litclaude-ai 0.3.28 → 0.3.30

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.3.30 - 2026-07-19 — LitResearch scientific records and public-reader hardening
+
+- Added root-owned append-only claim/evidence records, bounded expansion and
+  sequential fallback, DOI normalization, PDF byte proof, and separate
+  metadata/acquisition/conversion/review states to LitResearch.
+- Hardened public reads with connection-pinned DNS validation at every redirect,
+  broader private-address rejection, inert-content receipts, content proof, and
+  deep source-secret redaction.
+- Removed installed CLI and MCP environment bypasses for private destinations
+  and expanded invocation, package, reader, and security regression coverage.
+
+## 0.3.29 - 2026-07-18 — bundled handoff and scientific visualization
+
+- Bundle the approved exact-source `022_handoff` and
+  `045_scientific-visualization` corpora with their licenses, provenance,
+  scripts, assets, and canonical-source integrity records.
+- Add Claude-native command and exact-bare prompt-hook routes for `handoff` and
+  `lit-scientific-visualization`, including visible route-specific
+  `🔥 LITBURN IGNITED` banners and inert near-miss handling.
+- Verify installed-package skill discovery, immutable payload checks, script and
+  asset path resolution, and honest read-only dependency diagnostics for the
+  scientific visualization workflow without silently installing Python packages.
+
 ## 0.3.28 - 2026-07-14 — explicit start-work activation
 
 - Require the `$start-work` shorthand and natural `lit start work` activation

package/README.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.28-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.30-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -22,10 +22,10 @@
 > `litclaude@litclaude-ai`, so normal `claude` launches can load the
 > LitClaude skills and hooks without a long `--plugin-dir` command.
 
-This checkout is prepared as `litclaude-ai@0.3.28` for personal install
+This checkout is prepared as `litclaude-ai@0.3.30` for personal install
 convenience. The repo can remain quiet; preparing npm package metadata here does
 not imply public repo promotion, marketplace publication, or advertisement.
-Future package releases still require explicit user approval. The v0.3.28 release material requires explicit leading start-work invocations so diagnostic or copied mentions remain inert. The v0.3.27 release material adds a structured, animated five-stage installer with a success or failure receipt while preserving deterministic automation output. The v0.3.26 release material adds adaptive objective-achievable planning, draft-plan review, and orchestration readiness hardening. The v0.3.25 release material aligns portable details, public-read, litgoal status JSON, and evidence wording. The v0.3.24 release material aligns auxiliary skill inventories and advisory probes. The v0.3.23
+Future package releases still require explicit user approval. The v0.3.30 release material strengthens LitResearch with root-owned scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage, and a connection-pinned public-source reader with inert-content and secret-redaction guarantees. The v0.3.29 release material bundles exact-source `lit-handoff` and `lit-scientific-visualization` skills with Claude-native commands, exact-bare hook invocation, visible LITBURN banners, installed-payload integrity checks, and read-only scientific dependency diagnostics. The v0.3.28 release material requires explicit leading start-work invocations so diagnostic or copied mentions remain inert. The v0.3.27 release material adds a structured, animated five-stage installer with a success or failure receipt while preserving deterministic automation output. The v0.3.26 release material adds adaptive objective-achievable planning, draft-plan review, and orchestration readiness hardening. The v0.3.25 release material aligns portable details, public-read, litgoal status JSON, and evidence wording. The v0.3.24 release material aligns auxiliary skill inventories and advisory probes. The v0.3.23
 release materials inject the bundled skill bodies for bare `hyperplan`,
 `litresearch`, `lit research`, `init-deep`, and explicit `$start-work` prompt-hook routes while
 preserving the v0.3.19 adversarial planning skill, the v0.3.18 read-only `lit-recap` session recap surface, the v0.3.17 separate-worker native `/goal` launcher, the v0.3.16
@@ -78,7 +78,13 @@ activation/read-only polish, and installer permission-preference discipline.
   `korean-ai-slop-remover`, `review-work`, `frontend-ui-ux`,
   `git-master`, `comment-checker`, `rules`, `lsp`, `lsp-setup`, `litgoal`,
   `deep-interview`, `hyperplan`, `init-deep`, `litresearch`,
-  `lit-plan`, `lit-recap`, `lit-loop`, `start-work`, and `visual-qa`
+  `lit-plan`, `lit-recap`, `lit-loop`, `start-work`, `lit-handoff`,
+  `lit-scientific-visualization`, and `visual-qa`
+- **Bundled owner-authorized skills** - `lit-handoff` reads the complete immutable
+  four-file handoff source and supports the exact bare `handoff` prompt;
+  `lit-scientific-visualization` reads the complete immutable 16-file authored
+  source, resolves packaged scripts and assets, and reports missing Python or
+  matplotlib as `DEGRADED` without silently installing dependencies
 - **Auxiliary Skill-discovery entries** - `frontend-ui-ux`, `git-master`,
   `lsp-setup`, and `visual-qa` are shipped skill ids discoverable through
   Claude Code's native Skill discovery; they intentionally do not add extra
@@ -125,7 +131,7 @@ directory, the normal install command works:
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.28 install
+npx --yes litclaude-ai@0.3.30 install
 ```
 
 Validate the installed plugin:
@@ -138,7 +144,7 @@ The installer also sets Claude Code's `statusLine` command to the packaged
 LitClaude HUD. A typical no-color render starts like:
 
