create-byan-agent 2.35.0 → 2.39.0

package/CHANGELOG.md

@@ -9,6 +9,209 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.39.0] - 2026-07-02
+
+### Added - shippable soul stays in sync with the active soul (byan-sync-soul)
+
+BYAN's active identity (`_byan/agent/byan/soul.md`, `tao.md`) is shipped to a
+fresh install via the prefixed copies `byan-soul.md` / `byan-tao.md`, which the
+installer copies into place at setup. Those copies were a MANUAL mirror and had
+drifted: `byan-soul.md` had missed the `## Valeurs` section and the 2026-07-02
+couche-vivante revision, so a fresh install shipped a stale identity. The
+2026-03-27 revision had warned that soul transmission needs maintenance — the
+manual sync did not hold.
+
+- **New generator `byan-sync-soul`** (`lib/sync-soul.js` + `bin/byan-sync-soul.js`)
+  mirrors the active soul + tao into the shippable prefixed copies. `--check`
+  reports drift and exits non-zero.
+- **Pre-commit gate**: `.githooks/pre-commit` runs `byan-sync-soul --check`, so a
+  commit whose shippable soul drifted from the active one is blocked. Dev-repo
+  tooling — the bin is not shipped, so the gate no-ops in installed projects
+  (`[ -f ]` guard), where it is not needed.
+- **Caught up**: `byan-soul.md` now carries the `## Valeurs` section and the
+  2026-07-02 revision; `byan-tao.md` was already in sync.
+- **soul-memory is out of scope**: `byan-soul-memory.md` is a curated seed journal
+  (distinct from this repo's living `soul-memory.md`), so it is not mirrored.
+
+Files: `_byan/mcp/byan-mcp-server/lib/sync-soul.js` + `bin/byan-sync-soul.js` +
+`test/sync-soul.test.js`, `.githooks/pre-commit` (+ template mirror),
+`_byan/agent/byan/byan-soul.md` (+ template mirror). Adversarial review
+(bmad-compliance) approved, 0 must_fix; it corrected an inaccurate rationale in
+the comments (the installer copies, it does not rename), fixed before merge.
+MCP node --test 733/733, jest root 2473/2473.
+
+### Added - strict self-verify checklist from measured recurring gaps
+
+Strict mode now carries a self-verify checklist of BYAN's OWN most frequent
+blind spots, so each self-verify pass checks them on top of the locked
+acceptance criteria. The three themes are not guessed — they were harvested from
+the strict audit log by `byan_insight_digest` (self-verify gap clustering):
+tests/coverage (observed 20x), doc-follows-code (10x), scope-discovery (7x). The
+heterogeneous "other" cluster (18x) was deliberately excluded — too mixed to
+become a single check.
+
+- **Single source of truth**: the checklist lives under `self_verify.checklist`
+  in `_byan/_config/strict-mode.yaml`. Each item is a testable question plus an
+  `observed` count kept as the WHY (a signal, not a target).
+- **Propagated by the generator**: `byan-sync-rules` renders it into the three
+  operative surfaces — the `byan-strict` SKILL (a `## Self-verify checklist`
+  section), `.claude/hooks/lib/strict-config.json` (`self_verify_checklist`, with
+  `observed` stripped as source-only), and the `AGENTS.md` block (Codex parity).
+  Idempotent; an older config with no checklist renders an empty list and no
+  section.
+- **Anti-drop**: a test asserts the real `strict-mode.yaml` carries the three
+  themes and that they survive the generator, so a future edit cannot silently
+  drop them. Additive only — `min_passes`, `last_verdict_must_be`, mantras,
+  banners and the scope guard are unchanged.
+
+This closes the insight loop from the 2026-07-02 soul revision: a measured,
+recurring gap becomes a mechanized check rather than a remembered intention.
+
+Files: `_byan/_config/strict-mode.yaml`, `_byan/mcp/byan-mcp-server/lib/sync-rules.js`,
+`_byan/mcp/byan-mcp-server/test/sync-rules.test.js`, regenerated
+`.claude/skills/byan-strict/SKILL.md` + `.claude/hooks/lib/strict-config.json` +
+`AGENTS.md` (+ install template mirrors). Adversarial review (bmad-compliance)
+approved, 0 must_fix, 7/7 criteria. MCP node --test 726/726, jest root 2473/2473.
+
+## [2.38.0] - 2026-06-30
+
+### Added - yanstaller installs the byan-channel MCP entry by default (inert)
+
+`npx create-byan-agent` now registers a second MCP server, `byan-channel`,
+alongside `byan` in the project `.mcp.json`. It is a Claude Code RESEARCH PREVIEW
