ll-skills 3.0.0 → 3.1.0

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 Formato baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.1.0/). A skill `ll-update` lê este arquivo para mostrar o que mudou entre a versão instalada e a publicada.
 
+## [3.1.0] - 2026-09-11
+
+### Adicionado
+
+- Passo `board-switch` no helper: troca o marcador de fase antes da primeira onda gravar, e `passes` recusa gravar quando o marcador é de outra fase — a onda 1 não escreve mais no lugar da fase anterior (F-1).
+- Coluna `note` e condição executável (`` `cmd` exit N ``) nas linhas de backlog nascidas em `ll-implement`; o epílogo lista quem ainda não é parseável e a fase roda `backlog-reconcile` a seco antes de fechar, reescrevendo a linha na hora (F-2).
+- Linha de progresso por onda no terminal durante uma fase (`onda i/M — M2, M3 rodando`), no despacho e no retorno de cada marco (F-4).
+- Lint rule 9 (`lint-prompts.sh`): nenhuma pergunta ao dono ou linha de contagem carrega `band-1`, `[DEC-`, `[D-` ou `ASM-`; os casos de eval que esperavam a sessão "nomear o comando" (`router-research`, `router-execute`, `router-large-opener`) foram apagados e `router-no-skill` prova o contrário — um pedido comum é feito na hora mesmo num repositório com estado; os asserts de `decide-final-round` e `implement-stops-at-next` seguem a nova redação.
+- Teto de tamanho do helper em 760 linhas / 36 000 bytes (`DEC-0016-helper-ceiling-760-36000.md`).
+- `phase-stats --since <data>` passa a incluir o próprio dia informado (F-12).
+- `ll-resume` grava a resposta a uma decisão `WAITING` no próprio arquivo da decisão.
+- Linhas de memória fora do repositório (`ll-brainstorm`, `ll-close`) declaradas na tabela de entregáveis (F-10).
+- Segunda rodada completa do laboratório: `lab/scenarios/notes-api.md` ganha os turnos 8–24 (fechamento por milestone, pesquisa, decisão sem perguntas com roadmap de quatro fases e uma decisão `WAITING`, meta autônoma, verificação externa, sabotagem seguida de reverificação, oncall, feedback em docx, refino, `ll-auto --pause-at/--resume`), `lab/README.md` ganha o protocolo de sessão isolada (`CLAUDE_CONFIG_DIR` próprio, diálogo de confiança pré-aceito, sondagem a cada 5 minutos) e `lab/rubric.md` ganha as métricas de progresso visível, integridade do board e caminhos percorridos.
+
+### Corrigido
+
+- `ll-implement --no-talk` nunca pergunta: o item que só você decide vira decisão `WAITING` e congela só os marcos que dependem dele; o resto da fase roda (era o que `ll-auto` já assumia).
+- Skill só por comando explícito: o preâmbulo global não redireciona mais nenhum pedido para uma skill, em nenhum repositório, tenha ele estado do ll-skills ou não — a sessão responde ou faz o que foi pedido, e só nomeia um comando quando o dono pergunta qual usar (feedback do dono, 2026-09-11).
+- O gate de premissas do `ll-decide` manda no máximo quatro perguntas num bloco só, com cabeçalhos limpos (sem `[PG-n]`, sem `banda 1` na tela); a restrição inventada por cautela deixou de ser pergunta — vira assunção `ASM-n [revisable]` com gatilho de revisão, contada como assunção.
+- Pergunta cujas opções só diferem em rigor de checagem não é mais feita — vira decisão por ausência (F-8).
+- A sala de decisão (`OPTIONS.html`) é entregue por caminho de arquivo antes da primeira pergunta, sem publicar artefato e sem chamar outra skill (F-5, `DEC-0017-decision-room-file-not-published.md`).
+- As telas e as perguntas ao dono não usam mais `banda 1`, `DEC-`, `ASM-`; a linha de contagem virou `perguntas N · decisões só suas em aberto K` (F-3, `DEC-0018-plain-question-headers.md`).
+- As skills chamam o helper pelo comando, nunca leem o código dele na tela do dono (F-7).
+- Script de aceitação comitado com caminho absoluto ou que mata processo alheio (`pkill`, `killall`) vira bloqueio do verificador em vez de uma ressalva (F-6).