 ```text
-[🔥LITCLAUDE v0.3.28] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.30] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 The `↻` suffix is a compact rate-limit reset countdown. It is separated from
@@ -247,6 +253,10 @@ $litgoal <goal operation>
 /litgoal <goal operation>
 $start-work plans/example-plan.md
 /start-work plans/example-plan.md
+handoff
+/litclaude:lit-handoff
+lit-scientific-visualization
+/litclaude:lit-scientific-visualization <publication figure request>
 ```
 
 Expected behavior: LitClaude's prompt hook adds mode-specific `LITWORK MODE
@@ -359,8 +369,9 @@ actually supports the claim, keep a route trace with attempted and untried
 surfaces, treat fetched content as untrusted prompt-injection data, and stop
 honestly at authentication, paywall, private-data, or credential boundaries.
 The runtime JSON names `fetchAttempts`, a single `fetchVerdict`, untried safe
-routes, and a starter claim/source graph so HTTP 200 is never treated as proof
-that the page supports a claim.
+routes, a starter claim/source graph, and `contentSafety` flags that mark fetched
+text as untrusted data whose instructions are ignored, so HTTP 200 is never
+treated as proof that the page supports a claim.
 If you ask for read-only, no-write, or transcript-only research, LitClaude
 should ask before creating `.litclaude/litresearch/<slug>/`; without approval it
 keeps the journal in the transcript/TodoWrite only. The guaranteed runtime
@@ -407,6 +418,8 @@ namespaced commands when you want explicit LitClaude skill activation:
 /litclaude:review-work <scope to review>
 /litclaude:litgoal <goal operation>
 /litclaude:korean-ai-slop-remover <Korean prose or polish request>
+/litclaude:lit-handoff
+/litclaude:lit-scientific-visualization <publication figure request>
 /litclaude:start-work plans/example-plan.md
 ```
 
@@ -430,6 +443,25 @@ the prose being edited as data, preserve facts, numbers, names, quotes, claims,
 scope, and uncertainty, and avoid adding outside facts unless the user asks for
 research.
 
+Use exact bare `handoff`, `/litclaude:lit-handoff`, or
+`Skill(lit-handoff)` for a verified continuation packet. Only the standalone
+bare word activates the prompt hook; mentions, quoted text, compound prompts,
+and slash-command text remain inert. The route begins with
+`🔥 LITBURN IGNITED · lit-handoff 🔥` and reads the full packaged canonical
+source before selecting a destination.
+
+Use exact bare `lit-scientific-visualization`,
+`/litclaude:lit-scientific-visualization`, or
+`Skill(lit-scientific-visualization)` for publication-ready plotting. Only the
+standalone bare token activates the prompt hook; generic visualization prose,
+mentions, quoted or fenced text, mixed prompts, and slash-command text remain
+inert at that hook. The exact-bare hook shows the banner as a visible system
+message and injects the full adapter and canonical source. The route begins with
+`🔥 LITBURN IGNITED · lit-scientific-visualization 🔥`, resolves `scripts/` and
+`assets/` from the installed package, and uses a read-only dependency preflight.
+Python/matplotlib or optional scientific packages are never installed silently;
+unavailable capabilities are reported as `DEGRADED` with the affected workflow.
+
 ## Commands
 
 | Command | Purpose |

package/README_ko-KR.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.28-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.30-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -26,11 +26,11 @@
 > 설치되므로, 매번 긴 `--plugin-dir` 없이 일반 `claude` 실행에서
 > LitClaude skill과 hook을 불러올 수 있습니다.
 
