create-claude-cabinet 0.47.0 → 0.49.0

package/lib/cli.js

@@ -3,9 +3,9 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 const crypto = require('crypto');
-const { copyTemplates, recordSkip, isProjectOwnedSeed, freezeRetain } = require('./copy');
-const { mergeSettings, healUserSettings, mergeWatchtowerHooks, mergeMuxHooks, mergeBashCompressHooks } = require('./settings-merge');
-const { create: createMetadata, read: readMetadata, readFrozenModules, setFrozenModules } = require('./metadata');
+const { copyTemplates, recordSkip, isProjectOwnedSeed, classifyFileOwnership } = require('./copy');
+const { mergeSettings, healUserSettings, mergeWatchtowerHooks, mergeMuxHooks, mergeBashCompressHooks, mergeCcDevHooks, mergeSkillOverrides } = require('./settings-merge');
+const { create: createMetadata, read: readMetadata, readFrozenModules, setFrozenModules, readMcpOptOut } = require('./metadata');
 const { setupDb, shouldSkipInit, readBundledSchemaVersion } = require('./db-setup');
 const { setupVerifyRuntime } = require('./verify-setup');
 const { setupSiteAuditRuntime } = require('./site-audit-setup');
@@ -442,281 +442,10 @@ function generateAgentWrappers(projectDir) {
   return wanted.size;
 }
 
-// MODULES is the manifest: every template path here is copied into a
-// consumer's project on install. A skill/hook/script that exists under
-// templates/ but is NOT listed in any module never ships — that is the
-// orphan bug that left the whole built-in-memory layer uninstalled
-// before v0.27.2 (test/manifest-integrity guards against recurrence).
-//
-// Intentional orphans (maintainer-only, must NOT ship to consumers) are
-// allowlisted in test/manifest-integrity. Currently: skills/cc-publish
-// (CC-source-repo release tooling, like scripts/migrate-all-consumers.js).
-const MODULES = {
-  'session-loop': {
-    name: 'Session Loop (orient + debrief)',
-    description: 'The briefing cycle. Claude starts each session informed, ends by preparing the next briefing.',
-    mandatory: true,
-    templates: [
-      'skills/orient',
-      'skills/orient-quick',
-      'skills/debrief',
-      'skills/debrief-quick',
-      'skills/session-handoff',
-      // Instruction phases — always ship, overriding the default skip-phases rule in copy.js
-      'skills/debrief/phases/audit-pattern-capture.md',
-      'skills/debrief/phases/methodology-capture.md',
-      'skills/debrief/phases/record-lessons.md',
-      'skills/debrief/phases/upstream-feedback.md',
-      'skills/debrief/phases/qa-handoff-sweep.md',
-      // Reversibility scaffolding (act:6fa60c7d) — standalone classic copies
-      // of orient/debrief, kept invokable so the orient/debrief retirement is
-      // reversible during the watchtower transition. They do NOT delegate to
-      // the live orient/debrief (which will change at retirement); they ARE
-      // the old skills under a new name. orient-classic ships SKILL.md only
-      // (its phases use skeleton defaults, like live orient); debrief-classic
-      // ships its SKILL.md + the same instruction phases as live debrief.
