litclaude-ai 0.3.34 → 0.3.36

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.3.36 - 2026-07-28 — G8 UI/UX capability and evidence hardening
+
+- Promote the beta Design and Evidence schemas to runtime authority while
+  retaining alpha inputs as migration-only.
+- Bound natural-language UI/UX hook context with lazy contract documents and
+  require contract-bound route, state, and viewport PNG inventory.
+- Fail closed when renderer, auth, reviewer, or cleanup capabilities—or evidence
+  freshness and root provenance—cannot be proved, with schema/runtime parity and
+  adversarial real-surface coverage.
+
+## 0.3.35 - 2026-07-26 — parity runtime release preparation
+
+- Restore and enroll the complete `litwork`, rules-engine, plan-scaffolding,
+  litgoal-drift, structural-search, comment-checker, and teammode surfaces.
+- Resolve plan scaffolding from the installed plugin root while keeping the
+  source-checkout command as a thin compatibility entrypoint.
+- Track the nine release tests that exercise those surfaces while keeping local
+  evidence and the litgoal autoloop test intentionally ignored.
+- Extend canonical resource integrity and the isolated installed tamper probe to
+  the new executable skill/runtime assets, including the teammode CLI, rules
+  engine, installed scaffold executable, restored litwork body, and
+  added-comment extraction runtime.
+- Make `litwork`, `structural-search`, and `teammode` public skill inventory entries.
+  Permission modes mutate global Claude settings `permissions.allow` and
+  `permissions.deny`, preserve pre-existing entries, ownership-track only entries
+  LitClaude inserted, and remove only those inserted entries on mode change or
+  uninstall.
+
 ## 0.3.34 - 2026-07-25 — evidence-first UI/UX and visual QA
 
 - Add the packaged `frontend-ui-ux` design-intelligence workflow with a
@@ -12,6 +40,29 @@
   package guards, and adversarial scenario tests; prevent blocking P1 findings
   from retaining `PASS`, keep reviewers read-only, and bound TUI captures to
   1 MiB and 4,096 lines.
+- Ship sixteen hash-pinned interface reference documents: fifteen design
+  decision documents under `frontend-ui-ux/references`, each reachable from a
+  router table in its skill entrypoint, and a per-channel capture playbook
+  under `visual-qa/references`. `npm run validate:plugin` now emits
+  `SKILL_REFERENCE_ROUTER_PASS` and fails when a shipped reference is not
+  reachable from its own entrypoint.
+- Give the visual evidence lane its own copy of the Design Contract schema and
+  an independently written shape validator, so the evidence runtime imports
+  nothing from a sibling skill and a manifest stays checkable from whatever
+  subset of the package a caller installed. The two implementations agree
+  across the strict contract corpus; coupling between lanes is by contract
+  hash and evidence schema, never by skill name.
+- Split future-dated evidence out of staleness as `BLOCKED_EVIDENCE_FUTURE`,
+  add `BLOCKED_RENDERER_OWNERSHIP_UNVERIFIED` for a capture environment that
+  names no verified renderer or process owner, and make an honest incomplete
+  cleanup representable as `BLOCKED_CLEANUP_INCOMPLETE` instead of a schema
+  error. A cleanup status that contradicts its own resource list stays a
+  `CLEANUP_INCOMPLETE` failure. Review failure remains `FAIL`; only an absent
+  capability is `BLOCKED`, and `BLOCKED` continues to outrank `FAIL`.
+- Rewrite both interface skill entrypoints as dense host-native contracts with
+  invocation and selection rules, prerequisites, explicit non-goals, inert-data
+  trust boundaries for reference and user-supplied text, manual QA steps,
+  cleanup and handoff rules, and real install-verification output.
 
 ## 0.3.33 - 2026-07-24 — update notice and installed catalog verification
 

package/README.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.34-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.36-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -22,9 +22,20 @@
 > `litclaude@litclaude-ai`, so normal `claude` launches can load the
 > LitClaude skills and hooks without a long `--plugin-dir` command.
 