+channel (v2.1.80+) and ships INERT: registering it enables nothing on its own --
+it is only loaded when the user launches
+`claude --dangerously-load-development-channels server:byan-channel`. No
+`channelsEnabled`, no `allowedChannelPlugins`, no auto-activation flag is written.
+Codex is not covered by this feature.
+
+- **Port (read-only from byan_web)**: `channel-entry.js`, `lib/channel-server.js`,
+  `lib/channel-poll.js` brought into `_byan/mcp/byan-mcp-server/`. The entry
+  resolves its own config at boot via `resolve-config.js` (env ->
+  `~/.byan/credentials.json` -> defaults), so no secret is needed in `.mcp.json`.
+- **Wiring -- one shape, every writer**: the byan + byan-channel entry shape has a
+  single source of truth, `mcpConfig.mergeByanEntry`, with no `.mcp.json` template
+  to drift out of sync. Both writers route through it -- `generateMcpConfig` (the
+  primary native-setup path, a pure delegation) and `installDirectMCP` -- so they
+  are byte-coherent. Each writes a project-relative path (not absolute, not
+  `{{PROJECT_ROOT}}`), preserves an existing custom `command` and non-byan env,
+  strips `BYAN_API_URL`/`BYAN_API_TOKEN`, and merges into an existing `.mcp.json`
+  without clobbering other servers. Additional default MCP servers are registered
+  via `addMcpEntry` (mcp-extensions), not a template.
+- **Portable + secret-free**: relative paths survive a moved / npm-shipped repo;
+  the channel env is forced empty; no token shape can land in tracked `.mcp.json`.
+- **Shipped**: the 3 runtime files + 2 tests are in `TARGET_ADDITIONS` and
+  mirrored to `install/templates`, parity enforced by `byan-sync-template --check`.
+- **Honest post-install message**: states research-preview, version gate, inert
+  default, the activation flag, and that Codex is not covered.
+
+Files: `install/packages/platform-config/lib/mcp-config.js` (mergeByanEntry /
+mergeChannelEntry / mergeLeantimeRefs -- relative args, command preserved),
+`install/lib/claude-native-setup.js` (generateMcpConfig is a pure delegation to
+the shared merge), `install/lib/platforms/claude-code.js` (installDirectMCP),
+`install/bin/create-byan-agent-v2.js` (message),
+`_byan/mcp/byan-mcp-server/{channel-entry,lib/channel-server,lib/channel-poll}.js`,
+`_byan/mcp/byan-mcp-server/lib/template-sync.js`,
+`_byan/mcp/byan-mcp-server/test/{channel,channel-resolve}.test.js` (+ install
+templates). Adversarial review (bmad-compliance) caught 3 message/coherence gaps,
+all fixed before merge; a follow-up adversarial pass drove removal of the now-dead
+`.mcp.json.tmpl` so the byan/byan-channel shape has a single source of truth.
+jest root 2473/2473, MCP node --test 723/723.
+
+## [2.37.1] - 2026-06-30
+
+### Fixed - strict-stop-guard false positive on mentioned completion markers
+
+`claimsCompletion` matched a completion marker ANYWHERE in the assistant message,
+so a turn was blocked even when a marker was merely MENTIONED, not claimed:
+`complete` inside `byan_strict_complete`, `done` inside the `BYAN-BENCH:done`
+marker comment, or an accented marker embedded in another word (`fini` in
+`indefini`, `termine` in `determine`). Hit repeatedly in one session. Hardened: a
+working copy is denoised first (fenced + inline code, HTML comments, snake_case /
+namespaced identifiers stripped), then markers match only as a standalone claim
+with Unicode-aware boundaries and a permissive trailing inflection (`livre` ->
+`livree` / `livres`). Bias toward fewer false blocks -- the pre-commit gate stays
+the hard net for a real premature completion. Genuine claims (`done`,
+`c'est termine`, `feature livree`, `the build is complete`) still fire. +4
+regression tests.
+
+Files: `.claude/hooks/strict-stop-guard.js` (+ install template),
+`_byan/mcp/byan-mcp-server/test/strict-hooks.test.js`. MCP node --test 714/714,
+root jest 2466/2466.
+
+## [2.37.0] - 2026-06-30
+
+### Added - Prod-grade + maximal scope as the mechanical default (anti-downgrade)
+
+A 4-lens diagnosis workflow established WHY the agent kept drifting toward MVP /
+half-work despite the whole anti-downgrade arsenal: it was OPT-IN (every guard a
+no-op until a scope is locked), the strict loop was self-judged (agent writes the