-      'skills/orient-classic',
-      'skills/debrief-classic',
-      'skills/debrief-classic/phases/audit-pattern-capture.md',
-      'skills/debrief-classic/phases/methodology-capture.md',
-      'skills/debrief-classic/phases/record-lessons.md',
-      'skills/debrief-classic/phases/upstream-feedback.md',
-      'skills/debrief-classic/phases/qa-handoff-sweep.md',
-      'skills/menu',
-    ],
-  },
-  'hooks': {
-    name: 'Git Guardrails + Telemetry',
-    description: 'Block destructive git ops (force push, hard reset). Track skill usage via JSONL telemetry.',
-    mandatory: false,
-    default: true,
-    lean: true,
-    templates: ['hooks/git-guardrails.sh', 'hooks/cc-upstream-guard.sh', 'hooks/skill-telemetry.sh', 'hooks/skill-tool-telemetry.sh', 'hooks/work-tracker-guard.sh', 'hooks/action-quality-gate.sh', 'hooks/action-completion-gate.sh', 'hooks/memory-index-guard.sh', 'scripts/cc-drift-check.cjs', 'scripts/skill-usage.mjs'],
-  },
-  'work-tracking': {
-    name: 'Work Tracking (pib-db or markdown)',
-    description: 'Track work items for orient/debrief. Default: SQLite (pib-db). Also supports markdown (tasks.md) or external systems. Choice made during /onboard.',
-    mandatory: false,
-    default: true,
-    lean: false,
-    templates: ['scripts/pib-db.mjs', 'scripts/pib-db-path.mjs', 'scripts/pib-db-lib.mjs', 'scripts/pib-db-mcp-server.mjs', 'scripts/pib-db-schema.sql', 'scripts/work-tracker-server.mjs', 'scripts/work-tracker-ui.html', 'skills/work-tracker', 'skills/spring-clean'],
-    needsDb: true,
-  },
-  'planning': {
-    name: 'Planning + Execution (plan + execute)',
-    description: 'Structured planning with cabinet critique — members weigh in before you build.',
-    mandatory: false,
-    default: true,
-    lean: true,
-    templates: ['skills/plan', 'skills/execute', 'skills/execute/phases/post-impl-checklist.md', 'skills/debrief/phases/checklist-feedback.md', 'skills/checklist-discover', 'skills/generate-plan-groups', 'skills/execute-group', 'workflows/execute-group-implement.js', 'workflows/execute-group-complete.js', 'skills/investigate', 'cabinet/checkpoint-protocol.md', 'cabinet/worktree-invocation-contract.md', 'cabinet/elicitation-methods.md', 'cabinet/qa-dimensions-template.yaml', 'cabinet/checklist-stats-schema.md', 'scripts/qa-dimensions-validator.cjs', 'skills/orient/phases/checklist-status.md', 'skills/audit/phases/checklist-pruning.md'],
-  },
-  'compliance': {
-    name: 'Compliance Stack (rules + enforcement)',
-    description: 'Scoped instructions that load by path. Enforcement pipeline for promoting patterns to rules.',
-    mandatory: false,
-    default: true,
-    lean: false,
-    templates: ['rules/enforcement-pipeline.md', 'rules/maintainability.md', 'rules/markdown-prose.md', 'rules/verify-before-asserting.md', 'rules/plan-before-bulk-or-irreversible-actions.md', 'rules/acknowledge-when-corrected.md', 'skills/unwrap', 'memory/patterns/_pattern-template.md', 'memory/patterns/pattern-intelligence-first.md'],
-  },
-  'memory': {
-    name: 'Built-In Memory (cc-remember + reader + validator)',
-    description: 'Curated write/validate layer over Claude Code\'s built-in file memory. /cc-remember writes indexed memories, /memory browses them, validate-memory.mjs guards MEMORY.md integrity. Replaced the retired omega engine in v0.27.',
-    mandatory: false,
-    default: true,
-    // lean:true is load-bearing — it keeps the skill triad, scripts, and
-    // rule installing together as an atomic unit. compliance is lean:false,
-    // so the memory-capture rule must NOT live there or lean installs get a
-    // partial, incoherent set.
-    lean: true,
-    templates: [
-      'skills/cc-remember',
-      'skills/memory',
-      'rules/memory-capture.md',
-      'cabinet/memory-lifecycle-contract.md',
-      'scripts/write-memory-file.mjs',
-      'scripts/validate-memory.mjs',
-      // project-context.cjs ships as a co-located sibling: the two .mjs
-      // scripts require('./project-context.cjs') and consumers have no lib/.