-This checkout is prepared as `litclaude-ai@0.3.34` for personal install
+This checkout is prepared as `litclaude-ai@0.3.36` for personal install
 convenience. The repo can remain quiet; preparing npm package metadata here does
 not imply public repo promotion, marketplace publication, or advertisement.
+The v0.3.36 release material hardens the G8 UI/UX capability and evidence path
+with beta Design/Evidence schema authority, bounded lazy hook context,
+contract-bound route/state/viewport PNG coverage, and fail-closed provenance,
+freshness, root, and capability evidence blockers.
+The v0.3.35 release material restores the full `litwork`, rules-engine,
+plan-scaffolding, litgoal-drift, structural-search, comment-checker, and teammode
+surfaces; tracks their tests; and hash-pins shipped executable skill resources
+for installed tamper detection. Permission modes now mutate global Claude settings
+`permissions.allow` and `permissions.deny`: pre-existing entries are preserved, only
+entries LitClaude inserted are ownership-tracked, and only those inserted entries are
+removed on a later mode change or uninstall.
 Future package releases still require explicit user approval. The v0.3.34 release material adds packaged evidence-first UI/UX design intelligence, strict Design/Evidence/Review contracts, bounded PNG and TUI inspection, tier-correct independent review, and adversarial zero-false-PASS coverage. The v0.3.33 release material adds a quiet nonblocking npm update notice with strict cache, concurrency, timestamp, opt-out, and official-registry boundaries; preserves the installed permission mode and HUD accent on optionless updates; and makes source, install, installed-doctor, and Claude-details checks share the exact canonical skill catalog so missing packaged skills fail with `DOCTOR_FAIL`. The v0.3.32 release material adds the code-owned schema-3 start-work lifecycle with canonical bounded authority, explicit single-use resume grants, PreToolUse enforcement, root/subagent lane identity, progress-bound Stop continuation receipts, and fail-closed release boundaries. The v0.3.31 release material hardens litgoal creation, replacement, completion, and autoloop receipts while making visual QA browser ownership, bounded waits, blocked states, and cleanup evidence explicit. The v0.3.30 release material strengthens LitResearch with root-owned scientific evidence records, DOI/PDF lifecycle receipts, bounded route coverage, and a connection-pinned public-source reader with inert-content and secret-redaction guarantees. The v0.3.29 release material bundles exact-source `lit-handoff` and `lit-scientific-visualization` skills with Claude-native commands, exact-bare hook invocation, visible LITBURN banners, installed-payload integrity checks, and read-only scientific dependency diagnostics. The v0.3.28 release material requires explicit leading start-work invocations so diagnostic or copied mentions remain inert. The v0.3.27 release material adds a structured, animated five-stage installer with a success or failure receipt while preserving deterministic automation output. The v0.3.26 release material adds adaptive objective-achievable planning, draft-plan review, and orchestration readiness hardening. The v0.3.25 release material aligns portable details, public-read, litgoal status JSON, and evidence wording. The v0.3.24 release material aligns auxiliary skill inventories and advisory probes. The v0.3.23
 release materials inject the bundled skill bodies for bare `hyperplan`,
 `litresearch`, `lit research`, `init-deep`, and explicit `$start-work` prompt-hook routes while
@@ -78,20 +89,38 @@ activation/read-only polish, and installer permission-preference discipline.
   `korean-ai-slop-remover`, `review-work`, `frontend-ui-ux`,
   `git-master`, `comment-checker`, `rules`, `lsp`, `lsp-setup`, `litgoal`,
   `deep-interview`, `hyperplan`, `init-deep`, `litresearch`,
-  `lit-plan`, `lit-recap`, `lit-loop`, `start-work`, `lit-handoff`,
-  `lit-scientific-visualization`, and `visual-qa`
+  `lit-plan`, `lit-recap`, `lit-loop`, `litwork`, `start-work`, `structural-search`,
+  `teammode`, `lit-handoff`, `lit-scientific-visualization`, and `visual-qa`
 - **Bundled owner-authorized skills** - `lit-handoff` reads the complete immutable
   four-file handoff source and supports the exact bare `handoff` prompt;
   `lit-scientific-visualization` reads the complete immutable 16-file authored
   source, resolves packaged scripts and assets, and reports missing Python or
   matplotlib as `DEGRADED` without silently installing dependencies
-- **Auxiliary Skill-discovery entries** - `frontend-ui-ux`, `git-master`,
-  `lsp-setup`, and `visual-qa` are shipped skill ids discoverable through
-  Claude Code's native Skill discovery; they intentionally do not add extra
-  slash or dollar prompt routes
+- **Auxiliary Skill-discovery entries with chat routes** - `frontend-ui-ux`,
+  `git-master`, `lsp-setup`, and `visual-qa` are shipped skill ids discoverable
+  through Claude Code's native Skill discovery, and each also answers to a
+  leading bare token (`git-master ...`) or the dollar shorthand
+  (`$frontend-ui-ux ...`). They are deliberately **not** anywhere-tokens, so
+  mentioning one mid-sentence ("plain git-master discussion") does not activate
+  it. `frontend-ui-ux` additionally answers a natural-language design request -
+  a prompt carrying both a design verb and an interface noun, such as "design a
+  new settings page UI", surfaces it without naming the skill; "design the
+  database schema" does not. The same verb-and-noun rule works in Korean -
+  "설정 페이지 UI를 새로 디자인해줘" surfaces it, "API 클라이언트를 만들어줘"
+  does not - and Korean matches the verb stem, so every ending is covered.
+  These chat routes are additive: the existing post-edit and pre-commit event
+  routes still fire on their own conditions
 - **Auxiliary workflow packs** - ships `programming/references`,
   `programming/scripts`, and `debugging/references` for deeper language and
   runtime guidance
+- **Interface reference packs** - ships `frontend-ui-ux/references` (fifteen
+  design decision documents, each routed from a table in its skill entrypoint)
+  and `visual-qa/references` (a per-channel capture playbook). Every reference
+  file is hash-pinned, and `npm run validate:plugin` fails when a shipped
+  reference is not reachable from its own entrypoint. Natural UI/UX activation
+  stays within 4096 UTF-8 bytes by injecting a synthetic bounded hook pointer, not the exact
+  `SKILL.md` body; each preserved dense contract is opened lazily from
+  `references/complete-contract.md`.
 - **Workflow agents** - planner, executor, verifier, reviewer, librarian, and QA runner
 - **Local marketplace registration** - Claude can resolve `claude plugin details litclaude@litclaude-ai`
 - **MCP and LSP helpers** - plugin-local stdio MCP plus TypeScript-family LSP doctor
@@ -131,7 +160,7 @@ directory, the normal install command works:
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.34 install
+npx --yes litclaude-ai@0.3.36 install
 ```
 
 Validate the installed plugin:
@@ -159,7 +188,7 @@ The installer also sets Claude Code's `statusLine` command to the packaged
 LitClaude HUD. A typical no-color render starts like:
 
