
+ * unattended-flag.test.ts › "scopes the flag by the checkout, so two spellings
+ * of one directory arm one file".
+ *
+ * A path that does not exist has no real path; `resolve` is the fallback, and
+ * it is the same one on both sides of every comparison below.
+ */
+const canonicalPath = (p) => {
   try {
-    return realpathSync(declared);
+    return realpathSync.native(p);
   } catch {
-    return resolve(declared);
+    return resolve(p);
   }
 };
 
+const canonicalCheckout = (env) => {
+  const declared = typeof env.CLAUDE_PROJECT_DIR === 'string' ? env.CLAUDE_PROJECT_DIR.trim() : '';
+  if (declared === '') return null;
+  return canonicalPath(declared);
+};
+
 const checkoutId = (env) => {
   const canonical = canonicalCheckout(env);
   if (canonical === null) return null;
@@ -290,12 +313,10 @@ export const writeUnattended = ({ item, runDir = null, allow = [] } = {}, env =
 };
 
 const pathBelongsToCheckout = (candidate, checkout) => {
-  let resolved;
-  try {
-    resolved = realpathSync(candidate);
-  } catch {
-    resolved = resolve(candidate);
-  }
+  // `checkout` is `canonicalCheckout`'s output, so the candidate takes the same
+  // canonicaliser: two spellings compared here would put an in-checkout runDir
+  // outside its own checkout.
+  const resolved = canonicalPath(candidate);
   const rel = relative(checkout, resolved);
   return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
 };
@@ -364,14 +385,7 @@ export const clearLegacyUnattended = (selectedPath) => {
 
 const invokedDirectly = () => {
   if (!process.argv[1]) return false;
-  const real = (p) => {
-    try {
-      return realpathSync(p);
-    } catch {
-      return p;
-    }
-  };
-  return real(fileURLToPath(import.meta.url)) === real(process.argv[1]);
+  return canonicalPath(fileURLToPath(import.meta.url)) === canonicalPath(process.argv[1]);
 };
 
 if (invokedDirectly()) {

package/templates/agent-os/universal/.claude/skills/loop/SKILL.md

@@ -59,7 +59,11 @@ and the `board` command itself refuses a switch while the checkout is unattended
 does not prevent an arbitrary direct shell write to the selector — edit-tool
 hooks cannot see one. `.claude/queue.state.json` stays per config, not per board:
 the tier the last close recorded rations the next selection whichever board it
-lands on.
+lands on. This is repository-risk state, not tracker metadata: switching from
+one independent queue to another must not turn a previous mechanism close into
+permission for a second one in the same checkout. Pinned in the generator's
+`test/template/queue-board.test.ts` (absent in a generated rig) › "keeps
+completed-tier spacing repository-global when the active board switches".
 
 Adding a fourth is an adapter, not a rewrite: `core.mjs` holds every selection
 decision and each adapter only maps its tracker's records onto the neutral shape.