-      'scripts/project-context.cjs',
-    ],
-  },
-  'audit': {
-    name: 'Audit Loop (audit + triage + cabinet)',
-    description: '27 expert cabinet members review your project. Convene the full cabinet or just one committee.',
-    mandatory: false,
-    default: true,
-    lean: true,
-    templates: [
-      'skills/audit', 'skills/pulse', 'skills/triage-audit', 'skills/cabinet',
-      'cabinet', 'briefing',
-      'skills/cabinet-accessibility', 'skills/cabinet-anti-confirmation',
-      'skills/cabinet-architecture', 'skills/cabinet-automation',
-      'skills/cabinet-boundary-man',
-      'skills/cabinet-anthropic-insider', 'skills/cabinet-cc-health',
-      'skills/cabinet-data-integrity',
-      'skills/cabinet-debugger', 'skills/cabinet-deployment',
-      'skills/cabinet-historian',
-      'skills/cabinet-organized-mind', 'skills/cabinet-process-therapist',
-      'skills/cabinet-qa', 'skills/cabinet-record-keeper',
-      'skills/cabinet-roster-check', 'skills/cabinet-security',
-      'skills/cabinet-seo',
-      'skills/cabinet-small-screen', 'skills/cabinet-speed-freak',
-      'skills/cabinet-system-advocate', 'skills/cabinet-technical-debt',
-      'skills/cabinet-usability', 'skills/cabinet-workflow-cop',
-      'skills/cabinet-framework-quality', 'skills/cabinet-goal-alignment',
-      'skills/cabinet-information-design', 'skills/cabinet-mantine-quality',
-      'skills/cabinet-ui-experimentalist', 'skills/cabinet-user-advocate',
-      'skills/cabinet-vision',
-      'skills/cabinet-narrative-architect', 'skills/cabinet-interactive-storyteller',
-      'skills/cabinet-elegance',
-      'scripts/merge-findings.js', 'scripts/load-triage-history.js',
-      'scripts/pib-db-path.mjs', // load-triage-history.js imports it (declared cross-module dep; also shipped by work-tracking)
-      'scripts/triage-server.mjs', 'scripts/triage-ui.html',
-      'scripts/finding-schema.json', 'scripts/resolve-committees.cjs',
-      'scripts/review-server.mjs', 'scripts/review-ui.html',
-      'workflows/deliberative-audit.js', 'cabinet/critique-contract.md',
-    ],
-  },
-  'lifecycle': {
-    name: 'Lifecycle (onboard + seed + cc-upgrade + link)',
-    description: 'Onboarding prepares the briefings. Seed proposes new cabinet members when you adopt new tech.',
-    mandatory: false,
-    default: true,
-    lean: true,
-    templates: ['skills/onboard', 'skills/seed', 'skills/cc-upgrade', 'skills/cc-link', 'skills/cc-unlink', 'skills/cc-extract', 'skills/cc-feedback', 'cabinet/elicitation-methods.md'],
-  },
-  'validate': {
-    name: 'Validate',
-    description: 'Structural validation checks with unified summary. Define your own validators.',
-    mandatory: false,
-    default: true,
-    lean: false,
-    templates: ['skills/validate', 'scripts/skill-validator.sh'],
-  },
-  'verify': {
-    name: 'Verification Harness (Cucumber + Playwright)',
-    description: 'Walkthrough verification with human-in-the-loop verdict pauses. Replaces flat AC lists with re-runnable user-journey scenarios. Includes /verify skeleton skill + cabinet-verify npm runtime + opt-in integration phases for /plan, /execute, /debrief.',
-    mandatory: false,
-    default: false,
-    lean: false,
-    templates: [
-      'skills/verify',
-      'skills/plan/phases/verify-plan.md',
-      'skills/execute/phases/verify-emit.md',
-      'skills/debrief/phases/verify-coverage.md',
-      'skills/orient/phases/verify-backfill.md',
-    ],
-    postInstall: 'verify-setup',
-  },
-  'site-audit': {
-    name: 'Site Audit (deployed-site quality)',
-    description: '14-check audit for deployed websites: performance, accessibility (3 engines), security, SEO, DNS, privacy, sustainability. Standalone HTML report + comparison mode.',
-    mandatory: false,
-    default: false,
-    lean: false,
-    templates: [
-      'skills/cc-site-audit',
-      'site-audit-runtime',
-    ],
-    postInstall: 'site-audit-setup',
-  },
-  engagement: {
-    name: 'Engagement management (with secure credential handoff)',
-    description: 'Ongoing client-engagement management built on pib-db: per-recipient packets (rendered projections of the work backlog), role-gated billing, client feedback flowing back as events, and secure credential handoff (encrypted capture via OS dialog, pluggable email/MCP/file transport). Three primary skills across consultant and client sides, plus redirect stubs. Requires work-tracking (the pib-db adapter is the engine\'s data source).',