 ```text
-[🔥LITCLAUDE v0.3.34] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.36] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 The `↻` suffix is a compact rate-limit reset countdown. It is separated from
@@ -217,8 +246,8 @@ the skill and hook inventory in `claude plugin details`.
 Use `CLAUDE_CONFIG_DIR=/some/path` and `LITCLAUDE_HOME=/some/path` only for
 isolated tests.
 
-Installer permission preference can be recorded without copying OpenCode's
-permission model:
+Installer permission modes write a bounded set of Claude-native `permissions.allow`
+and `permissions.deny` entries; they do not copy another harness's permission model:
 
 ```bash
 npx --yes litclaude-ai install --permission-mode safe
@@ -226,11 +255,12 @@ npx --yes litclaude-ai install --permission-mode balanced
 npx --yes litclaude-ai install --yolo
 ```
 
-`safe` is conservative. `balanced` records that routine automation guidance is
-acceptable while preserving dangerous-shell deny boundaries and planner
-read-only safeguards. `yolo` records explicit user preference, but the installer
-does not rewrite Claude agent frontmatter or weaken `prometheus-planner`'s
-`permissionMode: plan` boundary.
+`safe` writes no allow/deny entries. `balanced` adds read/search and bounded routine
+Git, npm, and Node commands. `yolo` adds broader edit/write and Git/npm/Node command
+patterns. Both non-safe modes add the dangerous-shell deny set, and neither weakens
+`prometheus-planner`'s `permissionMode: plan` boundary. Install/update preserves
+pre-existing permission entries and unrelated keys; uninstall removes only entries
+that LitClaude actually inserted, independently of HUD/statusLine cleanup.
 