package/templates/agent-os/universal/.codex/hooks.json

@@ -7,23 +7,23 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-core-purity.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQBjAG8AcgBlAC0AcAB1AHIAaQB0AHkALgBtAGoAcwAnADsAIAAmACAAbgBvAGQAZQAgACQAaABvAG8AawBQAGEAdABoADsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQA="
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/guard-core-purity.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGcAdQBhAHIAZAAtAGMAbwByAGUALQBwAHUAcgBpAHQAeQAuAG0AagBzACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAEYAaQBsAGUATgBhAG0AZQAgAD0AIAAnAG4AbwBkAGUAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAEEAcgBnAHUAbQBlAG4AdABzACAAPQAgACcAIgAnACAAKwAgACQAaABvAG8AawBQAGEAdABoACAAKwAgACcAIgAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAYwBoAGkAbABkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwB0AGEAcgB0AEkAbgBmAG8AKQA7ACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AcABlAG4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAoACkALgBDAG8AcAB5AFQAbwAoACQAYwBoAGkAbABkAC4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAuAEIAYQBzAGUAUwB0AHIAZQBhAG0AKQA7ACAAJABjAGgAaQBsAGQALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAGgAaQBsAGQALgBXAGEAaQB0AEYAbwByAEUAeABpAHQAKAApADsAIABlAHgAaQB0ACAAJABjAGgAaQBsAGQALgBFAHgAaQB0AEMAbwBkAGUA"
           },
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-web-boundary.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQB3AGUAYgAtAGIAbwB1AG4AZABhAHIAeQAuAG0AagBzACcAOwAgACYAIABuAG8AZABlACAAJABoAG8AbwBrAFAAYQB0AGgAOwAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFAA=="
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/guard-web-boundary.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGcAdQBhAHIAZAAtAHcAZQBiAC0AYgBvAHUAbgBkAGEAcgB5AC4AbQBqAHMAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACcAbgBvAGQAZQAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwAiACcAIAArACAAJABoAG8AbwBrAFAAYQB0AGgAIAArACAAJwAiACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0ACAAPQAgACQAdAByAHUAZQA7ACAAJABjAGgAaQBsAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzAHQAYQByAHQASQBuAGYAbwApADsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwBwAGUAbgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0ACgAKQAuAEMAbwBwAHkAVABvACgAJABjAGgAaQBsAGQALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AQgBhAHMAZQBTAHQAcgBlAGEAbQApADsAIAAkAGMAaABpAGwAZAAuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQALgBDAGwAbwBzAGUAKAApADsAIAAkAGMAaABpAGwAZAAuAFcAYQBpAHQARgBvAHIARQB4AGkAdAAoACkAOwAgAGUAeABpAHQAIAAkAGMAaABpAGwAZAAuAEUAeABpAHQAQwBvAGQAZQA="
           },
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-secret-file.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQBzAGUAYwByAGUAdAAtAGYAaQBsAGUALgBtAGoAcwAnADsAIAAmACAAbgBvAGQAZQAgACQAaABvAG8AawBQAGEAdABoADsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQA="
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/guard-secret-file.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGcAdQBhAHIAZAAtAHMAZQBjAHIAZQB0AC0AZgBpAGwAZQAuAG0AagBzACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAEYAaQBsAGUATgBhAG0AZQAgAD0AIAAnAG4AbwBkAGUAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAEEAcgBnAHUAbQBlAG4AdABzACAAPQAgACcAIgAnACAAKwAgACQAaABvAG8AawBQAGEAdABoACAAKwAgACcAIgAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAYwBoAGkAbABkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwB0AGEAcgB0AEkAbgBmAG8AKQA7ACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AcABlAG4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAoACkALgBDAG8AcAB5AFQAbwAoACQAYwBoAGkAbABkAC4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAuAEIAYQBzAGUAUwB0AHIAZQBhAG0AKQA7ACAAJABjAGgAaQBsAGQALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAGgAaQBsAGQALgBXAGEAaQB0AEYAbwByAEUAeABpAHQAKAApADsAIABlAHgAaQB0ACAAJABjAGgAaQBsAGQALgBFAHgAaQB0AEMAbwBkAGUA"