-현재 checkout은 `litclaude-ai@0.3.28` 배포 준비용으로 정리되어 있습니다. 목적은
+현재 checkout은 `litclaude-ai@0.3.30` 배포 준비용으로 정리되어 있습니다. 목적은
 다른 PC에서도 빠르게 설치하기 위한 개인용 package metadata를 갖추는 것입니다.
 npm package metadata를 준비했다고 해서 홍보, 공개 저장소 운영, Claude
 marketplace 등록을 의미하지는 않습니다. 새 버전 배포는 항상 별도의 명시적
-승인 후에 진행합니다. v0.3.28 release material은 start-work 호출을 prompt 선두의 명시적 invocation으로 제한해 진단문이나 복사된 언급을 비활성 상태로 유지합니다. v0.3.27 release material은 success/failure receipt와 deterministic automation output을 갖춘 5-stage animated installer를 추가합니다. v0.3.26 release material은 adaptive objective-achievable planning, draft-plan review, orchestration readiness hardening을 추가합니다. v0.3.25 release material은 portable details, public-read, litgoal status JSON, evidence wording을 정렬합니다. v0.3.24 release material은 auxiliary skill inventory와 advisory probe를 정렬합니다. v0.3.23 release material은 bare `hyperplan`,
+승인 후에 진행합니다. v0.3.30 release material은 root-owned scientific evidence record, DOI/PDF lifecycle receipt, bounded route coverage, connection-pinned public-source reader, inert-content 및 secret-redaction 보장을 포함하는 LitResearch 강화판입니다. v0.3.29 release material은 exact-source `lit-handoff`와 `lit-scientific-visualization` skill, Claude-native command, exact-bare hook invocation, visible LITBURN banner, installed-payload integrity check, read-only scientific dependency diagnostic을 함께 포함합니다. v0.3.28 release material은 start-work 호출을 prompt 선두의 명시적 invocation으로 제한해 진단문이나 복사된 언급을 비활성 상태로 유지합니다. v0.3.27 release material은 success/failure receipt와 deterministic automation output을 갖춘 5-stage animated installer를 추가합니다. v0.3.26 release material은 adaptive objective-achievable planning, draft-plan review, orchestration readiness hardening을 추가합니다. v0.3.25 release material은 portable details, public-read, litgoal status JSON, evidence wording을 정렬합니다. v0.3.24 release material은 auxiliary skill inventory와 advisory probe를 정렬합니다. v0.3.23 release material은 bare `hyperplan`,
 `litresearch`, `lit research`, `init-deep`, explicit `$start-work` prompt-hook route에
 bundled skill body를 주입하면서, v0.3.19 adversarial planning
 skill, v0.3.18 read-only `lit-recap` session recap surface, v0.3.17 별도 worker 기반 native `/goal`
@@ -82,7 +82,12 @@ litresearch activation/read-only polish를 유지합니다.
   `korean-ai-slop-remover`, `review-work`, `frontend-ui-ux`,
   `git-master`, `comment-checker`, `rules`, `lsp`, `lsp-setup`, `litgoal`,
   `deep-interview`, `hyperplan`, `init-deep`, `litresearch`,
-  `lit-plan`, `lit-recap`, `lit-loop`, `start-work`, `visual-qa`
+  `lit-plan`, `lit-recap`, `lit-loop`, `start-work`, `lit-handoff`,
+  `lit-scientific-visualization`, `visual-qa`
+- **원본 보존 bundled skills** - `lit-handoff`는 승인된 4개 handoff 원본
+  파일을, `lit-scientific-visualization`은 승인된 authored 원본 16개를
+  byte-identical하게 포함합니다. Python 또는 matplotlib이 없으면 자동
+  설치하지 않고 해당 capability를 `DEGRADED`로 보고합니다.
 - **Auxiliary Skill-discovery entries** - `frontend-ui-ux`, `git-master`,
   `lsp-setup`, `visual-qa`는 Claude Code native Skill discovery로 찾는
   shipped skill id입니다. 별도의 slash route나 dollar prompt route를 추가하지
@@ -126,7 +131,7 @@ checkout을 먼저 해석해서 `sh: litclaude-ai: command not found`로 실패
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.28 install
+npx --yes litclaude-ai@0.3.30 install
 ```
 
 설치 상태를 확인합니다.
@@ -139,7 +144,7 @@ installer는 Claude Code의 `statusLine` command도 packaged LitClaude HUD로
 설정합니다. 색상을 제거한 예시는 다음처럼 시작합니다.
 