 ## LIT Usage
 
@@ -569,6 +599,7 @@ npm test
 npm run validate:plugin
 npm run qa:tmux
 npm run qa:portable
+npm run qa:real-surface
 npm run pack:dry-run
 ```
 
@@ -576,6 +607,28 @@ npm run pack:dry-run
 available on the machine, the smoke harness records a controlled skip with the
 version probe evidence instead of failing mysteriously.
 
+### Real-surface QA
+
+`qa:real-surface` runs three probes that drive the shipped runtime directly
+rather than importing it, so they keep working from a packaged install:
+
+| Script | What it drives | Passing signal |
+| --- | --- | --- |
+| `npm run qa:matrix` | the negative gate matrix: 17 rows against the real `frontend-ui-ux` and `visual-qa` validators, the shipped installer/doctor, and the pack payload guard | `NEGATIVE_GATE_MATRIX_PASS` |
+| `npm run qa:tamper` | an isolated install, then byte-tamper, delete, and restore of pinned skill resources | `INSTALLED_TAMPER_REPAIR_PASS` |
+| `npm run qa:behaviors` | portable install layout, postinstall plugin/HUD setup, hook event handling, and plugin validation through the installed surfaces | `REAL_SURFACE_BEHAVIORS_PASS` |
+
+Each row of the matrix reports its name, expected outcome, observed outcome, and
+`PASS`/`FAIL`/`BLOCKED`. A row that cannot be exercised is reported `BLOCKED`
+with its exact reason; it is never dropped and never counted as a pass. Every
+probe redirects `LITCLAUDE_HOME` and `CLAUDE_CONFIG_DIR` into temp roots, never
+touches a live profile, and ends with a measured cleanup receipt.
+
+`npm run qa:matrix-negative-control` is the matrix's self-test: it feeds one row
+a deliberately wrong expectation and **must exit non-zero**. It is deliberately
+excluded from `qa:real-surface`. If it ever exits 0, the matrix has stopped
+comparing anything and its green results mean nothing.
+
 ## Safety Model
 
 - Hooks read Claude Code event JSON from stdin and return bounded JSON context.

package/README_ko-KR.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.34-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.36-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -26,7 +26,7 @@
 > 설치되므로, 매번 긴 `--plugin-dir` 없이 일반 `claude` 실행에서
 > LitClaude skill과 hook을 불러올 수 있습니다.
 
-현재 checkout은 `litclaude-ai@0.3.34` 배포 준비용으로 정리되어 있습니다. 목적은
+현재 checkout은 `litclaude-ai@0.3.36` 배포 준비용으로 정리되어 있습니다. 목적은
 다른 PC에서도 빠르게 설치하기 위한 개인용 package metadata를 갖추는 것입니다.
 npm package metadata를 준비했다고 해서 홍보, 공개 저장소 운영, Claude
 marketplace 등록을 의미하지는 않습니다. 새 버전 배포는 항상 별도의 명시적
@@ -38,6 +38,11 @@ launcher와 v0.3.16 WSL2/Windows Terminal truecolor HUD gradient fix, v0.3.15
 Korean AI slop remover workflow, v0.3.13 public-source reader runtime,
 litresearch activation/read-only polish를 유지합니다.
 
+v0.3.36 release material은 beta Design/Evidence schema authority, bounded lazy
+hook context, contract-bound route/state/viewport PNG coverage,
+provenance·freshness·root·capability 증거의 fail-closed blocker로 G8 UI/UX
+capability/evidence path를 강화합니다.
+
 ## 기능
 
 - **자연스러운 Claude 실행** - 한 번 `npx`로 설치한 뒤에는 plain `claude`
@@ -83,18 +88,51 @@ litresearch activation/read-only polish를 유지합니다.
   `git-master`, `comment-checker`, `rules`, `lsp`, `lsp-setup`, `litgoal`,
   `deep-interview`, `hyperplan`, `init-deep`, `litresearch`,
   `lit-plan`, `lit-recap`, `lit-loop`, `start-work`, `lit-handoff`,
-  `lit-scientific-visualization`, `visual-qa`
+  `structural-search`, `teammode`, `lit-scientific-visualization`, `visual-qa`