+contract, grades its own verdict), and the cost model was anchored on human-2010
+time, generating the MVP-split reflex. This ships the mechanical, default-on fix.
+
+- **F1 -- delivery-contract anchor (LIVE).** New `inject-delivery-default.js`
+  (UserPromptSubmit) + pure lib `delivery-contract.js` re-inject a contract every
+  turn: grade=PROD, scope=MAXIMAL (proposing an MVP / short-deliverable /
+  dont-block-the-heavy split is forbidden unless the user types an opt-out word
+  THIS message), cost yardstick=AI-2026 (estimate in agent-time x10, not
+  human-by-hand). Opt-out wordlist in `_byan/_config/delivery-default.json`. The
+  opt-out parser is biased toward PROD: a single opt-out word counts only as a
+  short directive or with a go-cheap cue, is dropped when negated ("pas de mvp"),
+  and a mere mention in a long meta message leaves the anchor armed. Preserved
+  across compaction (CLAUDE.md) and mirrored to AGENTS.md (Codex).
+- **F2 -- non-agent completeness judge (built, DISARMED).** `completeness-evidence.js`
+  wired additively into strict `complete()` + the pre-commit gate: a "done" claim
+  is backed by a non-fabricable artifact (a real test-runner exit, a `git diff`
+  vs the locked paths, a file that exists), breaking the judge=defendant loop.
+  Ships behind `completenessGate.armed=false` (collect + ledger only) so it does
+  not change behavior or self-lock until the ledger validates arming.
+- **F3 -- punt-guard (built, DISARMED).** Stop hook + pure `punt-detect.js`
+  flags handing the user a runnable command the agent could run itself, with a
+  creds carve-out (git push / npm publish). Ships behind `puntGuard.armed=false`
+  (observe + ledger).
+
+Caught in build: F1's first live turn revealed a false positive (the anchor
+self-disabled on any message that merely mentioned an opt-out word). Fixed in
+place with the negation + directive-context hardening above + 3 regression tests.
+
+Files: `.claude/hooks/inject-delivery-default.js`, `.claude/hooks/lib/delivery-contract.js`,
+`.claude/hooks/punt-guard.js`, `.claude/hooks/lib/punt-detect.js`,
+`_byan/mcp/byan-mcp-server/lib/completeness-evidence.js`, wired into `strict-mode.js`
++ `precommit-gate.js`, `_byan/_config/delivery-default.json`, `.claude/settings.json`,
+CLAUDE.md + AGENTS.md (+ install templates) + tests. MCP node --test 710/710, root
+jest 2466/2466. Strict scope 9f8c6048.
+
+## [2.36.0] - 2026-06-29
+
+### Added - Leantime auto-sync: complexity, priority and description on task creation
+
+The FD->Leantime auto-sync (which already creates tasks and drives the
+todo/doing/review/done lifecycle) now enriches each created task with effort,
+priority and a traceable description -- no manual board work.
+
+- **F1 -- pure resolvers + enriched intent** (`leantime-fd-core.js`). Two
+  exported pure functions: `priorityToLeantime` (P1/P2/P3 -> 3/2/1, omitted when
+  unknown) and `complexityToStorypoints` (a finite `item.complexity` bucketed on
+  the Fibonacci scale <=15->2 / 16-39->5 / 40-69->8 / >=70->13, else derived from
+  priority P1->8 / P2->5 / P3->3, default 3 -- returns a numeric estimate).
+  `decideActions` now emits `{ priority?, storypoints, description }` in the
+  `task_create` intent (`description` = `BYAN FD <id> -- <headline>` +
+  ` [complexity:N]` when finite).
+- **F2 -- carrier + passthrough** (`leantime-sync.js` + the `leantime-fd-sync`
+  hook, source + install template). `createTask` accepts and sends `storypoints`;
+  the hook passes `description` / `priority` / `storypoints` through to it. The
+  lifecycle sync is untouched.
+
+Note: `storypoints` is the presumed Leantime effort field, `[UNVERIFIED]` against
+a live instance (Leantime unreachable at build time). An unknown key is at worst
+ignored by `addTicket` (no break), and the complexity is also carried in the
+description as a fallback. Flagged for a live-verify when reachable.
+
+Files: `_byan/mcp/byan-mcp-server/lib/leantime-fd-core.js`, `lib/leantime-sync.js`,
+`.claude/hooks/leantime-fd-sync.js` (+ install template), `test/leantime-fd-core.test.js`
++ `test/leantime-sync.test.js` (+7 tests). MCP node --test 696/696, root jest
+2441/2441. Strict scope 80405c59.
+
 ## [2.35.0] - 2026-06-26
 