           },
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-rulebook.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQByAHUAbABlAGIAbwBvAGsALgBtAGoAcwAnADsAIAAmACAAbgBvAGQAZQAgACQAaABvAG8AawBQAGEAdABoADsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQA="
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/guard-rulebook.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGcAdQBhAHIAZAAtAHIAdQBsAGUAYgBvAG8AawAuAG0AagBzACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBTAHQAYQByAHQASQBuAGYAbwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAEYAaQBsAGUATgBhAG0AZQAgAD0AIAAnAG4AbwBkAGUAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAEEAcgBnAHUAbQBlAG4AdABzACAAPQAgACcAIgAnACAAKwAgACQAaABvAG8AawBQAGEAdABoACAAKwAgACcAIgAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAgAD0AIAAkAHQAcgB1AGUAOwAgACQAYwBoAGkAbABkACAAPQAgAFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwB0AGEAcgB0AEkAbgBmAG8AKQA7ACAAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AcABlAG4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAoACkALgBDAG8AcAB5AFQAbwAoACQAYwBoAGkAbABkAC4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAuAEIAYQBzAGUAUwB0AHIAZQBhAG0AKQA7ACAAJABjAGgAaQBsAGQALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAGgAaQBsAGQALgBXAGEAaQB0AEYAbwByAEUAeABpAHQAKAApADsAIABlAHgAaQB0ACAAJABjAGgAaQBsAGQALgBFAHgAaQB0AEMAbwBkAGUA"
           }
         ]
       },
@@ -32,13 +32,13 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/block-no-verify.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBiAGwAbwBjAGsALQBuAG8ALQB2AGUAcgBpAGYAeQAuAG0AagBzACcAOwAgACYAIABuAG8AZABlACAAJABoAG8AbwBrAFAAYQB0AGgAOwAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFAA=="
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/block-no-verify.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGIAbABvAGMAawAtAG4AbwAtAHYAZQByAGkAZgB5AC4AbQBqAHMAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACcAbgBvAGQAZQAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwAiACcAIAArACAAJABoAG8AbwBrAFAAYQB0AGgAIAArACAAJwAiACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0ACAAPQAgACQAdAByAHUAZQA7ACAAJABjAGgAaQBsAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzAHQAYQByAHQASQBuAGYAbwApADsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwBwAGUAbgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0ACgAKQAuAEMAbwBwAHkAVABvACgAJABjAGgAaQBsAGQALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AQgBhAHMAZQBTAHQAcgBlAGEAbQApADsAIAAkAGMAaABpAGwAZAAuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQALgBDAGwAbwBzAGUAKAApADsAIAAkAGMAaABpAGwAZAAuAFcAYQBpAHQARgBvAHIARQB4AGkAdAAoACkAOwAgAGUAeABpAHQAIAAkAGMAaABpAGwAZAAuAEUAeABpAHQAQwBvAGQAZQA="
           },
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-bash.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAHUAYQByAGQALQBiAGEAcwBoAC4AbQBqAHMAJwA7ACAAJgAgAG4AbwBkAGUAIAAkAGgAbwBvAGsAUABhAHQAaAA7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUA"
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/guard-bash.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGcAdQBhAHIAZAAtAGIAYQBzAGgALgBtAGoAcwAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAJwBuAG8AZABlACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBBAHIAZwB1AG0AZQBuAHQAcwAgAD0AIAAnACIAJwAgACsAIAAkAGgAbwBvAGsAUABhAHQAaAAgACsAIAAnACIAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQAIAA9ACAAJAB0AHIAdQBlADsAIAAkAGMAaABpAGwAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAHQAYQByAHQAKAAkAHMAdABhAHIAdABJAG4AZgBvACkAOwAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHAAZQBuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQAKAApAC4AQwBvAHAAeQBUAG8AKAAkAGMAaABpAGwAZAAuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQALgBCAGEAcwBlAFMAdAByAGUAYQBtACkAOwAgACQAYwBoAGkAbABkAC4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAuAEMAbABvAHMAZQAoACkAOwAgACQAYwBoAGkAbABkAC4AVwBhAGkAdABGAG8AcgBFAHgAaQB0ACgAKQA7ACAAZQB4AGkAdAAgACQAYwBoAGkAbABkAC4ARQB4AGkAdABDAG8AZABlAA=="