+- O primeiro turno de um pedido grande para no comando e num plano de até 5 linhas, sem escolher formato de id nem biblioteca de IO antes da hora (F-9).
+- O laboratório aceita o diálogo de confiança da pasta antes do primeiro turno, num `CLAUDE_CONFIG_DIR` isolado — a primeira tentativa da rodada de 2026-09-11 tinha morrido nesse diálogo (F-11, `DEC-0019-lab-round-2-scope.md`).
+
+### Alterado
+
+- `lab/rubric.md`: a lista de jargão troca `gate` por `regime` (a classe de roteamento já tem nome próprio no `CLAUDE.md`; nada em `lab/` deveria repeti-la na tela do dono).
+
 ## [3.0.0] - 2026-09-10
 
 ### Adicionado

package/agents/ll-executor.md

@@ -90,7 +90,7 @@ commits: <sha7> test(M<n>): <msg> · <sha7> feat(M<n>): <msg>
 commands: <acceptance command> → "<last output line>" · <other command> → "<last line>"
 deviations: none | <rule applied> — <what> (<file:line>)
 questions: none | <decision requested> — <the option you would take and why>
-backlog: none | <deviation|stub|test-not-run|debt|domain-question> · <what> · `<closing command>` exit 0
+backlog: none | <type> · <what> · `<cmd>` exit 0 · note: <prose>
 not_verified: <what this milestone does not prove; one item per line, or none>
 ```
 

package/agents/ll-verifier.md

@@ -50,6 +50,7 @@ Levels for a phase criterion: exists (the file) → substantive (not a stub: no
 - `git diff <range> -- <test files>`: an assertion loosened, a test skipped, deleted or made unconditional without a `DEC-` id in the commit or in `decisions/` → `BLOCKS: process`.
 - each milestone with `tdd: yes`: `git log` shows `test(M<n>)` before `feat(M<n>)`; missing or inverted → `BLOCKS: process`.
 - files a milestone's block names that do not exist in HEAD, or commits it lists that git does not have → `BLOCKS: report`.
+- a committed script under `phases/` or `scripts/` with an absolute home path, `pkill -f` or `killall` → `BLOCKS: process` (a disconfirmation about a committed artifact is a BLOCK, not a reservation).
 
 ## The 8 plan questions (mode plan)
 

package/assets/preamble.md

@@ -2,26 +2,20 @@
 # ll-skills — how this session works
 
 ## Skills
-A skill runs only when the owner types `/ll-<name>`. The session never starts one on its own, never
-runs one "on the owner's behalf", never proposes to run one for them and never calls the Skill tool
-on an ll skill; when a request looks like a skill's job it answers with the exact command to paste
-and stops there. `ll-auto` is the single place that follows another skill's instructions, and only
-while the owner invoked `/ll-auto`.
-Commands to name, never to run: research, a comparison or an unvalidated restriction →
-`/ll-research <topic>`; a new idea → `/ll-brainstorm`; a phase whose PLAN still has an open
-milestone, "implementa", "continua" → `/ll-implement N`; "status", "onde estamos", "o que tenho pra
-decidir" → `/ll-resume`; a decision to record → `/ll-decide`; deploy, credential, incident →
-`/ll-oncall`; external feedback on a running product → `/ll-refine`; closing a phase → `/ll-close`.
-A request that is a verb plus an addressable target and fits in about three tool calls gets the work
-itself, not a ritual: read the target, do what is authorized, verify with a number, label provenance;
-no spec, no plan, no PROGRESS entry, no VERIFICATION, no premortem, no interview, no subagent, no
-automatic commit, no two questions in a row. When a small request turns out to be large (a bigger
-root cause, a chained delivery, a new folder or repo), say so in one line and name the command once.
-A skill never invokes another skill and never decides the owner's next request; `ll-implement` covers one
-phase per invocation. Every skill ends in a repository file and prints "▶ Next — /clear, then <command>" for
-the owner to paste; that line ends the turn, no tool call follows it. State lives at the repo root (`PLAN.md`,
-`PROGRESS.md`, `phases/`, `decisions/`), never in a subfolder, written as it happens. Reply to the owner in
-Portuguese, in their words (marco, onda, gate, contexto limpo, fiel); every file is English. Short answer, long proof.