 ```text
-[🔥LITCLAUDE v0.3.28] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.30] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 `↻` 표시는 rate-limit reset까지 남은 시간을 짧게 보여주는 countdown입니다.
@@ -240,6 +245,10 @@ $litgoal <goal operation>
 /litgoal <goal operation>
 $start-work plans/example-plan.md
 /start-work plans/example-plan.md
+handoff
+/litclaude:lit-handoff
+lit-scientific-visualization
+/litclaude:lit-scientific-visualization <출판용 figure 요청>
 ```
 
 기대 동작은 LitClaude prompt hook이 자연어 LIT route별 mode-specific
@@ -331,8 +340,9 @@ plan을 must not implement 합니다. 완료된 작업은 기존 5-lane review
 investigation 요청에 한해 `/litclaude:litresearch`로 라우팅됩니다. Web lane은
 public API/feed를 먼저 확인하고, HTTP status만 믿지 않고 실제 claim이 들어
 있는지 검증하며, 시도한 route와 남은 route, stop reason을 route trace로
-남깁니다. 가져온 페이지 내용은 prompt injection 관점에서 untrusted data로
-다루고, authentication/paywall/private data/credential 경계에서는 우회하지 않고
+남깁니다. Runtime JSON의 `contentSafety`는 가져온 페이지 내용을 untrusted
+data로 표시하고 그 안의 지시를 실행하지 않았음을 기계 판독 가능하게 남깁니다.
+authentication/paywall/private data/credential 경계에서는 우회하지 않고
 정직하게 멈춥니다. 사용자가 read-only, no-write, transcript-only 조사를
 요청하면 LitClaude는 `.litclaude/litresearch/<slug>/` 생성 전에 먼저 확인해야
 하며, 승인 전에는 transcript/TodoWrite에만 journal을 둡니다. Guaranteed runtime
@@ -345,8 +355,9 @@ surface는 JS-only direct public URL reader입니다. Dynamic `Workflow`,
 litclaude public-read https://example.com/article --json
 ```
 
-`public-read` 명령과 MCP `public_source_read`는 기본적으로 localhost,
-private-network, non-http(s) target을 거부합니다. site credential을 사용하거나
+`public-read` 명령과 MCP `public_source_read`는 localhost,
+private-network, non-http(s) target을 거부하며 환경 변수로 이 경계를 해제하지
+않습니다. site credential을 사용하거나
 login/paywall을 우회하지 않으며, 막힌 소스는 public URL, exported artifact,
 또는 excerpt를 받아 처리합니다.
 