           }
         ]
       }
@@ -48,9 +48,9 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/gate-stop-dod.mjs\"",
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/gate-stop-dod.mjs\"",
             "timeout": 900,
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBnAGEAdABlAC0AcwB0AG8AcAAtAGQAbwBkAC4AbQBqAHMAJwA7ACAAJgAgAG4AbwBkAGUAIAAkAGgAbwBvAGsAUABhAHQAaAA7ACAAZQB4AGkAdAAgACQATABBAFMAVABFAFgASQBUAEMATwBEAEUA"
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGcAYQB0AGUALQBzAHQAbwBwAC0AZABvAGQALgBtAGoAcwAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBGAGkAbABlAE4AYQBtAGUAIAA9ACAAJwBuAG8AZABlACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBBAHIAZwB1AG0AZQBuAHQAcwAgAD0AIAAnACIAJwAgACsAIAAkAGgAbwBvAGsAUABhAHQAaAAgACsAIAAnACIAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlACAAPQAgACQAZgBhAGwAcwBlADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQAIAA9ACAAJAB0AHIAdQBlADsAIAAkAGMAaABpAGwAZAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAHQAYQByAHQAKAAkAHMAdABhAHIAdABJAG4AZgBvACkAOwAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBPAHAAZQBuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQAKAApAC4AQwBvAHAAeQBUAG8AKAAkAGMAaABpAGwAZAAuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQALgBCAGEAcwBlAFMAdAByAGUAYQBtACkAOwAgACQAYwBoAGkAbABkAC4AUwB0AGEAbgBkAGEAcgBkAEkAbgBwAHUAdAAuAEMAbABvAHMAZQAoACkAOwAgACQAYwBoAGkAbABkAC4AVwBhAGkAdABGAG8AcgBFAHgAaQB0ACgAKQA7ACAAZQB4AGkAdAAgACQAYwBoAGkAbABkAC4ARQB4AGkAdABDAG8AZABlAA=="
           }
         ]
       }
@@ -60,8 +60,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/inject-rules.mjs\"",
-            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAaABvAG8AawBQAGEAdABoACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJAByAGUAcABvAFIAbwBvAHQAIAAnAC4AYwBsAGEAdQBkAGUALwBoAG8AbwBrAHMALwBpAG4AagBlAGMAdAAtAHIAdQBsAGUAcwAuAG0AagBzACcAOwAgACYAIABuAG8AZABlACAAJABoAG8AbwBrAFAAYQB0AGgAOwAgAGUAeABpAHQAIAAkAEwAQQBTAFQARQBYAEkAVABDAE8ARABFAA=="
+            "command": "repoRoot=\"$(git rev-parse --show-toplevel)\" && CLAUDE_PROJECT_DIR=\"$repoRoot\" node \"$repoRoot/.claude/hooks/inject-rules.mjs\"",
+            "commandWindows": "powershell.exe -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAdABvAHAAJwA7ACAAJAByAGUAcABvAFIAbwBvAHQAIAA9ACAAZwBpAHQAIAByAGUAdgAtAHAAYQByAHMAZQAgAC0ALQBzAGgAbwB3AC0AdABvAHAAbABlAHYAZQBsADsAIABpAGYAIAAoACQATABBAFMAVABFAFgASQBUAEMATwBEAEUAIAAtAG4AZQAgADAAKQAgAHsAIABlAHgAaQB0ACAAJABMAEEAUwBUAEUAWABJAFQAQwBPAEQARQAgAH0AOwAgACQAZQBuAHYAOgBDAEwAQQBVAEQARQBfAFAAUgBPAEoARQBDAFQAXwBEAEkAUgAgAD0AIAAkAHIAZQBwAG8AUgBvAG8AdAA7ACAAJABoAG8AbwBrAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAZQBwAG8AUgBvAG8AdAAgACcALgBjAGwAYQB1AGQAZQAvAGgAbwBvAGsAcwAvAGkAbgBqAGUAYwB0AC0AcgB1AGwAZQBzAC4AbQBqAHMAJwA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4ARgBpAGwAZQBOAGEAbQBlACAAPQAgACcAbgBvAGQAZQAnADsAIAAkAHMAdABhAHIAdABJAG4AZgBvAC4AQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwAiACcAIAArACAAJABoAG8AbwBrAFAAYQB0AGgAIAArACAAJwAiACcAOwAgACQAcwB0AGEAcgB0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQAgAD0AIAAkAGYAYQBsAHMAZQA7ACAAJABzAHQAYQByAHQASQBuAGYAbwAuAFIAZQBkAGkAcgBlAGMAdABTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0ACAAPQAgACQAdAByAHUAZQA7ACAAJABjAGgAaQBsAGQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzAHQAYQByAHQASQBuAGYAbwApADsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoATwBwAGUAbgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0ACgAKQAuAEMAbwBwAHkAVABvACgAJABjAGgAaQBsAGQALgBTAHQAYQBuAGQAYQByAGQASQBuAHAAdQB0AC4AQgBhAHMAZQBTAHQAcgBlAGEAbQApADsAIAAkAGMAaABpAGwAZAAuAFMAdABhAG4AZABhAHIAZABJAG4AcAB1AHQALgBDAGwAbwBzAGUAKAApADsAIAAkAGMAaABpAGwAZAAuAFcAYQBpAHQARgBvAHIARQB4AGkAdAAoACkAOwAgAGUAeABpAHQAIAAkAGMAaABpAGwAZAAuAEUAeABpAHQAQwBvAGQAZQA="
           }
         ]
       }