 ### Added - Portable core / native projection doctrine + degradation litmus

package/install/bin/create-byan-agent-v2.js

@@ -1296,6 +1296,21 @@ async function install(options = {}) {
     console.log(chalk.cyan('Claude Code native setup (hooks, skills, MCP server)'));
     try {
       await setupClaudeNative(projectRoot);
+      // Honest disclosure about the byan-channel entry now in .mcp.json. It is a
+      // Claude Code RESEARCH PREVIEW feature and ships INERT: registering it does
+      // not enable it. We tell the user exactly what it is, what it requires, how
+      // to turn it on, and that Codex is not covered — no overselling.
+      console.log(
+        chalk.gray(
+          '    - byan-channel = Claude Code RESEARCH PREVIEW channel (v2.1.80+), INERT by default.'
+        )
+      );
+      console.log(
+        chalk.gray(
+          '      To activate: claude --dangerously-load-development-channels server:byan-channel'
+        )
+      );
+      console.log(chalk.gray('      Codex is not covered by this feature.'));
     } catch (error) {
       console.log(chalk.red(`  ✘ Claude native setup failed: ${error.message}`));
       console.log(

package/install/lib/claude-native-setup.js

@@ -9,7 +9,8 @@
  *   - _byan/mcp/byan-mcp-server/** (no node_modules)
  *
  * Generates:
- *   - .mcp.json with the absolute path to the target project's MCP server
+ *   - .mcp.json with the RELATIVE path to the target project's MCP server
+ *     (byan + inert byan-channel entries, via the shared pure merge)
  *
  * Runs:
  *   - npm install inside the copied MCP server dir (with fallback warning)
@@ -22,6 +23,7 @@ const chalk = require('chalk');
 
 const TEMPLATE_ROOT = path.resolve(__dirname, '..', 'templates');
 const { whitelistMcpServer } = require('./settings-local');
+const { mcpConfig } = require('byan-platform-config');
 
 async function copyClaudeHooks(projectRoot) {
   const src = path.join(TEMPLATE_ROOT, '.claude', 'hooks');
@@ -78,30 +80,15 @@ async function copyMcpServer(projectRoot) {
 }
 
 async function generateMcpConfig(projectRoot, options = {}) {
-  const tmplPath = path.join(TEMPLATE_ROOT, '.mcp.json.tmpl');
   const dstPath = path.join(projectRoot, '.mcp.json');
 