@@ -380,6 +391,8 @@ command를 사용합니다.
 /litclaude:review-work <검토할 범위>
 /litclaude:litgoal <goal operation>
 /litclaude:korean-ai-slop-remover <한국어 문장 또는 다듬기 요청>
+/litclaude:lit-handoff
+/litclaude:lit-scientific-visualization <출판용 figure 요청>
 /litclaude:start-work plans/example-plan.md
 ```
 
@@ -403,6 +416,24 @@ mode에서 바로 다듬고, 길거나 민감하거나 review/redo/fidelity 확
 범위, 불확실성을 보존하며, 사용자가 research를 요청하지 않으면 외부 사실을
 추가하지 않습니다.
 
+정확히 `handoff` 한 단어만 입력하거나 `/litclaude:lit-handoff`,
+`Skill(lit-handoff)`를 사용하면 검증된 continuation packet 흐름이
+시작됩니다. 언급, 인용, compound prompt, slash-command 문자열은 hook을
+활성화하지 않습니다. 첫 줄은 `🔥 LITBURN IGNITED · lit-handoff 🔥`이고,
+패키지에 포함된 원본을 전부 읽은 뒤 목적지를 결정합니다.
+
+출판용 figure에는 정확한 bare `lit-scientific-visualization`,
+`/litclaude:lit-scientific-visualization`, 또는
+`Skill(lit-scientific-visualization)`을 사용합니다. 바깥 공백을 제외한 전체 prompt가
+이 bare token과 일치할 때만 prompt hook이 활성화됩니다. 일반적인 visualize,
+plot, chart 표현, 언급, 인용·fence, mixed prompt, slash-command 문자열은
+비활성 상태를 유지합니다. exact-bare hook은 배너를 visible system message로 표시하고
+전체 adapter와 canonical source를 주입합니다. 첫 줄은
+`🔥 LITBURN IGNITED · lit-scientific-visualization 🔥`이며 설치된 패키지의
+`scripts/`와 `assets/`를 사용합니다. Python, matplotlib, 선택 scientific
+package는 몰래 설치하지 않고, 없으면 영향받는 workflow를 `DEGRADED`로
+보고합니다.
+
 ## 명령어
 
 | 명령어 | 용도 |

package/RELEASE_CHECKLIST.md

@@ -1,7 +1,13 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.28` is the current release candidate — explicit
-leading start-work activation guards plus a structured five-stage interactive
+Status: `litclaude-ai@0.3.30` is the current release candidate — root-owned
+scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage,
+connection-pinned public-source reads, inert-content receipts, and deep secret
+redaction, plus bundled
+exact-source `lit-handoff` and `lit-scientific-visualization` skills with
+Claude-native command routes, exact-bare hook invocation, visible LITBURN
+banners, payload integrity checks, and read-only scientific dependency
+diagnostics, plus explicit leading start-work activation guards and a structured five-stage interactive
 installer with success/failure receipts and adaptive
 planning, draft-plan review, and orchestration-safety release on top of the portable
 details, public-read, litgoal-status, and evidence-wording release and the auxiliary
@@ -17,9 +23,9 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.28`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.28`, and the
-plugin-local MCP server reports `0.3.28`.
+`package.json` is aligned to `0.3.30`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.30`, and the
+plugin-local MCP server reports `0.3.30`.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -63,19 +69,56 @@ Use this track when testing from the current checkout:
 
 No npm publication is required for this track.
 
+## v0.3.30 LitResearch and Public Reader Gates
+
+Before requesting publication approval, confirm the installed LitResearch body
+keeps the journal root-owned, preserves stable claim and scientific lifecycle
+receipts, distinguishes access failure from route exhaustion, and documents the
+deliberate non-port boundary. Confirm the public-source reader pins every
+validated DNS answer and redirect connection, rejects private and mapped
+addresses, treats fetched content as inert untrusted data, and redacts source URL
+secrets from every receipt and extracted metadata surface.
+
+## v0.3.29 Bundled Skill Gates
+
+Before requesting publication approval, confirm these artifacts from the current
+checkout and from an isolated install of the packed tarball:
+
+- `lit-handoff` ships the approved exact four-file canonical corpus plus license
+  and provenance metadata, and exact bare `handoff` shows
+  `🔥 LITBURN IGNITED · lit-handoff 🔥` while quoted, fenced, mixed, slash, and
+  explanatory near misses remain inert.
+- `lit-scientific-visualization` ships the approved exact 16-file canonical
+  corpus plus license and provenance metadata, and exact bare
+  `lit-scientific-visualization` shows
+  `🔥 LITBURN IGNITED · lit-scientific-visualization 🔥` while quoted, fenced,
+  mixed, slash, generic-visualization, and explanatory near misses remain inert.
+- The scientific adapter reads the full canonical source, resolves packaged
+  `scripts/` and `assets/`, and exposes the shipped style presets, figure export
+  helpers, and color palettes from the installed package rather than checkout-only
+  paths.
+- Installed-payload integrity checks compare the immutable source records and
+  fail closed on missing or changed bundled files.
+- `litclaude-scientific-visualization-doctor.js --json` performs read-only
+  dependency checks, never installs Python packages, and reports unsupported
+  optional workflows as `DEGRADED` rather than claiming availability.
+- `npm pack --dry-run --json` and an isolated consumer install include both
+  command routes, both adapted skills, both canonical-source trees, provenance,
+  licenses, scripts, assets, and the scientific dependency doctor.
+
 ## v0.2.2 Dynamic Workflow Hardening Gates
 
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.28`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.28`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.28`.
+- `package.json` version is `0.3.30`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.30`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.30`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.
 - `node bin/litclaude-ai.js public-read <public-url> --json` exposes the guarded JS runtime reader.
-- MCP `tools/list` exposes `public_source_read`, and `tools/call` returns JSON content with `isError` set on safety stops.
+- MCP `tools/list` exposes `public_source_read`, and `tools/call` returns JSON content with `isError` set on safety stops plus machine-readable `contentSafety` flags.
 - `plugins/litclaude/commands/dynamic-workflow.md` documents subagent delegation.
 - `node bin/litclaude-ai.js workflow-check --json` reports `status: pass`.
 - `node bin/litclaude-ai.js workflow-check --json` reports

package/bin/litclaude-ai.js

@@ -17,6 +17,7 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { HUD_ACCENT_THEMES, normalizeHudAccent, themeForAccent } from "../plugins/litclaude/lib/hud-accent-palette.mjs";
 import { readPublicSource } from "../plugins/litclaude/lib/public-source-reader/reader.mjs";