package/templates/agent-os/universal/docs/decisions/spacing-rations-mechanisms.md

@@ -116,6 +116,21 @@ with no refusal, and then **holds** the elevated item with `causes: ["spacing"]`
 It holds because `core.mjs` is the layer that reads every unrecognised value
 restrictively — the same layer that holds when `selectNext` is called directly.
 
+## A board switch does not reset repository risk
+
+`lastCompletedTier` is intentionally checkout-global, not board-scoped. Boards
+partition ownership and selection; they do not partition the repository a merge
+changes. If switching the selector chose a fresh tier slot, a run could land an
+unreviewed mechanism from one board, switch to an independent queue, and land a
+second mechanism in the same checkout — exactly the back-to-back chain the
+ration exists to stop.
+
+The selector therefore changes only the adapter options. The tier stays in the
+one `.claude/queue.state.json` paired with the checkout's config, and the next
+selection reads it whichever board is active. This is pinned in the generator's
+`test/template/queue-board.test.ts` (absent in a generated rig) › "keeps
+completed-tier spacing repository-global when the active board switches".
+
 ## What this does not fix
 
 The livelock where *every* remaining item is elevated-by-mechanism still exists —

package/templates/agent-os/universal/layers.json

@@ -17,6 +17,7 @@
     ".claude/hooks/guard-secret-file.mjs",
     ".claude/hooks/guard-rulebook.mjs",
     ".claude/hooks/lib/edit-input.mjs",
+    ".claude/hooks/lib/hook-input.mjs",
     ".claude/skills/pr-ship/SKILL.md",
     ".claude/skills/loop/SKILL.md",
     ".claude/skills/check-premises/SKILL.md",