-    mandatory: false,
-    default: false,
-    lean: false,
-    requires: ['work-tracking'],
-    postInstall: 'engagement-setup',
-    templates: [
-      'skills/collab-client',
-      'skills/collab-consultant',
-      'skills/engagement-help',
-      'skills/engagement-create',
-      'skills/setup-accounts',
-      'skills/guide',
-      'engagement',
-    ],
-  },
-  watchtower: {
-    name: 'Watchtower (continuous background state)',
-    description: 'Replaces orient/debrief with continuous background processing. Three rings (mechanical cron, Claude intelligence, session-aware), ambient state injection via SessionStart hook, and an inbox for extracted knowledge and signals. Sessions start informed with minimal context cost.',
-    mandatory: false,
-    default: false,
-    lean: false,
-    templates: [
-      'scripts/watchtower-validate.mjs',
-      'cabinet/watchtower-contracts.md',
-      'scripts/watchtower-lib.mjs',
-      'scripts/watchtower-queue.mjs',
-      'scripts/watchtower-routines.mjs',
-      'scripts/watchtower-hook-runner.mjs',
-      'scripts/watchtower-phase-shim.mjs',
-      'scripts/watchtower-sync.mjs',
-      'scripts/watchtower-advisories.mjs',
-      'cabinet/advisories-state-schema.md',
-      'skills/inbox',
-      'hooks/watchtower-session-start.sh',
-      'scripts/watchtower-build-context.mjs',
-      'scripts/watchtower-snapshot.mjs',
-      'scripts/watchtower-narrative-corpus.mjs',
-      'scripts/watchtower-cross-ring-reader.mjs',
-      'scripts/watchtower-ring1.mjs',
-      'scripts/watchtower-ring1-runner.sh',
-      'skills/watchtower',
-      'watchtower/com.claude-cabinet.watchtower-ring1.plist',
-      'watchtower/watchtower-ring1.service',
-      'watchtower/watchtower-ring1.timer',
-      'scripts/watchtower-ring2.mjs',
-      'scripts/watchtower-ring2-runner.sh',
-      'watchtower/com.claude-cabinet.watchtower-ring2-fast.plist',
-      'watchtower/com.claude-cabinet.watchtower-ring2-slow.plist',
-      'watchtower/watchtower-ring2-fast.service',
-      'watchtower/watchtower-ring2-fast.timer',
-      'watchtower/watchtower-ring2-slow.service',
-      'watchtower/watchtower-ring2-slow.timer',
-      'hooks/watchtower-session-end.sh',
-      'scripts/watchtower-ring3-close.mjs',
-      'scripts/watchtower-ring4.mjs',
-      'scripts/watchtower-ring4-runner.sh',
-      'scripts/watchtower-status.sh',
-      'skills/briefing',
-      'skills/threads',
-      'skills/catch-up',
-      'skills/qa-handoff',
-      'skills/qa-drain',
-      'skills/close',
-    ],
-  },
-  mux: {
-    name: 'Mux (tmux project manager)',
-    description: 'Multi-project terminal manager. Desks (tmux sessions), auto-worktrees, trail logging, sticky notes, portal color-switching, and an MCP server for Claude. Installs to user-level paths (~/.local/bin/, ~/.config/mux/).',
-    mandatory: false,
-    default: false,
-    lean: false,
-    postInstall: 'mux-setup',
-    templates: ['skills/orient/phases/dx-captures.md', 'skills/dx-feedback'],
-  },
-  'engagement-server': {
-    name: 'Engagement Server',
-    description: 'Central multi-engagement API server. Deploys once to Railway/Fly, serves all client engagements. User-level infrastructure.',
-    mandatory: false,
-    default: false,
-    lean: false,
-    requires: ['engagement', 'work-tracking'],
-    postInstall: 'engagement-server-setup',
-    templates: [],
-  },
-  'bash-compress': {
-    name: 'Bash Output Compression Hook',
-    description: 'PostToolUse hook that compresses noisy Bash stdout (git status walls, npm/yarn install output, find/ls dumps) to reclaim context in long sessions. Off by default. stderr and error/warning lines pass through verbatim; every rewrite carries a visible [compressed] marker; fail-open on any error. Requires the hooks module (it wires into .claude/settings.json).',
-    mandatory: false,
-    default: false,
-    lean: false,
-    requires: ['hooks'],
-    templates: ['hooks/bash-output-compress.sh'],
-  },
-};
+// The MODULES manifest (the module → template-path registry) lives in its
+// own file so this ~2000-line orchestrator stays navigable (architecture-0005).