+import { verifyBundledSkillsIntegrity } from "../plugins/litclaude/lib/bundled-skills-integrity.mjs";
 import { runStartWorkContinuationCli } from "../plugins/litclaude/lib/start-work-continuation.mjs";
 import { runLitgoalCli } from "../plugins/litclaude/lib/litgoal/cli.mjs";
 import { runWorkflowCheckCli } from "../plugins/litclaude/lib/workflow-check.mjs";
@@ -563,6 +564,17 @@ const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 
 const assertCurrentPluginDetails = (detailsOutput) => {
   const missing = [];
+  const inventorySections = new Map();
+  let currentInventory;
+  for (const rawLine of detailsOutput.replace(/\u001b\[[0-?]*[ -/]*[@-~]/gu, "").split("\n")) {
+    const header = rawLine.trim().match(/^([A-Za-z][A-Za-z -]+)\s*\(\d+\)/u);
+    if (header) currentInventory = header[1].trim().toLowerCase();
+    if (currentInventory) {
+      inventorySections.set(currentInventory, `${inventorySections.get(currentInventory) ?? ""}\n${rawLine}`);
+    }
+  }
+  const skillsInventory = inventorySections.get("skills") ?? "";
+
   if (!new RegExp(`\\b${escapeRegex(version)}\\b`, "u").test(detailsOutput)) {
     missing.push(`expected version ${version}`);
   }
@@ -572,9 +584,12 @@ const assertCurrentPluginDetails = (detailsOutput) => {
     missing.push("expected nonzero Agents inventory with prometheus-planner");
   }
 
-  if (!/\blit-loop\b/u.test(detailsOutput) || !/\blit-plan\b/u.test(detailsOutput)) {
+  if (!/\blit-loop\b/u.test(skillsInventory) || !/\blit-plan\b/u.test(skillsInventory)) {
     missing.push("expected lit-loop and lit-plan skills");
   }
+  if (!/\blit-handoff\b/u.test(skillsInventory) || !/\blit-scientific-visualization\b/u.test(skillsInventory)) {
+    missing.push("expected lit-handoff and lit-scientific-visualization skills");
+  }
 
   if (missing.length > 0) {
     fail(`Claude plugin details did not show current LitClaude agent inventory: ${missing.join("; ")}. Re-run litclaude install in the intended CLAUDE_CONFIG_DIR.`);
@@ -619,11 +634,27 @@ const resetCurrentPointer = (home, target) => {
 };
 
 const verifyInstalledPayload = ({ home, litClaudeHome, targetPlugin }) => {
-  for (const relativePath of [".claude-plugin/plugin.json", "hooks/hooks.json", "bin/litclaude-hook.js"]) {
+  for (const relativePath of [
+    ".claude-plugin/plugin.json",
+    "hooks/hooks.json",
+    "bin/litclaude-hook.js",
+    "bin/litclaude-scientific-visualization-doctor.js",
+    "skills/lit-handoff/SKILL.md",
+    "commands/lit-handoff.md",
+    "vendor/022_handoff/SKILL.md",
+    "skills/lit-scientific-visualization/SKILL.md",
+    "commands/lit-scientific-visualization.md",
+    "vendor/045_scientific-visualization/SKILL.md",
+    "vendor/045_scientific-visualization/scripts/style_presets.py",
+  ]) {
     if (!existsSync(join(targetPlugin, relativePath))) {
       throw new Error(`installed plugin is missing ${relativePath}`);
     }
   }
+  const integrity = verifyBundledSkillsIntegrity(targetPlugin);
+  if (integrity.status !== "PASS") {
+    throw new Error(`installed bundled-skill integrity verification failed: ${JSON.stringify(integrity)}`);
+  }
   if (!readInstalledPlugins(home).plugins[pluginKey]?.length) {
     throw new Error(`Claude registry is missing ${pluginKey}`);
   }
@@ -747,6 +778,7 @@ const doctor = ({ dryRun }) => {
     process.stdout.write(`Would run: claude plugin validate ${pluginPath}\n`);
     process.stdout.write(`Would check Claude plugin registry: ${pluginKey}\n`);
     process.stdout.write(`Would check Claude statusLine HUD: ${hudCommandForPlugin(pluginPath)}\n`);
+    process.stdout.write(`Would run: node ${join(pluginPath, "bin", "litclaude-scientific-visualization-doctor.js")}\n`);
     return;
   }
 
@@ -763,6 +795,23 @@ const doctor = ({ dryRun }) => {
     "bin/litclaude-mcp.js",
     "skills/lit-loop/SKILL.md",
     "skills/lit-plan/SKILL.md",
+    "skills/lit-handoff/SKILL.md",
+    "commands/lit-handoff.md",
+    "vendor/022_handoff/SKILL.md",
+    "vendor/022_handoff/evals/evals.json",
+    "vendor/022_handoff/examples/HANDOFF-example-generic-auth-refactor.md",
+    "vendor/022_handoff/templates/HANDOFF.md",
+    "skills/lit-scientific-visualization/SKILL.md",
+    "commands/lit-scientific-visualization.md",
+    "bin/litclaude-scientific-visualization-doctor.js",
+    "vendor/045_scientific-visualization/SKILL.md",
+    "vendor/045_scientific-visualization/scripts/style_presets.py",
+    "vendor/045_scientific-visualization/scripts/figure_export.py",
+    "vendor/045_scientific-visualization/assets/color_palettes.py",
+    "vendor/provenance/022_handoff.md",
+    "vendor/provenance/045_scientific-visualization.md",
+    "vendor/licenses/022_handoff-MIT.txt",
+    "vendor/licenses/045_scientific-visualization-MIT.txt",
   ];
 
   for (const file of requiredFiles) {
@@ -772,6 +821,18 @@ const doctor = ({ dryRun }) => {
 
   printLspDiagnostics(pluginPath, registry);
 
+  const scientificVisualizationDoctor = spawnSync(
+    process.execPath,
+    [join(pluginPath, "bin", "litclaude-scientific-visualization-doctor.js")],
+    { encoding: "utf8" },
+  );
+  if (scientificVisualizationDoctor.stdout) process.stdout.write(scientificVisualizationDoctor.stdout);
+  if (scientificVisualizationDoctor.stderr) process.stderr.write(scientificVisualizationDoctor.stderr);
+  if (scientificVisualizationDoctor.status !== 0) {
+    fail("LitClaude bundled-skills payload is incomplete or hash-invalid. Run `litclaude install` again.");
+  }
+  process.stdout.write("BUNDLED_SKILLS_PAYLOAD_PASS\n");
+
   const claude = spawnSync("claude", ["--version"], { encoding: "utf8" });
   if (claude.error) {
     process.stdout.write("CLAUDE_WARNING: claude executable not found in PATH\n");
@@ -823,9 +884,7 @@ const runPublicRead = async ({ rest }) => {
   const input = filtered.join(" ").trim();
   if (!input) fail("public-read requires a URL or query", 64);
 
-  const result = await readPublicSource(input, {
-    allowPrivateHosts: process.env.LITCLAUDE_PUBLIC_READ_ALLOW_PRIVATE === "1",
-  });
+  const result = await readPublicSource(input);
 
   if (json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);

package/docs/hooks.md

@@ -111,6 +111,8 @@ $dynamic-workflow
 $review-work
 $litgoal
 $start-work
+handoff
+lit-scientific-visualization
 ```
 