-  let template;
-  if (await fs.pathExists(tmplPath)) {
-    template = await fs.readFile(tmplPath, 'utf8');
-  } else {
-    template = JSON.stringify(
-      {
-        mcpServers: {
-          byan: {
-            command: 'node',
-            args: ['{{PROJECT_ROOT}}/_byan/mcp/byan-mcp-server/server.js'],
-            env: { BYAN_API_URL: options.apiUrl || 'http://localhost:3737' },
-          },
-        },
-      },
-      null,
-      2
-    );
-  }
-
-  const rendered = template.replace(/\{\{PROJECT_ROOT\}\}/g, projectRoot);
-
+  // Read-merge-write through the single source of truth for the byan + inert
+  // byan-channel entry shape: mcpConfig.mergeByanEntry (relative args, secret-free,
+  // existing siblings + custom command + non-byan env preserved, channel added
+  // inert). This is byte-coherent with installDirectMCP, which routes through the
+  // same merge. Additional default MCP servers are registered via addMcpEntry
+  // (mcp-extensions), not here -- so there is no .mcp.json template to drift out
+  // of sync with the merge.
   let existing = {};
   if (await fs.pathExists(dstPath)) {
     try {
@@ -111,20 +98,7 @@ async function generateMcpConfig(projectRoot, options = {}) {
     }
   }
 
-  const merged = JSON.parse(rendered);
-  merged.mcpServers = { ...(existing.mcpServers || {}), ...merged.mcpServers };
-
-  // Security: BYAN_API_TOKEN is never written into .mcp.json (git-tracked); the
-  // token reaches the MCP server via .claude/settings.local.json env. Also honor
-  // the caller's apiUrl: the template URL is only a default.
-  const byanEntry = merged.mcpServers && merged.mcpServers.byan;
-  if (byanEntry && byanEntry.env) {
-    delete byanEntry.env.BYAN_API_TOKEN;
-    if (options.apiUrl) {
-      byanEntry.env.BYAN_API_URL = options.apiUrl;
-    }
-  }
-
+  const merged = mcpConfig.mergeByanEntry(existing, { apiUrl: options.apiUrl });
   await fs.writeJson(dstPath, merged, { spaces: 2 });
   return { path: dstPath };
 }
@@ -197,7 +171,7 @@ async function setupClaudeNative(projectRoot, options = {}) {
   );
 
   results.mcpConfig = await generateMcpConfig(projectRoot, options);
-  log(chalk.green(`  ✓ .mcp.json generated (absolute path)`));
+  log(chalk.green(`  byan + inert byan-channel entries in .mcp.json (relative paths)`));
 
   // Whitelist the byan MCP server: a project .mcp.json entry is inert in Claude
   // Code until its id is listed in .claude/settings.local.json.

package/install/lib/platforms/claude-code.js

@@ -11,9 +11,19 @@ const path = require('path');
 const os = require('os');
 const fileUtils = require('../utils/file-utils');
 const logger = require('../utils/logger');
+// Single source of truth for the byan + byan-channel entry shape: the same pure
+// merge the canonical .mcp.json writer uses (READ-MERGE-WRITE, relative paths,
+// no secret, byan-channel inert). installDirectMCP delegates to it instead of
+// hand-building a divergent entry with an absolute path that overwrote siblings.
+const { mcpConfig } = require('byan-platform-config');
 
 const PLATFORM_NAME = 'Claude Code';
-const MCP_SERVER_FILENAME = 'byan-mcp-server.js';
+// Relative path discipline: the byan server entry args[0] is repo-relative
+// (mcpConfig.MCP_SERVER_REL_PATH), NEVER an absolute path. The old
+// MCP_SERVER_FILENAME ('byan-mcp-server.js') was both the wrong filename and
+// joined into an absolute path; both are gone. Kept only as the existence probe
+// target below is the real server file under the relative path.
+const MCP_SERVER_REL_PATH = mcpConfig.MCP_SERVER_REL_PATH;
 