+// Re-exported below for back-compat with importers of `require('../lib/cli').MODULES`.
+const { MODULES } = require('./modules');
 
 /** Recursively collect all relative file paths under a directory. */
 function walkDir(dir, base) {
@@ -822,6 +551,35 @@ function computeRemovals({ existingManifest, allManifest, selectedModules, templ
   return { toRemove, kept };
 }
 
+// Merge CC-shipped MCP server entries into a consumer's .mcp.json mcpServers
+// object, honoring the .ccrc.json `mcpOptOut` list (act:b770c323). Pure and
+// mutating-in-place on `existing` (the caller serializes the parent object):
+//   - incoming keys NOT opted out are set/overwritten (the prior Object.assign
+//     behavior) and reported in `added`;
+//   - incoming keys the consumer opted out are never added (`skipped`);
+//   - an opted-out key already present in `existing` is DELETED (`removed`) —
+//     self-heal toward the declared intent, but ONLY for keys CC itself ships
+//     (in `incoming`), so a consumer's hand-added servers are never touched.
+function mergeMcpServers(existing, incoming = {}, optOut = []) {
+  const optedOut = new Set(optOut);
+  const added = [];
+  const removed = [];
+  const skipped = [];
+  for (const [key, value] of Object.entries(incoming)) {
+    if (optedOut.has(key)) {
+      skipped.push(key);
+      if (Object.prototype.hasOwnProperty.call(existing, key)) {
+        delete existing[key];
+        removed.push(key);
+      }
+      continue;
+    }
+    existing[key] = value;
+    added.push(key);
+  }
+  return { added, removed, skipped };
+}
+
 // Signals that a directory contains a real project (not just empty)
 const PROJECT_SIGNALS = [
   'package.json', 'Cargo.toml', 'requirements.txt', 'pyproject.toml',
@@ -961,6 +719,42 @@ function printHelp() {
 `);
 }
 
+// --- advisories-state gitignore seeding (act:c008862c) ---
+// .claude/cabinet/advisories-state.json is machine-written runtime state
+// (the advisory pass rewrites it), so tracked it churns every commit and
+// reads as authored work in mux worktrees. FRESH installs (no prior
+// .ccrc.json) seed a .gitignore entry so it never enters git; existing
+// installs are left untouched — untracking a live consumer repo is
+// operator-gated — but a TRACKED copy is reported so the consumer walk
+// surfaces it. Pure and injectable for tests.
+const ADVISORIES_STATE_PATH = '.claude/cabinet/advisories-state.json';
+function seedAdvisoriesGitignore(projectDir, { fresh, dryRun, exec } = {}) {
+  const run = exec || ((cmd) => require('child_process').execSync(cmd, { cwd: projectDir, stdio: 'pipe' }));
+  try {
+    run(`git ls-files --error-unmatch ${ADVISORIES_STATE_PATH}`);
+    return { status: 'tracked-reported' };
+  } catch { /* not tracked — fall through */ }
+  if (!fresh) return { status: 'skipped-existing-install' };
+  try {
+    run('git rev-parse --git-dir');
+  } catch {
+    return { status: 'skipped-no-git' };
+  }
+  try {
+    // Already ignored by ANY rule (exact line or a covering glob like this
+    // repo's `.claude/cabinet/*`) — nothing to add.