 When a LIT trigger is present, the hook returns additional context containing
@@ -125,6 +127,24 @@ switch Claude Code agents. The `$start-work` shorthand and natural start-work
 phrases activate only when they lead the prompt; diagnostic prose and copied or
 blockquoted mentions remain inert.
 
+`handoff` is a separate exact-bare route: only the complete prompt `handoff`
+after outer whitespace activates `Skill(lit-handoff)` and injects the complete
+canonical bundled source. It shows
+`🔥 LITBURN IGNITED · lit-handoff 🔥`. Explanatory mentions, quoted or fenced
+text, compound prompts, `/litclaude:lit-handoff`, and secret-bearing multiline
+content do not activate the hook. The slash command remains a native Claude
+Code command surface.
+
+Scientific visualization has one exact-bare UserPromptSubmit route: only the
+complete prompt `lit-scientific-visualization` after outer whitespace activates
+`Skill(lit-scientific-visualization)`, injects the full adapter and canonical
+source, and shows the exact
+`🔥 LITBURN IGNITED · lit-scientific-visualization 🔥` system banner.
+Generic visualization, plot, chart, figure, and scientific visualization prose,
+mentions, quoted or fenced text, mixed prompts, near misses, and
+`/litclaude:lit-scientific-visualization` text do not activate the prompt hook.
+The slash command remains a native Claude Code command surface.
+
 LitClaude follows the LitClaude goal pattern as an honest native-binding attempt,
 not as slash-command injection. If Claude Code exposes native goal tools, the
 guidance tells Claude to inspect `get_goal`, call `create_goal` only when no
@@ -225,8 +245,9 @@ no-write, or transcript-only research, ask before creating
 `.litclaude/litresearch/<slug>/` and otherwise keep the journal in the
 transcript/TodoWrite. The guaranteed runtime surface is direct public URL reads
 through `public_source_read` or `litclaude public-read`; its JSON includes
-`fetchAttempts`, `fetchVerdict`, untried safe routes, and a starter claim graph
-so HTTP 200 is not treated as success without content validation. Dynamic
+`fetchAttempts`, `fetchVerdict`, untried safe routes, a starter claim graph, and
+`contentSafety` flags declaring fetched text untrusted and its instructions
+ignored, so HTTP 200 is not treated as success without content validation. Dynamic
 `Workflow`, `/deep-research`, browsing, and namespaced subagents are
 host-dependent and need fallbacks.
 