+A skill runs only when the owner types `/ll-<name>`. The session never starts one on its own, never runs one on the
+owner's behalf, never calls the Skill tool on an ll skill and never redirects a request to a skill: whatever the owner
+asks is answered or done as asked, in any repository, whether or not `PLAN.md`, `PROGRESS.md`, `phases/` or
+`decisions/` exist. A command is named only when the owner asks which command to use. `ll-auto` is the single place
+that follows another skill's instructions, and only while the owner invoked `/ll-auto`.
+A request that is a verb plus an addressable target and fits in about three tool calls gets the work itself, not a
+ritual: read the target, do what is authorized, verify with a number, label provenance; no spec, no plan, no PROGRESS
+entry, no VERIFICATION, no premortem, no interview, no subagent, no automatic commit, no two questions in a row. When
+a small request turns out to be large (a bigger root cause, a chained delivery, a new folder or repo), say so in one
+line. A skill never invokes another skill and never decides the owner's next request; `ll-implement` covers one phase
+per invocation. Every skill ends in a repository file and prints "▶ Next — /clear, then <command>" for the owner to
+paste; that line ends the turn, no tool call follows it. State lives at the repo root (`PLAN.md`, `PROGRESS.md`,
+`phases/`, `decisions/`), never in a subfolder, written as it happens. Reply to the owner in Portuguese, in their
+words (marco, onda, gate, contexto limpo, fiel); every file is English. Short answer, long proof.
 
 ## Delegation
 The session orchestrates; subagents execute, verify, scout and review, never orchestrate; depth 1 — an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ll-skills",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Evidence-driven development pipeline for Claude Code: router preamble, 12 skills (auto, brainstorm, research, decide, goal, implement, verify, close, resume, refine, oncall, update), 4 agents, 3 hooks and a state helper",
   "bin": {
     "ll-skills": "bin/install.js"

package/scripts/evals/README.md

@@ -6,7 +6,7 @@ copy of a fixture repository, and scores the answer and the work tree with a she
 
     bash scripts/evals/run.sh --dry-run --all              # print the commands, call nothing
     bash scripts/evals/run.sh --case router-small --reps 1 # one case, one rep
-    bash scripts/evals/run.sh --all                        # thirteen cases, three reps
+    bash scripts/evals/run.sh --all                        # twelve cases, three reps
 
 `--all` | `--case <id>` (repeatable) | `--reps N` (default 3) | `--model <id>` | `--dry-run`.
 Exit 0 when every selected case passed in at least `min_pass` reps (`case.json`, capped at the
@@ -14,7 +14,7 @@ reps actually run, so `--reps 1` means 1 of 1).
 
 ## Cost
 
-Router cases are 1–6 turns and cost cents. The six agent and skill cases run 30–40 turns: dollars
+Router cases are 1–8 turns and cost cents. The six agent and skill cases run 30–40 turns: dollars
 per rep, tens of dollars for `--all --reps 3` — a skill that fans out subagents costs about a dollar
 per turn-block, so keep routing caps low. Dry run first, then one cheap case.
 
@@ -34,6 +34,30 @@ preprocessor Bash calls together with the model's own tool calls, and a run has
 `num_turns 7` under `--max-turns 4`. Pin each cap above the highest count real reps show (`case.json`
 `note`), so the cap only ever cuts a run that really went long.
 
+## Router cases
+
+A skill runs only when the owner types it, so these cases score what the session does with a plain
+request — never which command it names back.
+
+| case | prompt | what it scores |
+|---|---|---|
+| `router-small` | `conta as linhas de README.md` | the answer itself: nothing written, no ritual, no Skill call |
+| `router-no-skill` | a research request in a repo that carries `PLAN.md` and `decisions/` | the research itself: no command handed back, no `▶ Next`, no Skill call, nothing created |
+| `preamble-no-ritual` | a one-line typo fix | no spec, no plan, no `PROGRESS.md`, no subagent |
+
+A case that exercises a skill types the slash command in its `prompt.txt` (`/ll-implement 7`,
+`/ll-decide project …`): a skill is never started from prose, so a prose prompt would score the
+plain answer, not the skill.