+    run(`git check-ignore -q ${ADVISORIES_STATE_PATH}`);
+    return { status: 'already-present' };
+  } catch { /* not ignored — seed below */ }
+  const giPath = path.join(projectDir, '.gitignore');
+  let content = '';
+  try { content = fs.readFileSync(giPath, 'utf8'); } catch { /* no .gitignore yet */ }
+  if (dryRun) return { status: 'would-seed' };
+  const nl = content && !content.endsWith('\n') ? '\n' : '';
+  fs.appendFileSync(giPath, `${nl}# machine-written advisory-dismissal state (CC)\n${ADVISORIES_STATE_PATH}\n`);
+  return { status: 'seeded' };
+}
+
 async function run() {
   const flags = parseArgs(process.argv);
 
@@ -1463,69 +1257,88 @@ async function run() {
         const incoming = fs.readFileSync(srcPath, 'utf8');
         const incomingHash = hashContent(incoming);
         const mPath = manifestPath(tmpl);
+        const destExists = fs.existsSync(destPath);
+        const existingContent = destExists ? fs.readFileSync(destPath, 'utf8') : null;
+        // Instruction phases explicitly listed in MODULES are CC-owned and must
+        // always overwrite (they're not customizable); other phase files are
+        // preserved when the operator has edited them.
+        const isPhaseFile = tmpl.includes('/phases/') || tmpl.includes('\\phases\\');
+        const isInstructionPhase = isPhaseFile && mod.templates.includes(tmpl);
+
+        // Single decision spine — the ownership cascade lives in copy.js
+        // (classifyFileOwnership) so this branch can't drift from the directory
+        // walk. The leak this closes: the hand-inlined copy here was missing
+        // the project-owned-seed guard (elegance-0002, act:a6377c82).
+        const decision = classifyFileOwnership({
+          relPath: tmpl,
+          destExists,
+          existingContent,
+          incoming,
+          isPhaseFile,
+          isInstructionPhase,
+          frozen,
+          isCcOwned: Boolean(existingManifest[mPath]),
+          skipConflicts: flags.yes || dirState === 'existing-install',
+        });
 
-        if (fs.existsSync(destPath)) {
-          const existingContent = fs.readFileSync(destPath, 'utf8');
-          if (existingContent === incoming) {
+        switch (decision.action) {
+          case 'seed':
+            // Project-owned seed (act:2001bf54): seed if absent, NEVER
+            // overwrite, ALWAYS omit from the manifest.
+            if (!destExists) {
+              if (!flags.dryRun) fs.copyFileSync(srcPath, destPath);
+              totalCopied++;
+            } else {
+              totalSkipped++;
+            }
+            recordSkip(allManifest, mPath);
+            continue;
+          case 'preserve-phase':
+            console.log(`  Preserved customized phase: ${tmpl}`);
+            totalSkipped++;
+            recordSkip(allManifest, mPath);
+            continue;
+          case 'skip-identical':
             totalSkipped++;
             recordSkip(allManifest, mPath, { identical: true, incomingHash });
             continue;
-          }
-
-          // Phase file customization guard — mirrors copy.js:48-59 for the
-          // single-file install path. If the destination path is a phase
-          // file and the on-disk content differs from upstream (operator
-          // edited it), preserve it. This keeps the documented "customize
-          // by editing the phase file" affordance intact across upgrades.
-          // Exception: instruction phases explicitly listed in MODULES are
-          // CC-owned and must always overwrite (they're not customizable).
-          const isPhaseFile = tmpl.includes('/phases/') || tmpl.includes('\\phases\\');
-          const isInstructionPhase = isPhaseFile && mod.templates.includes(tmpl);
-          if (isPhaseFile && !isInstructionPhase && existingContent.trim() !== '' && existingContent.trim() !== incoming.trim()) {
-            console.log(`  Preserved customized phase: ${tmpl}`);
+          case 'freeze-hold':
+            totalSkipped++;
+            frozenCounts[modKey] = (frozenCounts[modKey] || 0) + 1;
+            allManifest[mPath] = decision.manifestHash;
+            console.log(`  ❄ Frozen (held): ${path.relative(projectDir, destPath)}`);
+            continue;
+          case 'overwrite':
+            if (!flags.dryRun) fs.copyFileSync(srcPath, destPath);
+            totalOverwritten++;
+            // Log single-file overwrites too — the directory path (copy.js)
+            // already does. Without this, scripts/ updates are invisible in
+            // install output, masking whether a changed script propagated.