package/templates/hash-history.json

@@ -6,7 +6,8 @@
     "0.3.2",
     "0.4.0",
     "0.5.0",
-    "0.6.0"
+    "0.6.0",
+    "0.6.1"
   ],
   "files": {
     ".agents/skills/check-premises/SKILL.md": {
@@ -20,7 +21,8 @@
       "since": "0.5.0",
       "hashes": [
         "eb52ef41269018107534d8dc2f552c57698e1677a1e76b5e666b5d09c007cac0",
-        "47922b182915cb92696f851174f2e88c4ae8c67dc119ef39a3a597ef1300fab5"
+        "47922b182915cb92696f851174f2e88c4ae8c67dc119ef39a3a597ef1300fab5",
+        "57f6add0504db45e7577474f97705fe474310e4cd3310cdb348a2c64eabe88cd"
       ]
     },
     ".agents/skills/new-invariant/SKILL.md": {
@@ -90,7 +92,8 @@
       "hashes": [
         "8d5762849afd328fdc1aabf053ad207f2e306e013665e3ff934b06cbb1bbda38",
         "0e4307cd9cf8ef723d79e98b1af46a34c6912a6aa925e2179d939cb83c8f2a44",
-        "7e8eaa2b4af9d65e1d10bf50c32c1d138fb2f8b9ba6e6d0880cade0524324d9d"
+        "7e8eaa2b4af9d65e1d10bf50c32c1d138fb2f8b9ba6e6d0880cade0524324d9d",
+        "ed1c05d3938c0b4f277f1bf4af8641460def830569049ff0697c9bda14518b78"
       ]
     },
     ".claude/agents/security-scanner.md": {
@@ -126,14 +129,16 @@
         "de1f331eaf93bad6ef0e1734789fd3c4ab07550a85ed2d8ff8888bc6f0bcfb0f",
         "9fb8fad4d95756fb2424a97550aa85dfab0ca8dbcf91e6d0385263ba3b929135",
         "7852205961cb1647b49de5f7e79820c1735b4be897adcf8f5bc3eeb49318ff78",
-        "33edb11904e5c4f88626b41c7e649b85d20957a11ff7e1062538917647c3e7f0"
+        "33edb11904e5c4f88626b41c7e649b85d20957a11ff7e1062538917647c3e7f0",
+        "19202a28355dac1d7a95d29411668cf970006b3044d89a772768ce21793931aa"
       ]
     },
     ".claude/hooks/guard-bash.mjs": {
       "since": "0.3.0",
       "hashes": [
         "4d396f412fc53094188b14348c5af4e79c7542a182630c20c4687d79899c5b0e",
-        "e7a513216ebbceaa7f11ec8fb611de8bb5d5925dfdfd75b779dcb7c0ee6e83cc"
+        "e7a513216ebbceaa7f11ec8fb611de8bb5d5925dfdfd75b779dcb7c0ee6e83cc",
+        "78047f42dda65076dd2cdb73ad530553db3d4a6f3ea7f0729590ac7286323cb1"
       ]
     },
     ".claude/hooks/guard-core-purity.mjs": {
@@ -146,13 +151,15 @@
     ".claude/hooks/guard-rulebook.mjs": {
       "since": "0.6.0",
       "hashes": [
-        "4524d715f2e41f4cfdd3d0f9c858817f913aaca5192bda97dff876b4d8c51f19"
+        "4524d715f2e41f4cfdd3d0f9c858817f913aaca5192bda97dff876b4d8c51f19",
+        "f9e3e4b7c22c4a64f521402419707ff382b05c8deb6310f62e5545db87f7cb4f"
       ]
     },
     ".claude/hooks/guard-secret-file.mjs": {
       "since": "0.5.0",
       "hashes": [
-        "f6b81cb7640924d2e56aced58e6b48f65df6638fb5a9099985fe5d673245c3ad"
+        "f6b81cb7640924d2e56aced58e6b48f65df6638fb5a9099985fe5d673245c3ad",
+        "8c333879dba1f2bf87bbb8e7b257ac51315a74a4cb45252408ca615e2a42d7b5"
       ]
     },
     ".claude/hooks/guard-web-boundary.mjs": {
@@ -173,7 +180,8 @@
       "since": "0.5.0",
       "hashes": [
         "4f836bc3ff75a868ffe035b179ac9e7dc1ad7715d520677ff9f6aa5bfdb200eb",
-        "0c191d326a7bb0bbfc110e2210f44b4aa39276e8db3779aaa4545cffd4e11863"
+        "0c191d326a7bb0bbfc110e2210f44b4aa39276e8db3779aaa4545cffd4e11863",
+        "572c671f8f2cad190fe2f144071954ac4d3b1357cab80a19bad584dd3b3768c8"
       ]
     },
     ".claude/queue.json": {
@@ -194,7 +202,8 @@