 - **원본 보존 bundled skills** - `lit-handoff`는 승인된 4개 handoff 원본
   파일을, `lit-scientific-visualization`은 승인된 authored 원본 16개를
   byte-identical하게 포함합니다. Python 또는 matplotlib이 없으면 자동
   설치하지 않고 해당 capability를 `DEGRADED`로 보고합니다.
-- **Auxiliary Skill-discovery entries** - `frontend-ui-ux`, `git-master`,
-  `lsp-setup`, `visual-qa`는 Claude Code native Skill discovery로 찾는
-  shipped skill id입니다. 별도의 slash route나 dollar prompt route를 추가하지
-  않습니다.
+- **Auxiliary Skill-discovery entries + chat route** - `frontend-ui-ux`,
+  `git-master`, `lsp-setup`, `visual-qa`는 Claude Code native Skill discovery로
+  찾는 shipped skill id이면서, 문장 맨 앞에 오는 bare token(`git-master ...`)과
+  dollar shorthand(`$frontend-ui-ux ...`)로도 활성화됩니다. anywhere-token은
+  일부러 아닙니다. 문장 중간에 이름만 언급하는 경우("plain git-master
+  discussion")에는 활성화되지 않습니다. `frontend-ui-ux`는 자연어 디자인 요청도
+  받습니다. **한국어도 지원합니다.** 만들기/디자인 계열 동사와 UI 명사가 함께
+  있어야 활성화되는 구조는 영어와 동일합니다. 활성화되는 예: "설정 페이지 UI를
+  새로 디자인해줘", "디자인 시스템을 만들어줘", "대시보드 레이아웃을 개편해줘".
+  활성화되지 않는 예: "API 클라이언트를 만들어줘", "데이터베이스 마이그레이션을
+  새로 만들어줘" — 동사는 같아도 UI 명사가 없기 때문입니다. 한국어는 교착어라서
+  어미가 아니라 어간(`디자인`, `만들`)을 매칭하므로 `디자인해줘`, `디자인하고`,
+  `디자인할`, `리디자인` 이 모두 같은 어간으로 잡힙니다. 영어 예시로는 "design a
+  new settings page UI"가 활성화되고 "design the database schema"는 활성화되지
+  않습니다. 이 chat route는 추가된 것이라서 기존 post-edit / pre-commit event
+  route는 그대로 각자의 조건으로 동작합니다.
 - **Auxiliary workflow packs** - `programming/references`,
   `programming/scripts`, `debugging/references`까지 포함해서 언어별,
   런타임별 세부 지침을 보존
+- **Interface reference packs** - `frontend-ui-ux/references`(디자인 결정
+  문서 15개, 각 skill entrypoint의 라우터 표에서 바로 찾아갈 수 있음)와
+  `visual-qa/references`(채널별 capture playbook)를 포함합니다. 모든 reference
+  파일은 hash-pinned이고, entrypoint에서 도달할 수 없는 reference가 있으면
+  `npm run validate:plugin`이 실패합니다. 현재 canonical manifest는 정확히 **85 resources**를
+  검증합니다. 자연어 UI/UX hook은 정확한 `SKILL.md` 본문이 아니라 synthetic bounded hook pointer를
+  주입하고 상세 `references/complete-contract.md`는 필요할 때만 읽습니다. prompt-time rule을 합친 최종
+  `additionalContext`도 UTF-8 기준 **4096 바이트 이하**입니다.
+- **Beta Design/Evidence authority** - UI 작성의 권위 스키마는
+  `litfamily.design-contract/v1beta1`, 시각 증거의 권위 스키마는
+  `litfamily.evidence-manifest/v1beta1`입니다. alpha는 migration-only이며
+  `LEGACY_SCHEMA_V1ALPHA1`/`evidence_eligible: false`로 남습니다. Beta smoke evidence는
+  beta contract에 선언된 primary route, critical interaction, 적용 가능한 negative/empty state,
+  최소/최대 viewport에만
+  연결되고, viewport마다 contract의 width/height와 일치하는 PNG가 필요합니다. 호환되지
+  않는 viewport를 PNG 하나로 충족하거나 선언되지 않은 inventory를 넣으면 `PASS`가
+  아니라 `EVIDENCE_CONTRACT_INVENTORY_MISMATCH` 또는
+  `EVIDENCE_VIEWPORT_BINDING_INVALID`입니다. renderer/auth/reviewer/cleanup capability가
+  없으면 정확한 `BLOCKED_*`를 유지하며 `PASS`로 낮추지 않습니다. 공개 JSON, 갱신한 mtime,
+  호출자가 넣은 current hash/revision은 host capture provenance를 증명하지 못하므로 현재 pathname
+  CLI는 `BLOCKED_EVIDENCE_FRESHNESS_UNPROVEN`과 `BLOCKED_EVIDENCE_ROOT_UNPROVEN`을 반환합니다.
 - **워크플로우 agents** - planner, executor, verifier, reviewer, librarian, QA runner
 - **Local marketplace 등록** - `claude plugin details litclaude@litclaude-ai`에서 inventory 확인
 - **MCP와 LSP helper** - plugin-local stdio MCP와 TypeScript 계열 LSP doctor
@@ -131,7 +169,7 @@ checkout을 먼저 해석해서 `sh: litclaude-ai: command not found`로 실패
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.34 install
+npx --yes litclaude-ai@0.3.36 install
 ```
 