 /**
  * Get config path for current platform
@@ -137,41 +147,40 @@ async function installViaClaudeAgent(projectRoot, agents, config) {
  */
 async function installDirectMCP(projectRoot, agents, config) {
   const configPath = getConfigPath();
-  const mcpServerPath = path.join(projectRoot, MCP_SERVER_FILENAME);
-  
+  // Existence probe against the REAL server file at its repo-relative path
+  // (resolved to absolute only for the fs check). The args written into the
+  // config below stay relative — see mcpConfig.MCP_SERVER_REL_PATH.
+  const mcpServerPath = path.join(projectRoot, MCP_SERVER_REL_PATH);
+
   // Check if MCP server exists
   if (!await fileUtils.exists(mcpServerPath)) {
     logger.warn(`MCP server not found at: ${mcpServerPath}`);
     logger.warn('Run @bmad-agent-claude to generate MCP server first.');
-    
+
     return {
       success: false,
       installed: 0,
       method: 'direct-mcp-failed'
     };
   }
-  
+
   // Backup existing config
   const backupPath = `${configPath}.backup`;
   await fileUtils.copy(configPath, backupPath);
   logger.info(`Backed up config to: ${backupPath}`);
-  
-  // Read and update config
+
+  // READ-MERGE-WRITE through the shared pure merge so this writer is byte-for-byte
+  // identical to the canonical .mcp.json writer: relative server path, no secret,
+  // existing mcpServers.* preserved, and the inert byan-channel entry added.
+  // apiUrl is irrelevant to the entry shape (the server resolves its own config),
+  // but the merge signature accepts it; a localhost placeholder keeps it valid.
   const existingConfig = await fileUtils.readJson(configPath);
-  existingConfig.mcpServers = existingConfig.mcpServers || {};
-  
-  existingConfig.mcpServers.byan = {
-    command: 'node',
-    args: [mcpServerPath],
-    env: {
-      PROJECT_ROOT: projectRoot
-    }
-  };
-  
+  const merged = mcpConfig.mergeByanEntry(existingConfig, { apiUrl: 'http://localhost:3737' });
+
   // Write updated config
-  await fileUtils.writeJson(configPath, existingConfig, { spaces: 2 });
+  await fileUtils.writeJson(configPath, merged, { spaces: 2 });
   logger.info(`Updated MCP config: ${configPath}`);
-  
+
   return {
     success: true,
     installed: agents.length,

package/install/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-byan-agent",
-  "version": "2.35.0",
+  "version": "2.37.1",
   "description": "BYAN - Intelligent AI agent installer with multi-platform native support (Claude Code, Codex/OpenCode)",
   "bin": {
     "create-byan-agent": "bin/create-byan-agent-v2.js"

package/install/packages/platform-config/lib/mcp-config.js

@@ -27,6 +27,13 @@ const path = require('path');
 const fs = require('fs-extra');
 
 const MCP_SERVER_REL_PATH = '_byan/mcp/byan-mcp-server/server.js';
+// Channel entrypoint: a SEPARATE MCP server (research preview) spawned by Claude
+// Code via --dangerously-load-development-channels. Same relative-path discipline
+// as the main server (relative to projectRoot, never absolute) so the entry is
+// portable across machines/OSes and stays valid when the repo is moved or shipped
+// via npm. The entry is INERT by default: registering it in .mcp.json does NOT
+// enable the channel (that needs the explicit --dangerously-load flag at launch).
+const MCP_CHANNEL_REL_PATH = '_byan/mcp/byan-mcp-server/channel-entry.js';
 const TOKEN_PLACEHOLDER = '${BYAN_API_TOKEN}';
 const LEANTIME_URL_PLACEHOLDER = '${LEANTIME_API_URL}';
 const LEANTIME_TOKEN_PLACEHOLDER = '${LEANTIME_API_TOKEN}';
@@ -87,15 +94,66 @@ function mergeByanEntry(existingConfig, { apiUrl, token } = {}) {
   delete env.BYAN_API_URL;
   delete env.BYAN_API_TOKEN;
 