+            console.log(`  Updated: ${path.relative(projectDir, destPath)}`);
+            allManifest[mPath] = incomingHash;
+            continue;
+          case 'skip-omit':
             totalSkipped++;
-            // Customized phase = project-owned content → omit from manifest
-            // (recordSkip in copy.js — omission means "not ours").
+            // Project-created file → omit from manifest entirely. Ownership
+            // classification is manifest-PRESENCE-based, so recording ANY hash
+            // here would mark the file upstream-owned and the NEXT install
+            // would silently overwrite it (act:bf21c95b).
             recordSkip(allManifest, mPath);
             continue;
-          }
-
-          // Frozen module (act:c1013967): held instead of overwritten. Mirrors
-          // copy.js's directory path via the shared freezeRetain rule — retain
-          // at the on-disk hash only if already CC-owned; a project-owned file
-          // falls through to the normal skip-and-omit path below.
-          if (frozen) {
-            const decision = freezeRetain({ existing: existingContent, isCcOwned: Boolean(existingManifest[mPath]) });
-            if (decision.manifestHash) {
-              totalSkipped++;
-              frozenCounts[modKey] = (frozenCounts[modKey] || 0) + 1;
-              allManifest[mPath] = decision.manifestHash;
-              console.log(`  ❄ Frozen (held): ${path.relative(projectDir, destPath)}`);
-              continue;
-            }
-            // decision.omit → project-owned; fall through.
-          }
-
-          if (flags.yes || dirState === 'existing-install') {
-            // If file is in the old manifest, it's upstream-managed — overwrite.
-            // If not, it's project-created — skip.
-            if (existingManifest[mPath]) {
-              if (!flags.dryRun) fs.copyFileSync(srcPath, destPath);
-              totalOverwritten++;
-              // Log single-file overwrites too — the directory path (copy.js)
-              // already does. Without this, scripts/ updates are invisible in
-              // install output, masking whether a changed script propagated.
-              console.log(`  Updated: ${path.relative(projectDir, destPath)}`);
-              allManifest[mPath] = incomingHash;
-            } else {
-              totalSkipped++;
-              // Project-created file → omit from manifest entirely. Ownership
-              // classification is manifest-PRESENCE-based, so recording ANY
-              // hash here would mark the file upstream-owned and the NEXT
-              // install would silently overwrite it (act:bf21c95b).
-              recordSkip(allManifest, mPath);
-            }
-          } else {
+          case 'freeze-hold-new':
+            // New file in a frozen module: hold it back (don't create) so the
+            // module stays internally consistent at its pinned version. Report
+            // only — never a manifest entry (no on-disk content to hash).
+            frozenCounts[modKey] = (frozenCounts[modKey] || 0) + 1;
+            console.log(`  ❄ Frozen (held new): ${path.relative(projectDir, destPath)}`);
+            continue;
+          case 'copy-new':
+            if (!flags.dryRun) fs.copyFileSync(srcPath, destPath);
+            totalCopied++;
+            allManifest[mPath] = incomingHash;
+            continue;
+          case 'prompt':
+          default: {
             const response = await prompts({
               type: 'select',
               name: 'action',
@@ -1546,19 +1359,8 @@ async function run() {
               // the manifest so it is never mistaken for upstream content.
               recordSkip(allManifest, mPath);
             }
-          }
-        } else {
-          // New file in a frozen module: hold it back (don't create) so the
-          // module stays internally consistent at its pinned version. Report
-          // only — never a manifest entry (no on-disk content to hash).
-          if (frozen) {
-            frozenCounts[modKey] = (frozenCounts[modKey] || 0) + 1;
-            console.log(`  ❄ Frozen (held new): ${path.relative(projectDir, destPath)}`);
             continue;
           }
-          if (!flags.dryRun) fs.copyFileSync(srcPath, destPath);
-          totalCopied++;
-          allManifest[mPath] = incomingHash;
         }
       }
     }
@@ -1619,6 +1421,27 @@ async function run() {
       mergeBashCompressHooks(settingsPath);
       console.log('  ⚙️  Registered bash-output compression PostToolUse hook');
     }
+
+    // Repo-local maintainer hooks — no-op unless this IS the CC source repo
+    // (dogfood). Registers the node --check PostToolUse gate durably so a
+    // reinstall can't silently regenerate it away (architecture-0004).