 설치 상태를 확인합니다.
@@ -159,7 +197,7 @@ installer는 Claude Code의 `statusLine` command도 packaged LitClaude HUD로
 설정합니다. 색상을 제거한 예시는 다음처럼 시작합니다.
 
 ```text
-[🔥LITCLAUDE v0.3.34] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.36] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 `↻` 표시는 rate-limit reset까지 남은 시간을 짧게 보여주는 countdown입니다.
@@ -216,8 +254,8 @@ LitClaude 전용 local marketplace 항목, `known_marketplaces.json`을 함께
 격리 테스트가 필요할 때만 `CLAUDE_CONFIG_DIR=/some/path`와
 `LITCLAUDE_HOME=/some/path`를 지정하세요.
 
-installer permission preference는 OpenCode permission model을 그대로 복사하지
-않고 Claude-native 설정으로 기록합니다.
+installer permission mode는 다른 harness의 permission model을 복사하지 않고,
+Claude-native `permissions.allow`와 `permissions.deny`에 제한된 규칙을 기록합니다.
 
 ```bash
 npx --yes litclaude-ai install --permission-mode safe
@@ -225,10 +263,12 @@ npx --yes litclaude-ai install --permission-mode balanced
 npx --yes litclaude-ai install --yolo
 ```
 
-`safe`는 보수적 기본값입니다. `balanced`는 routine automation guidance를
-허용한다는 선호만 기록하되 dangerous-shell deny boundary와 planner read-only
-safeguard를 유지합니다. `yolo`도 명시적 선호를 기록할 뿐,
+`safe`는 allow/deny 규칙을 추가하지 않습니다. `balanced`는 read/search와 제한된
+Git·npm·Node 명령을 추가하고, `yolo`는 edit/write 및 더 넓은 Git·npm·Node 패턴을
+추가합니다. 두 non-safe mode 모두 dangerous-shell deny 규칙을 유지하며
 `prometheus-planner`의 `permissionMode: plan` boundary를 약화하지 않습니다.
+install/update는 기존 permission 규칙과 `defaultMode` 같은 무관한 key를 보존하고,
+uninstall은 HUD/statusLine cleanup과 독립적으로 LitClaude가 실제 삽입한 규칙만 제거합니다.
 
 ## LIT 사용법
 
@@ -506,6 +546,7 @@ npm test
 npm run validate:plugin
 npm run qa:tmux
 npm run qa:portable
+npm run qa:real-surface
 npm run pack:dry-run
 ```
 
@@ -513,6 +554,28 @@ npm run pack:dry-run
 환경에서는 smoke harness가 모호한 실패 대신 controlled skip과 version
 probe evidence를 남깁니다.
 