+  // The canonical RELATIVE path is forced on `args` AFTER ...existing so it always
+  // wins -- this REPAIRS a stale entry that carried an absolute path (a pre-2.37.x
+  // install): relative survives a moved / npm-shipped repo, absolute does not, and
+  // Claude Code spawns the server with cwd=projectRoot so the relative path resolves
+  // identically. `command` is only F1-orthogonal (the interpreter, not a path), so a
+  // user-chosen command is preserved; we default to 'node' only when absent. Other
+  // pre-existing keys are still preserved.
   const entry = {
-    command: 'node',
-    args: [MCP_SERVER_REL_PATH],
     ...existing,
+    command: existing.command || 'node',
+    args: [MCP_SERVER_REL_PATH],
   };
   if (Object.keys(env).length > 0) entry.env = env;
   else delete entry.env;
 
   cfg.mcpServers.byan = entry;
+
+  // The channel entry is written alongside byan from the SAME merge so there is
+  // a single source of truth for the byan MCP registration. It is inert.
+  return mergeChannelEntry(cfg);
+}
+
+/**
+ * Pure merge — no I/O. Adds the `byan-channel` MCP server entry alongside byan.
+ *
+ * This entry is a Claude Code research-preview channel (CC v2.1.80+). It is
+ * INERT by default: present in .mcp.json but only loaded when the user launches
+ * with `claude --dangerously-load-development-channels server:byan-channel`.
+ * Registering it does NOT auto-activate anything — this function writes NO
+ * channelsEnabled / allowedChannelPlugins / --dangerously-load flag.
+ *
+ * Same portability discipline as the byan entry: a RELATIVE path (never
+ * absolute), no secret in env (the channel resolves its own config at boot via
+ * resolve-config.js: env -> ~/.byan/credentials.json -> defaults). An existing
+ * byan-channel entry is preserved (command/args/env) so the merge is idempotent.
+ *
+ * @param {object} existingConfig — current parsed config
+ * @returns {object} new merged config
+ */
+function mergeChannelEntry(existingConfig) {
+  const cfg = existingConfig && typeof existingConfig === 'object' ? { ...existingConfig } : {};
+  cfg.mcpServers = { ...(cfg.mcpServers || {}) };
+
+  const existing = cfg.mcpServers['byan-channel'] || {};
+
+  // The canonical RELATIVE path + the empty (secret-free) env are forced AFTER
+  // ...existing so they always win, normalizing a stale entry (absolute path, or
+  // a stray env) while preserving any other pre-existing key. env stays empty: the
+  // channel resolves BYAN_API_URL/TOKEN itself via resolve-config.js -- writing a
+  // secret here would land it in tracked git, and the channel has no legitimate
+  // env contract of its own (Leantime refs live on the byan entry). `command` is
+  // F1-orthogonal so a user-chosen interpreter is preserved, 'node' only as the
+  // default. Idempotent: re-running yields the same entry.
+  cfg.mcpServers['byan-channel'] = {
+    ...existing,
+    command: existing.command || 'node',
+    args: [MCP_CHANNEL_REL_PATH],
+    env: {},
+  };
+
   return cfg;
 }
 
@@ -141,14 +199,20 @@ function mergeLeantimeRefs(existingConfig) {
   env.LEANTIME_API_URL = LEANTIME_URL_PLACEHOLDER;
   env.LEANTIME_API_TOKEN = LEANTIME_TOKEN_PLACEHOLDER;
 
+  // Same discipline as mergeByanEntry: args forced to the canonical RELATIVE path
+  // (normalizes a stale absolute one), command preserved (F1-orthogonal), env
+  // carries the merged Leantime refs.
   cfg.mcpServers.byan = {
-    command: 'node',
-    args: [MCP_SERVER_REL_PATH],
     ...existing,
+    command: existing.command || 'node',
+    args: [MCP_SERVER_REL_PATH],
     env,
   };
 
-  return cfg;
+  // Keep the channel entry coherent with the byan entry: ensureLeantimeRefs runs
+  // after ensureMcpConfig in the installer, but routing through mergeChannelEntry
+  // here makes the byan-channel registration robust to call order (idempotent).
+  return mergeChannelEntry(cfg);
 }
 
 /**
@@ -252,12 +316,14 @@ module.exports = {
   ensureMcpConfig,
   readMcpConfig,
   mergeByanEntry,
+  mergeChannelEntry,
   mergeLeantimeRefs,
   ensureLeantimeRefs,
   addMcpEntry,
   removeMcpEntry,
   looksLikeSecret,
   MCP_SERVER_REL_PATH,
+  MCP_CHANNEL_REL_PATH,
   TOKEN_PLACEHOLDER,
   LEANTIME_URL_PLACEHOLDER,
   LEANTIME_TOKEN_PLACEHOLDER,

package/install/templates/.claude/CLAUDE.md

@@ -127,6 +127,7 @@ A confirm, a destructive prompt, or an obvious default is not a fork — emit
 ## Compact instructions
 