+
+## Cases proven offline
+
+The `router-no-skill` (research delivered, no command handed back), `decide-final-round`
+(decision-room path before the first question, count line in plain words) and
+`implement-stops-at-next` (wave line before the epilogue, helper never read) asserts are proven
+without calling `claude -p` by `npm test` (section `evals-auto`), against the captures and answers
+under `fixtures/router-no-skill/` — `out.json`, a compliant `pass.txt` and a `fail.txt` that only
+hands a command back — and the inline captures the smoke test builds.
+
 ## Results — outside the repo
 
 Each run writes `$LL_EVAL_RESULTS/<YYYY-MM-DD-HHMM>/` (default `~/.claude/ll-skills-evals`, outside the repo): `RESULTS.md`,

package/scripts/evals/cases/decide-final-round/assert.sh

@@ -6,7 +6,7 @@ WORK="$1"; OUT_JSON="$2"; OUT_TXT="$3"
 
 # a one-shot run has no owner to answer: either the final round (counter) or a blocking gate block (≤ 4 questions) is the correct stop
 if grep -qE 'questions asked' "$OUT_TXT"; then
-  contains "$OUT_TXT" 'band-1 open' 'the final round carries "band-1 open"'
+  contains "$OUT_TXT" 'owner decisions open' 'the final round carries "owner decisions open"'
 else
   contains "$OUT_TXT" '\[PG-1\]|Pergunta 1/|Question 1/' 'the gate asks its first question instead of assuming'
   n="$(grep -cE '^\*\*\[PG-[0-9]+\]|^\*\*Pergunta [0-9]+/|^\*\*Question [0-9]+/' "$OUT_TXT")"
@@ -14,7 +14,20 @@ else
   no_path "$WORK/PLAN.md" 'nothing frozen while the gate is open'
 fi
 
-# The contract is only scored when it was written: with a band-1 item open, nothing freezes.
+# The decision room is handed over before the first question, never after it (F-5).
+if grep -qE 'OPTIONS\.html' "$OUT_TXT"; then
+  opt="$(grep -nE 'OPTIONS\.html' "$OUT_TXT" | head -1 | cut -d: -f1)"
+  q="$(grep -nE 'Pergunta 1/|Question 1/' "$OUT_TXT" | head -1 | cut -d: -f1)"
+  if [ -z "$q" ] || [ "$opt" -lt "$q" ]; then
+    ok "the decision-room path (line $opt) comes before the first question"
+  else
+    fail "the decision-room path (line $opt) comes after the first question (line $q)"
+  fi
+else
+  ok 'no decision-room path in this answer: the room was not opened, so the order is not scored'
+fi
+
+# The contract is only scored when it was written: with an owner-only item open, nothing freezes.
 if [ -f "$WORK/PLAN.md" ]; then
   contains "$WORK/PLAN.md" '^## ' 'PLAN.md carries ## sections'
   if [ -d "$WORK/decisions" ]; then

package/scripts/evals/cases/decide-final-round/case.json

@@ -4,5 +4,5 @@
   "min_pass": 2,
   "agent": null,
   "permission_mode": "bypassPermissions",
-  "note": "Empty fixture so the LARGE route has nowhere to resume from. The final round is always sent, even when every item was band 2/3, so the counter must appear whether or not PLAN.md was frozen."
+  "note": "Prompt is the slash command itself: since 3.0.0 the session never starts a skill from prose (preamble), so a prose prompt only hands the command back. Empty fixture so the LARGE route has nowhere to resume from. The final round is always sent, even when every item was band 2/3, so the counter must appear whether or not PLAN.md was frozen."
 }

package/scripts/evals/cases/decide-final-round/prompt.txt

@@ -1 +1 @@
-escreva o plano para um serviço que envia lembretes por e-mail
+/ll-decide project serviço que envia lembretes por e-mail

package/scripts/evals/cases/implement-review-gate/assert.sh

@@ -20,9 +20,11 @@ first_feat="$(git -C "$WORK" log ${range:+"$range"} --reverse --format='%ct %s'
 if [ -z "$first_feat" ]; then
   ok 'this run committed no feat(: nothing could precede the gate'
 else
-  # When the review was committed, git dates it; otherwise fall back to the file mtime.