         "c3aa6ea4487adf6d542174f491bf469d8f8563ec7c8c4de63fcd82d6a5ca4fba",
         "ce2104ce697d3e5ed9210e85fe0daeb66b432a36868493f06fec54073a5fff31",
         "530f63a4b29a5cc67867fa7b23575db81d42609ae401bfc4089b05194c586c21",
-        "a7359408d56e6bdbf268019ad9193d5fbf4a872385a65ba08564204e6a8f5b5f"
+        "a7359408d56e6bdbf268019ad9193d5fbf4a872385a65ba08564204e6a8f5b5f",
+        "619999500386b3d2867bbd4799f86a800fe7e168083c6e35fb2e629a2c926c5f"
       ]
     },
     ".claude/rules/aws-cdk.md": {
@@ -211,7 +220,8 @@
         "b24bbf3e596033719eff463d317ba1e933d0661e48bfa8eafba8d6dca1453a59",
         "518d9b3d7cbae50f30c86d33b2b4bbea11ab3ba6cfef270876e92604b2af5f50",
         "389484f0846c3dd8207c0f41bd56409103fbcc7f58b94b1bf4bd1d81b5af0e87",
-        "a2e10499a0bcd2cdc32f3986d27b59077c86e524d40323faabb2e5d78afc002c"
+        "a2e10499a0bcd2cdc32f3986d27b59077c86e524d40323faabb2e5d78afc002c",
+        "c94c33d7ccbd46f191948325dfc7f68ce13b0d3a9470215de1de3f06b1499111"
       ]
     },
     ".claude/rules/node-ts.md": {
@@ -233,7 +243,8 @@
       "since": "0.5.0",
       "hashes": [
         "783b5b455a56c6a3e3723f3c6da861e0a945562acb686b86ab9d0e16dbd552a6",
-        "c7a045d3687429c5047f09b4033ffffcecfede2edba736106f5e1048eb3cf27f"
+        "c7a045d3687429c5047f09b4033ffffcecfede2edba736106f5e1048eb3cf27f",
+        "8e9fe877949955e8f698701f969784b288bc95943c3bcea3bd4368db82e8e43e"
       ]
     },
     ".claude/scripts/detect-missed-gate.mjs": {
@@ -247,13 +258,15 @@
     ".claude/scripts/doctor.mjs": {
       "since": "0.6.0",
       "hashes": [
-        "eb31d2726ab95d6b8fd091b1daf8a21f403a46c801590baf4fecee5c1bec64b9"
+        "eb31d2726ab95d6b8fd091b1daf8a21f403a46c801590baf4fecee5c1bec64b9",
+        "5154ad9abdcb37fea58b0da78fd71842c705774ffe48fd8050c302da17e73913"
       ]
     },
     ".claude/scripts/git-env.mjs": {
       "since": "0.5.0",
       "hashes": [
-        "ff9f3c848a3881b67a8f795a4d172f407d896447e21dd3a9c4903365977d4519"
+        "ff9f3c848a3881b67a8f795a4d172f407d896447e21dd3a9c4903365977d4519",
+        "b022399f287cdce1bcb07329c0aab44bf99714b5f0515f274c962f41ea072b86"
       ]
     },
     ".claude/scripts/lib/gate-coverage.mjs": {
@@ -265,13 +278,15 @@
     ".claude/scripts/lib/revalidation-points.mjs": {
       "since": "0.6.0",
       "hashes": [
-        "41c4f70e5914636bccec7995172c322c875774027e0c626abb7c593c43fddd65"
+        "41c4f70e5914636bccec7995172c322c875774027e0c626abb7c593c43fddd65",
+        "b48e4959862906e279eca481f484f07a7fd4aa082f2778224a6574a7871bc9d8"
       ]
     },
     ".claude/scripts/lib/secrets.mjs": {
       "since": "0.5.0",
       "hashes": [
-        "dc4a300646f12459c0c37e380b325451474e1ec113482381e0fad80aceb88049"
+        "dc4a300646f12459c0c37e380b325451474e1ec113482381e0fad80aceb88049",
+        "60fab2cc9f2028bccf6139e6a744406b4a86a9039d1367f3cef409902e9b327d"
       ]
     },
     ".claude/scripts/lib/verdict.mjs": {
@@ -332,7 +347,8 @@
       "hashes": [
         "cd149245dc29ef7489ae0e5394fa5a063dea2cc017bd3cbbface1ace6f8d7b46",
         "7db3c17b781e6876b4822afd09e6affa97e46607b63d443975d987daf1f14464",
-        "9edd70b5960f367958e8e7500150b4edd285c99869cca803e40e0537d2d347b0"