 Quand tu compactes cette conversation, PRESERVE en priorite :
+- le contrat de livraison par defaut (F1) : grade=PROD, scope=MAXIMAL, etalon de cout=AI-2026 (temps-agent x10, jamais temps-humain-a-la-main). Pas de proposition d'MVP/livrable-court/decoupage-pour-ne-pas-bloquer-le-lourd sauf opt-out explicite du message courant. Source : `_byan/_config/delivery-default.json` ; reinjecte chaque tour par `inject-delivery-default`.
 - l'etat FD BYAN actif s'il existe : phase courante, feature_name, le backlog avec le statut par item, le dernier verdict review/validate (source : `_byan-output/fd-state.json`).
 - la session Strict Mode active s'il y en a une : scope_hash, criteres d'acceptation, nombre de passes, completion (source : `.byan-strict/state.json` + API byan_web).
 - l'identite BYAN : le noyau immuable du soul + la voix tao (registre, signatures, tutoiement, zero emoji). `inject-tao` la reinjecte au SessionStart, mais garde la voix active dans le resume aussi.

package/install/templates/.claude/hooks/inject-delivery-default.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+/**
+ * UserPromptSubmit hook — BYAN delivery-default contract (F1).
+ *
+ * Injects, every turn, the baseline delivery posture: grade=PROD, scope=MAXIMAL,
+ * the AI-2026 cost yardstick (estimate in agent-time x10, never human-by-hand
+ * time), and the explicit ban on quietly proposing an MVP / short deliverable /
+ * a split that exists only to avoid doing the heavy part. This is the proactive
+ * twin of strict mode: strict locks a scope on demand, this sets the DEFAULT.
+ *
+ * Ships LIVE (unlike the F2 completeness reject and the F3 punt-guard, which
+ * ship disarmed): the anchor is pure injected context, it blocks nothing, so a
+ * false positive costs a few tokens — never a trapped turn or a blocked commit.
+ *
+ * The only escape is an explicit opt-out word the user types THIS message (mvp,
+ * quick, brouillon, ...). On opt-out the hook emits a single descope-authorized
+ * line instead of the full anchor, so the agent is told the contract is relaxed
+ * for this one request.
+ *
+ * Always exits 0; never blocks prompt submission.
+ */
+
+const { loadConfig, decideContext } = require('./lib/delivery-contract');
+const { readStdin, parseJson } = require('./lib/strict-runtime');
+
+if (require.main === module) {
+  (async () => {
+    let additionalContext = '';
+    try {
+      const projectRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+      const config = loadConfig(projectRoot);
+      const payload = parseJson(await readStdin());
+      const userMsg = payload.prompt || payload.user_prompt || payload.userPrompt || '';
+      additionalContext = decideContext({ userMsg, config }).text;
+    } catch {
+      // Never block prompt submission — degrade to no context.
+      additionalContext = '';
+    }
+    process.stdout.write(
+      JSON.stringify({
+        hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext },
+      })
+    );
+    process.exit(0);
+  })();
+}

package/install/templates/.claude/hooks/leantime-fd-sync.js

@@ -162,7 +162,18 @@ function logLine(entry) {
     if (createIntents.length && sidecar.projectId && timeLeft() > 0) {
       const results = await Promise.allSettled(
         createIntents.map((i) =>
-          lt.createTask({ projectId: sidecar.projectId, headline: i.headline }, opts).then((r) => ({ i, r })),
+          lt
+            .createTask(
+              {
+                projectId: sidecar.projectId,
+                headline: i.headline,
+                description: i.description,
+                priority: i.priority,
+                storypoints: i.storypoints,
+              },
+              opts,
+            )
+            .then((r) => ({ i, r })),
         ),
       );
       for (const s of results) {