-  review_ct="$(git -C "$WORK" log --diff-filter=A --format=%ct -- "$REVIEW" | tail -1)"
-  [ -n "$review_ct" ] || review_ct="$(stat -c %Y "$WORK/$REVIEW" 2>/dev/null)"
+  # The review is written once by the verifier and committed later with the phase state, so the
+  # earliest evidence dates it: the file mtime, or its commit when that is older.
+  review_ct="$(stat -c %Y "$WORK/$REVIEW" 2>/dev/null)"
+  review_commit="$(git -C "$WORK" log --diff-filter=A --format=%ct -- "$REVIEW" | tail -1)"
+  if [ -n "$review_commit" ] && { [ -z "$review_ct" ] || [ "$review_commit" -lt "$review_ct" ]; }; then review_ct="$review_commit"; fi
   if [ -n "$review_ct" ] && [ "$review_ct" -le "$first_feat" ]; then
     ok "the gate ($review_ct) precedes the first feat( of this run ($first_feat)"
   else

package/scripts/evals/cases/implement-review-gate/case.json

@@ -4,5 +4,5 @@
   "min_pass": 2,
   "agent": null,
   "permission_mode": "bypassPermissions",
-  "note": "No executor is dispatched until phases/07/PLAN-REVIEW.md is on disk; and one invocation plans one phase, so phases/08/ must stay untouched."
+  "note": "--no-talk so a one-shot run never waits on an owner-only question: the cents item (DEC-0041) becomes WAITING, M5/M6/M7 get stop: owner, and the review gate must still be written for M1/M2/M4. No executor is dispatched until phases/07/PLAN-REVIEW.md is on disk; and one invocation plans one phase, so phases/08/ must stay untouched."
 }

package/scripts/evals/cases/implement-review-gate/prompt.txt

@@ -1 +1 @@
-implementa a fase 7
+/ll-implement 7 --no-talk

package/scripts/evals/cases/implement-stops-at-next/assert.sh

@@ -36,4 +36,86 @@ fi
 
 contains "$OUT_TXT" '/clear' 'the next command is handed over with /clear'
 
+# The waves are visible while they run, not only in the epilogue (F-4).
+# The wave line is printed mid-run, so it lives in an earlier assistant text block, not in the final
+# answer: scan the capture in order and map it onto the same scale as the epilogue check.
+onda="$(node -e '
+  const fs = require("fs");
+  let data; try { data = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); } catch { process.exit(0); }
+  const events = Array.isArray(data) ? data : [data];
+  let n = 0, hit = 0, epi = 0;
+  for (const ev of events) {
+    if (!ev || ev.type !== "assistant") continue;
+    const content = ev.message && ev.message.content;
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b) continue;
+      // a one-shot run prints no mid-run text: the wave heartbeat is the proxy; the screen line is checked by the lab rubric
+      if (b.type === "tool_use" && !hit && /heartbeat\s+\\?"(wave|onda) 1\//.test(JSON.stringify(b.input || {}))) hit = n + 1;
+      if (b.type !== "text") continue;
+      n++;
+      if (!hit && /(^|\n)onda 1\//.test(b.text || "")) hit = n;
+      if (!epi && /## Epilogue|▶ Next/.test(b.text || "")) epi = n;
+    }
+  }
+  if (hit) process.stdout.write(String(hit));
+' "$OUT_JSON")"
+close_block="$(node -e '
+  const fs = require("fs");
+  let data; try { data = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); } catch { process.exit(0); }
+  const events = Array.isArray(data) ? data : [data];
+  let n = 0;
+  for (const ev of events) {
+    if (!ev || ev.type !== "assistant") continue;
+    const content = ev.message && ev.message.content;
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b || b.type !== "text") continue;
+      n++;
+      if (/## Epilogue|▶ Next/.test(b.text || "")) { process.stdout.write(String(n)); process.exit(0); }
+    }
+  }
+' "$OUT_JSON")"
+close="$(grep -nE '^## Epilogue|▶ Next' "$OUT_TXT" | head -1 | cut -d: -f1)"
+if [ -z "$onda" ]; then
+  fail 'no "onda 1/M" line: the first wave ran with no visible progress'
+elif [ -n "$close_block" ] && [ "$onda" -gt "$close_block" ]; then
+  fail "the onda 1/M line (text block $onda) comes only after the epilogue (text block $close_block)"
+else
+  ok "the first wave is announced on screen (line $onda), before the epilogue"
+fi
+
+# The helper is called, never read (F-7): no shell that cats/seds/greps it, no Read of it.