+### Real-surface QA
+
+`qa:real-surface`는 재구현이 아니라 실제 배포 runtime을 직접 구동하는 probe
+3종을 실행하므로, 패키지 설치본에서도 그대로 동작합니다.
+
+| Script | 구동 대상 | 통과 신호 |
+| --- | --- | --- |
+| `npm run qa:matrix` | negative gate matrix 17개 row를 실제 `frontend-ui-ux`/`visual-qa` validator, 배포 installer/doctor, pack payload guard로 실행 | `NEGATIVE_GATE_MATRIX_PASS` |
+| `npm run qa:tamper` | 격리 설치 후 pinned skill resource를 byte 변조·삭제·복원 | `INSTALLED_TAMPER_REPAIR_PASS` |
+| `npm run qa:behaviors` | portable install layout, postinstall plugin/HUD 설정, hook 이벤트 처리, plugin validation을 설치된 표면으로 검증 | `REAL_SURFACE_BEHAVIORS_PASS` |
+
+matrix의 각 row는 이름, 기대 결과, 관측 결과, `PASS`/`FAIL`/`BLOCKED`를
+출력합니다. 실행할 수 없는 row는 정확한 사유와 함께 `BLOCKED`로 보고하며,
+누락하거나 pass로 처리하지 않습니다. 모든 probe는 `LITCLAUDE_HOME`과
+`CLAUDE_CONFIG_DIR`을 임시 경로로 우회시켜 실제 프로필을 건드리지 않고,
+마지막에 측정된 cleanup receipt를 남깁니다.
+
+`npm run qa:matrix-negative-control`은 matrix의 self-test이며 **반드시 0이
+아닌 exit code로 종료해야 합니다**. 일부러 틀린 기대값을 하나 주입하기
+때문에 `qa:real-surface`에서는 제외되어 있고, 0으로 종료된다면 matrix가
+비교를 멈춘 것이므로 나머지 green 결과도 신뢰할 수 없습니다.
+
 ## 안전 모델
 
 - Hook은 Claude Code event JSON을 stdin으로 읽고 제한된 JSON context를 반환합니다.

package/RELEASE_CHECKLIST.md

@@ -1,7 +1,12 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.34` is the current release candidate — packaged
-evidence-first UI/UX design intelligence, strict Design/Evidence/Review
+Status: `litclaude-ai@0.3.36` is the current release candidate — G8 UI/UX
+capability and evidence hardening with beta Design/Evidence schema authority,
+bounded lazy hook context, contract-bound PNG inventory, and fail-closed
+provenance, freshness, root, and capability blockers. It also carries restored
+litwork, rules-engine, plan-scaffolding, litgoal-drift, structural-search,
+comment-checker, and teammode surfaces with tracked regression tests and
+installed tamper coverage, plus packaged evidence-first UI/UX design intelligence, strict Design/Evidence/Review
 contracts, bounded PNG and TUI inspection, tier-correct independent review, and
 adversarial zero-false-PASS coverage. It also carries the quiet nonblocking npm
 update notice with strict cache, concurrency, timestamp, opt-out, and
@@ -36,9 +41,9 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.34`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.34`, and the
-plugin-local MCP server reports `0.3.34`.
+`package.json` is aligned to `0.3.36`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.36`, and the
+plugin-local MCP server reports `0.3.36`.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -71,6 +76,10 @@ behavior.
 - `npm run pack:payload-guard`
 - `npm run qa:tmux`
 - `npm run qa:portable`
+- `npm run qa:matrix`
+- `npm run qa:tamper`
+- `npm run qa:behaviors`
+- `npm run qa:matrix-negative-control` (must exit non-zero)
 - `npm run pack:dry-run`
 
 ## Local Checkout Use
@@ -106,6 +115,67 @@ the installed package can run its packaged visual CLI against caller-owned
 captures. Source doctor, isolated install, installed doctor, canonical resource
 integrity, scenario replay, and package-payload guards must all pass.
 