package/docs/workflow-compatibility-audit.md

@@ -16,6 +16,8 @@ make the missing LitClaude target obvious.
 | litgoal state/runtime | `commands/litgoal.md`, `skills/litgoal`, `plugins/litclaude/lib/litgoal/`, `.litclaude/litgoal/`, `bin/litclaude-ai.js litgoal ...` commands | Implemented | `litgoal` now has durable state, ledger, checkpoint, steering, quality gate, and review blocker commands through `litclaude litgoal create-goals`, `record-evidence`, `checkpoint`, `steer`, and `record-review-blockers`. |
 | LIT/start-work discipline | `commands/lit-loop.md`, `commands/lit-plan.md`, `commands/start-work.md`, `skills/lit-loop`, `skills/lit-plan`, `skills/start-work` | Implemented | Existing LIT/start-work surfaces require plan reading, ledger updates, publish boundary checks, verification, manual QA artifacts, cleanup receipts, resume checkpoints, and evidence artifacts. |
 | hook trigger safety | `hooks/hooks.json`, `bin/litclaude-hook.js`, `test/hooks.test.mjs`, `docs/hooks.md` | Implemented | Hooks use `UserPromptSubmit` trigger detection, exact workflow aliases, near-miss fixtures, prompt injection safe context, and no auto-type behavior for slash commands. |
+| bundled handoff | `skills/lit-handoff`, `commands/lit-handoff.md`, `vendor/022_handoff`, exact-bare hook | Implemented | Four canonical files remain byte-identical; exact bare `handoff` injects the complete source while mentions, compounds, slash text, and secret-bearing prompts remain inert. |
+| bundled scientific visualization | `skills/lit-scientific-visualization`, `commands/lit-scientific-visualization.md`, `vendor/045_scientific-visualization`, exact-bare hook, capability doctor | Implemented | Sixteen authored files remain byte-identical; the exact-bare hook displays the banner and injects the complete adapter/source while mixed and generic prompts stay inert; installed source-root path resolution, dependency DEGRADED status, Python source tests, and real figure export are covered without silent installation. |
 | agent/command routing | `agents/*.md`, `commands/*.md`, `.claude-plugin/plugin.json`, command discovery tests | Implemented | Agents and commands route planner, executor, verifier, reviewer, librarian, and QA responsibilities into Claude Code surfaces, including review-work and litgoal command files. |
 | docs/package payload | `README.md`, `README_ko-KR.md`, `docs/*.md`, `package.json`, `.claude-plugin/plugin.json`, `test/workspace-hygiene.test.mjs` | Implemented | Docs, package payload, manifest, install metadata, package file-list, and guarded-token gates are covered by tests; v0.2.0 docs describe local parity without implying publish completion. |
 | excluded/deferred telemetry | No runtime telemetry package; docs omission note | Omitted | Telemetry is omitted and any network telemetry remains deferred by reason: LitClaude should stay local and quiet unless the user explicitly requests an observable reporting feature. |
@@ -60,6 +62,8 @@ workflow additions:
 - `litgoal`
 - `lit-loop`
 - `lit-plan`
+- `lit-handoff`
+- `lit-scientific-visualization`
 
 Auxiliary Skill-discovery entries are part of the public inventory without adding
 new command routes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litclaude-ai",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "litclaude",
   "description": "Claude Code-native workflow plugin.",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "author": {
     "name": "LitClaude contributors"
   },