+reads="$(node -e '
+  const fs = require("fs");
+  let data; try { data = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); }
+  catch { process.stdout.write("unparseable out.json"); process.exit(0); }
+  const events = Array.isArray(data) ? data : [data];
+  const shell = /(^|[\s;|&(])(cat|sed|grep|head|tail|less)\b[^\n;|&]*ll-tools\.js/; // the reading verb starts a command and the helper is its argument
+  for (const ev of events) {
+    if (!ev || ev.type !== "assistant") continue;
+    const content = ev.message && ev.message.content;
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b || b.type !== "tool_use") continue;
+      const input = b.input || {};
+      if (b.name === "Bash" && shell.test(String(input.command || ""))) {
+        process.stdout.write("a Bash call reads the helper: " + String(input.command).slice(0, 80));
+        process.exit(0);
+      }
+      if (b.name === "Read" && /ll-tools\.js$/.test(String(input.file_path || ""))) {
+        process.stdout.write("a Read call opens the helper: " + String(input.file_path));
+        process.exit(0);
+      }
+    }
+  }
+  process.stdout.write("");
+' "$OUT_JSON")"
+
+if [ -z "$reads" ]; then
+  ok 'the helper was called, never read'
+else
+  fail "$reads"
+fi
+
 finish

package/scripts/evals/cases/implement-stops-at-next/prompt.txt

@@ -1 +1 @@
-implementa a fase 7
+/ll-implement 7 --no-talk

package/scripts/evals/cases/router-no-skill/assert.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# A skill runs only when the owner types it: a plain research request is answered here and
+# now — no command handed back to paste, no ▶ Next, no Skill tool call — even though the
+# fixture carries ll-skills state (PLAN.md, decisions/).
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")/../../lib" && pwd)/assert.sh"
+
+WORK="$1"; OUT_JSON="$2"; OUT_TXT="$3"
+
+# The queue engines a real answer names. Longest alternative first: grep -E is leftmost-longest,
+# so "bullmq" never scores as "bull".
+QUEUES='bullmq|bee-queue|pg-boss|rabbitmq|graphile|bull|redis|sqs|kafka|agenda'
+
+absent "$OUT_TXT" '▶ Next' 'the answer ends in no ▶ Next: this turn is not a skill hand-off'
+
+if [ -f "$OUT_TXT" ] && grep -Eqi -- 'cole:|cole isto|cole o comando|paste this' "$OUT_TXT"; then
+  fail "the answer hands a command back to paste: $(grep -Eio -- 'cole:|cole isto|cole o comando|paste this' "$OUT_TXT" | head -1)"
+else
+  ok 'the answer hands no command back to paste'
+fi
+
+n="$(grep -Eoi -- "$QUEUES" "$OUT_TXT" 2>/dev/null | tr 'A-Z' 'a-z' | sort -u | wc -l)"
+if [ "${n:-0}" -ge 2 ]; then
+  ok "the research was done here: $n queue options named"
+else
+  fail "the answer names $n queue option(s): the research was not done"
+fi
+
+no_tool_use "$OUT_JSON" Skill 'no Skill tool call anywhere in the capture'
+
+no_path "$WORK/PROGRESS.md" 'no PROGRESS.md was created'
+no_path "$WORK/phases"      'no phases/ was created'
+
+finish

package/scripts/evals/cases/router-no-skill/case.json

@@ -0,0 +1,8 @@
+{
+  "max_turns": 8,
+  "history": false,
+  "min_pass": 2,
+  "agent": null,
+  "permission_mode": "acceptEdits",
+  "note": "A skill runs only when the owner types it. A plain request is done as asked, never handed back as a command to paste — and the fixture carries ll-skills state (PLAN.md, decisions/) to prove the claim where a router would be loudest. No PROGRESS.md, so nothing competes with the answer. max_turns 8 leaves room for a couple of reads before the answer."