+    if (mergeCcDevHooks(projectDir)) {
+      console.log('  ⚙️  Registered repo-local node --check PostToolUse hook (CC source repo)');
+    }
+
+    // cabinet-* skills are ~half the skill-listing budget and are spawned by
+    // agentType (name), never auto-invoked by description — so set them
+    // "name-only" to free budget for the routing skills that need full trigger
+    // keywords (act:bee0fa16). Only-if-absent, so a user override is preserved.
+    if (selectedModules.includes('audit')) {
+      const cabinetSkills = (MODULES.audit.templates || [])
+        .map((t) => (t.match(/^skills\/(cabinet-[^/]+)$/) || [])[1])
+        .filter(Boolean);
+      const added = mergeSkillOverrides(projectDir, cabinetSkills);
+      if (added > 0) {
+        console.log(`  ⚙️  Set ${added} cabinet-* skill${added === 1 ? '' : 's'} to name-only (frees skill-listing budget)`);
+      }
+    }
   }
 
   // --- Heal user-level ~/.claude/settings.json ---
@@ -1648,9 +1471,22 @@ async function run() {
           existing = {};
         }
         if (!existing.mcpServers) existing.mcpServers = {};
-        Object.assign(existing.mcpServers, mcpConfig.mcpServers);
-        fs.writeFileSync(mcpJsonPath, JSON.stringify(existing, null, 2) + '\n');
-        console.log(`  🔌 Merged pib-db MCP server into .mcp.json`);
+        const optOut = readMcpOptOut(projectDir);
+        const { added, removed, skipped } = mergeMcpServers(existing.mcpServers, mcpConfig.mcpServers, optOut);
+        // Only write when this merge actually contributed or healed something —
+        // an all-opted-out install must not reformat a consumer's .mcp.json.
+        if (added.length > 0 || removed.length > 0) {
+          fs.writeFileSync(mcpJsonPath, JSON.stringify(existing, null, 2) + '\n');
+        }
+        if (added.length > 0) {
+          console.log(`  🔌 Merged ${added.join(', ')} MCP server into .mcp.json`);
+        }
+        if (skipped.length > 0) {
+          console.log(`  ⏭  MCP registration declined by .ccrc.json mcpOptOut: ${skipped.join(', ')}`);
+        }
+        if (removed.length > 0) {
+          console.log(`  🧹 Removed opted-out MCP entr${removed.length === 1 ? 'y' : 'ies'} from .mcp.json: ${removed.join(', ')}`);
+        }
       }
     } catch (err) {
       console.log(`  ⚠ MCP config merge failed: ${err.message}`);
@@ -1874,6 +1710,23 @@ async function run() {
     }
   }
 
+  // --- Seed advisories-state gitignore (fresh installs only; act:c008862c) ---
+  try {
+    const seedResult = seedAdvisoriesGitignore(projectDir, {
+      fresh: dirState !== 'existing-install',
+      dryRun: !!flags.dryRun,
+    });
+    if (seedResult.status === 'seeded') {
+      console.log('  🙈 Gitignored .claude/cabinet/advisories-state.json (machine-written state)');
+    } else if (seedResult.status === 'would-seed') {
+      console.log('  [dry run] Would gitignore .claude/cabinet/advisories-state.json');
+    } else if (seedResult.status === 'tracked-reported') {
+      console.log('  ℹ .claude/cabinet/advisories-state.json is TRACKED in this repo — left untouched. Untracking (git rm --cached) is an operator call; tracked, it churns every commit.');
+    }
+  } catch (err) {
+    console.log(`  ⚠ advisories-state gitignore seeding skipped: ${err.message}`);
+  }
+
   // --- Write metadata ---
   if (!flags.dryRun) {
     createMetadata(projectDir, {
@@ -1967,4 +1820,4 @@ async function run() {
   console.log('');
 }
 
-module.exports = { run, MODULES, generateAgentWrappers, generateSkillIndex, expandFrozenClosure, computeRemovals, manifestPath };
+module.exports = { run, MODULES, generateAgentWrappers, generateSkillIndex, expandFrozenClosure, computeRemovals, mergeMcpServers, manifestPath, seedAdvisoriesGitignore };