+        "9edd70b5960f367958e8e7500150b4edd285c99869cca803e40e0537d2d347b0",
+        "4cf917ac06708e1068dfe9f8bbebc9376c4748526bd669b9bea32929ba996d0a"
       ]
     },
     ".claude/scripts/queue/jira.mjs": {
@@ -341,7 +357,8 @@
         "13e187a4005136a9a1fae5fb5a3d2a61c3cf5dc097b467c12622ad82a0fd5d52",
         "86591a48b9264d641c2530238ea3720705f12e17af2ec8dccecabfa3a742a2e7",
         "13c301f828d4402fcf81e7e0b2b1d22472cbdb50f6fd606770056af4ec215e51",
-        "b8be5855809c0d44ece94858456098663296c17c5ad9abb1ea2cf1a8f48ca491"
+        "b8be5855809c0d44ece94858456098663296c17c5ad9abb1ea2cf1a8f48ca491",
+        "3fc8ff9a06a2e22355a660a31e2943a97f50869f7e5726f768a7931d17b64b5b"
       ]
     },
     ".claude/scripts/queue/plan-md.mjs": {
@@ -368,13 +385,15 @@
     ".claude/scripts/revalidate.mjs": {
       "since": "0.6.0",
       "hashes": [
-        "32f847a2a3a5136cabcb42f6447da9f8cf98e2d20512212ee5201461128d7798"
+        "32f847a2a3a5136cabcb42f6447da9f8cf98e2d20512212ee5201461128d7798",
+        "b62348a27bcaa1d62a0e4ddd53873fab6cb75f9af8e8c69d24f6ce81c592c4e3"
       ]
     },
     ".claude/scripts/revalidation-report.mjs": {
       "since": "0.6.0",
       "hashes": [
-        "b99a3537158c2851698bfac027f7061811d7d428c3eea57f3ce0f58ea75dc249"
+        "b99a3537158c2851698bfac027f7061811d7d428c3eea57f3ce0f58ea75dc249",
+        "78adac5c8f696f2c9cc86f404abf1d55604ccb10f11dd612501c14d4cf5935b1"
       ]
     },
     ".claude/scripts/run-journal.mjs": {
@@ -400,7 +419,8 @@
     ".claude/scripts/unattended-flag.mjs": {
       "since": "0.6.0",
       "hashes": [
-        "060b001927d8b471f1c1a8c8851fbb4266d3b2edd674cccbd6c16c44b57b91dd"
+        "060b001927d8b471f1c1a8c8851fbb4266d3b2edd674cccbd6c16c44b57b91dd",
+        "7721ee19fd1bcf6902be3d359def40742d79b88f5d83e7e3ca22ba45ca3211aa"
       ]
     },
     ".claude/scripts/verdict.mjs": {
@@ -435,7 +455,8 @@
         "8f687f92fa60d4cc679fa13bff997cec92227f6bc0b90c1dc5b8a5400f2abef0",
         "e442ca58c4249ac10d5759bba2d8360544642e03b2b158e6253e71f5be3767fb",
         "eb52ef41269018107534d8dc2f552c57698e1677a1e76b5e666b5d09c007cac0",
-        "47922b182915cb92696f851174f2e88c4ae8c67dc119ef39a3a597ef1300fab5"
+        "47922b182915cb92696f851174f2e88c4ae8c67dc119ef39a3a597ef1300fab5",
+        "57f6add0504db45e7577474f97705fe474310e4cd3310cdb348a2c64eabe88cd"
       ]
     },
     ".claude/skills/new-invariant/SKILL.md": {
@@ -503,7 +524,8 @@
       "since": "0.5.0",
       "hashes": [
         "80b4631502d95c619ad060ce02cc8702b12574758ba7df8337ed63efa15d764d",
-        "cfd516f72acdfd197c59ac3cbdd39d7b175976dbd3d9eef52825dfdc4f1e5b60"
+        "cfd516f72acdfd197c59ac3cbdd39d7b175976dbd3d9eef52825dfdc4f1e5b60",
+        "8687eacf0ad707a4f887e0714e82fca23fd005fa9ec8824faedfe99ca46333e1"
       ]
     },
     ".codex/agents/security-scanner.toml": {

package/templates/release-ledger.json

@@ -6,5 +6,6 @@
   "0.3.2": "bbcb24fd8ff5290826ee3b152b5130f6bd4697da",
   "0.4.0": "c77c6c3e5d991a55b733a05a3b5ae01e2a55e578",
   "0.5.0": "d78d0e77307a2be128de46ff4f64e3c146b5df2b",
-  "0.6.0": "29ca0543368e922349945e52541a92b46ddcc5bd"
+  "0.6.0": "29ca0543368e922349945e52541a92b46ddcc5bd",
+  "0.6.1": "f1d1e3dbd2161545d77ee5e7f90fa8e74b8a9f3e"
 }