+}

package/scripts/evals/cases/router-no-skill/fixture/PLAN.md

@@ -0,0 +1,21 @@
+# PLAN — now
+
+## §0 Precedence
+
+This file is the entry of the work; the project CLAUDE.md wins over it.
+
+## §1 Objective and truths
+
+One sentence of delivery: the CLI prints the local time and exits 0.
+
+- T1 `node now.js` prints one line and exits 0. — `node now.js`
+
+## §2 Invariants
+
+I-01 NEVER delete, disable or weaken a test or acceptance criterion. [owner]
+
+## §3 Owner decisions
+
+| id | question | decision | by | date |
+|---|---|---|---|---|
+| — | none recorded yet | — | — | — |

package/scripts/evals/cases/router-no-skill/fixture/README.md

@@ -0,0 +1,7 @@
+# now
+
+A tiny CLI that prints the time.
+
+## Run
+
+    node now.js

package/scripts/evals/cases/router-no-skill/fixture/decisions/README.md

@@ -0,0 +1,3 @@
+# decisions
+
+One file per recorded decision, `DEC-NNNN-<slug>.md`. Empty until the first one is written.

package/scripts/evals/cases/router-no-skill/prompt.txt

@@ -0,0 +1 @@
+pesquise as opções de fila para Node e me diz qual você usaria num projeto pequeno

package/scripts/evals/fixtures/router-no-skill/fail.txt

@@ -0,0 +1,5 @@
+Isso é trabalho do skill de pesquisa: eu não inicio um skill por conta própria. Cole o comando `/ll-research`:
+
+    `/ll-research opções de fila para Node`
+
+O skill compara as opções, confere as fontes e escreve `docs/research/RESEARCH.md`.

package/scripts/evals/fixtures/router-no-skill/out.json

@@ -0,0 +1,27 @@
+[
+  {
+    "type": "system",
+    "subtype": "init",
+    "session_id": "router-no-skill-fixture",
+    "model": "claude-sonnet-5"
+  },
+  {
+    "type": "assistant",
+    "message": {
+      "role": "assistant",
+      "content": [
+        {
+          "type": "text",
+          "text": "Para um projeto pequeno em Node eu usaria `bullmq` sobre `redis`: fila com retry e dead-letter prontos.\nAs outras que olhei: `pg-boss` no Postgres, `rabbitmq` e `sqs`."
+        }
+      ]
+    }
+  },
+  {
+    "type": "result",
+    "subtype": "success",
+    "is_error": false,
+    "num_turns": 3,
+    "result": "Para um projeto pequeno em Node eu usaria `bullmq` sobre `redis`: fila com retry e dead-letter prontos.\nAs outras que olhei: `pg-boss` no Postgres, `rabbitmq` e `sqs`."
+  }
+]

package/scripts/evals/fixtures/router-no-skill/pass.txt

@@ -0,0 +1,4 @@
+Para um projeto pequeno em Node eu usaria `bullmq` sobre `redis`: fila durável, retry, backoff e dead-letter já vêm prontos.
+As outras que valem olhar: `pg-boss` (a fila mora no Postgres — uma dependência a menos quando o banco já existe), `rabbitmq` (roteamento rico, mas é mais um serviço para operar) e `sqs` (gerenciado, com o preço de amarrar o projeto à AWS).
+Regra prática: enquanto tudo couber num processo e o Postgres já estiver de pé, `pg-boss`; quando precisar de concorrência, rate limit e repetição por fila, `bullmq`.
+Nada disso foi medido aqui: é leitura de documentação, não `benchmark` rodado por mim.

package/scripts/fixtures/lint-bad/jargon-in-questions/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: ll-fake
+description: Prints the owner's questions with the internal vocabulary still in them, so lint rule 9 has something to catch.
+argument-hint: "[--no-talk]"
+disable-model-invocation: true
+---
+
+# ll-fake
+
+## Flow
+
+1. Print the round:
+
+**Pergunta 1/2 — limite de título [DEC-0001]** (impacto ALTO · desfazer: barato)
+
+**Question 2/2 — retenção [ASM-3]** (impact LOW)
+
+**[PG-1] Pergunta 1/5 — janela de retenção** (impacto ALTO · desfazer: caro)
+
+2. Print the counter: `questions asked 2 / assumptions 1 / band-1 open 1`
+
+3. The Portuguese line: `perguntas 2 / assunções 1 · decisões [D-07-01] em aberto 1`
+
+4. Print the label the owner never reads: esta é uma banda 1, só o dono decide.