+Confirm both interface reference packs ship and stay reachable. `npm run
+validate:plugin` must print `SKILL_REFERENCE_ROUTER_PASS` with every shipped
+`references/*.md` named in its own `SKILL.md`; a reference that is pinned and
+installed but unreachable from its entrypoint is dead payload and blocks the
+release. Run `npm run gen:skill-resources` after touching any reference, schema,
+or script under either skill, and confirm `npm run check:skill-resources`
+reports no drift.
+
+Confirm the visual evidence lane still imports nothing from a sibling skill:
+`grep -rn "frontend-ui-ux" plugins/litclaude/skills/visual-qa/` must return no
+hits. The lane keeps its own Design Contract schema copy and its own shape
+validator on purpose, so a manifest remains checkable from a partial install and
+two independent readings of one shape can disagree visibly.
+
+Confirm the blocker vocabulary is complete and honest. `BLOCKED_AUTH_UNAVAILABLE`,
+`BLOCKED_RENDERER_UNAVAILABLE`, `BLOCKED_INDEPENDENT_REVIEW_UNAVAILABLE`,
+`BLOCKED_TEST_ACCOUNT_UNSAFE`, `BLOCKED_RENDERER_OWNERSHIP_UNVERIFIED`,
+`BLOCKED_EVIDENCE_STALE`, `BLOCKED_EVIDENCE_FUTURE`, and
+`BLOCKED_CLEANUP_INCOMPLETE` must each be emittable by the shipped validator,
+not merely documented. A reviewer that returns a non-`PASS` verdict must produce
+`FAIL`, never a blocker, and `BLOCKED` must outrank `FAIL` when both apply.
+
+## Real-Surface QA Gates
+
+`npm run qa:real-surface` must pass alongside `npm test`, not instead of it.
+It runs three probes that drive the shipped runtime rather than importing a
+reimplementation, so they survive a packaged install and outlive any test-tree
+cleanup:
+
+- `npm run qa:matrix` must print `NEGATIVE_GATE_MATRIX_PASS` with 17 rows and
+  zero `FAIL` or `BLOCKED` rows. The matrix drives the real
+  `validate-design-contract` CLI, the real `visual-qa` CLI, the shipped
+  installer and doctor, and `tools/check-pack-payload.mjs`. It proves each
+  blocker code above by emitting it from the shipped validator: a valid contract
+  and evidence bundle pass; a duplicate-key contract, capture bytes changed after
+  the manifest, and a same-context self-review fail; missing capture, stale and
+  future-dated evidence, unavailable auth, unverified renderer ownership,
+  incomplete cleanup, an unavailable reviewer, and an unsafe test account each
+  block with their exact code; bounded PNG, TUI, and CJK cases pass; and the
+  pack payload guard reports zero forbidden paths.
+- `npm run qa:tamper` must print `INSTALLED_TAMPER_REPAIR_PASS`. It installs
+  into isolated temp roots, proves the installed doctor passes, produces
+  `RESOURCE_HASH_MISMATCH` from every byte tamper, and names the exact deleted
+  path through either `RESOURCE_MISSING` or the earlier canonical-catalog
+  `DOCTOR_FAIL` used for a missing `SKILL.md` entrypoint. It then proves each
+  restoration returns the doctor to `DOCTOR_PASS`.
+- `npm run qa:behaviors` must print `REAL_SURFACE_BEHAVIORS_PASS` with all four
+  named behaviours reported `REPLACED`: portable install layout, postinstall
+  isolated plugin/HUD setup, hook fixtures, and plugin validation. A behaviour
+  that cannot be exercised is reported `NOT_REPLACEABLE` with its reason and
+  fails the gate; it is never quietly downgraded to a pass.
+
+`npm run qa:matrix-negative-control` is the matrix self-test and **must exit
+non-zero**. It feeds one row a deliberately wrong expectation; a zero exit means
+the matrix stopped comparing observed outcomes against expectations and every
+other green result from it is void.
+
+Every probe redirects `LITCLAUDE_HOME` and `CLAUDE_CONFIG_DIR` into temp roots,
+never reads or writes a live profile, and ends with a cleanup receipt whose
+state is measured after removal. A leaked temp root fails the gate.
+
 ## v0.3.33 Update Notice and Canonical Catalog Gates
 
 Before requesting publication approval, confirm interactive `install`, `update`,
@@ -185,9 +255,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.34`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.34`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.34`.
+- `package.json` version is `0.3.36`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.36`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.36`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.