+
+## Deliverables
+
+| File | Role | Mutability |
+| --- | --- | --- |
+| `docs/fake.md` | nothing | rewritten |
+
+## Completion criterion
+
+Done when the file exists.
+
+▶ Next — `/clear`, then `/ll-resume`

package/scripts/fixtures/project/BACKLOG.md

@@ -1,10 +1,11 @@
 # BACKLOG — fixture project
 
-| id | born (phase / commit) | type | closing condition (executable) | state |
-|---|---|---|---|---|
-| B-014 | 07 / a1b2c3d | stub | `true` exit 0 | OPEN |
-| B-015 | 07 / b2c3d4e | deviation | `false` exit 0 | OPEN |
-| B-016 | 06 / c3d4e5f | debt | `true` exit 0 | CLOSED |
+| id | born (phase / commit) | type | closing condition (executable) | note | state |
+|---|---|---|---|---|---|
+| B-014 | 07 / a1b2c3d | stub | `true` exit 0 | — | OPEN |
+| B-015 | 07 / b2c3d4e | deviation | `false` exit 0 | — | OPEN |
+| B-016 | 06 / c3d4e5f | debt | `true` exit 0 | — | CLOSED |
+| B-017 | 07 / a1b2c3d | debt | run `npm test` and check exit | — | OPEN |
 
 types: deviation | stub | test-not-run | debt | domain-question
 

package/scripts/fixtures/project/PROGRESS.md

@@ -57,5 +57,5 @@ not_verified: backoff under real network latency
 
 passed: M1 · left: M2 (acceptance red), M3 (BLOCKED: DEC-0041) · WAITING: DEC-0041 (cents rounding) ·
 new backlog: B-014, B-015 · actions that need you: decide DEC-0041 before wave 3
-milestones passed 2/3 · questions asked 3 / assumptions 1 (ASM-1) / band-1 open 0 · amendments 1 · verification: phases/07/VERIFICATION.md APPROVED
+milestones passed 2/3 · questions asked 3 / assumptions 1 (ASM-1) / owner decisions open 0 · amendments 1 · verification: phases/07/VERIFICATION.md APPROVED
 ▶ Next — `/clear`, then `ll-implement 8`

package/scripts/lint-prompts.sh

@@ -3,7 +3,9 @@
 # with disable-model-invocation: true and a plain one-line description, 60-300
 # chars, no trigger phrase), agent frontmatter, line ceilings and the preamble
 # without a router, section shape, forbidden strings, identical copies, language
-# and an optional private word list. One line per rule; exit 1 on any FAIL.
+# an optional private word list and plain questions (no band label, decision id,
+# question id or assumption id on a question header or a count line, and no
+# Portuguese band label anywhere in the prose). One line per rule; exit 1 on any FAIL.
 # Usage: lint-prompts.sh [--rule N]   (no flag runs every rule)
 set -euo pipefail
 ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
@@ -31,6 +33,16 @@ ALLOWED_TOOLS_BY_SKILL = {"ll-auto": "Bash(${CLAUDE_SKILL_DIR}/scripts/ll-auto.j
 ORCHESTRATOR = ["ll-auto"]
 # Strings the global preamble must not carry: they route a request to a skill.
 PREAMBLE_FORBIDDEN = ["Route every request", "One word from the owner"]
+# Rule 9 — the owner's screen carries no internal vocabulary (DEC-0018): a question
+# header or a count line never names a band, a decision id or an assumption id, and
+# the retired count wording is gone from the prose.
+QUESTION_LINE = re.compile(r"Pergunta [0-9]+/|Question [0-9]+/|questions asked|perguntas [0-9N]+")
+JARGON = ["band-1", "[DEC-", "[D-", "[PG-", "ASM-"]
+OLD_COUNT = "band-1 open"
+# The same label in Portuguese is never on the owner's screen, question line or not.
+BAND_PT = re.compile(r"banda[ -]1", re.IGNORECASE)
+BAND_PT_TREES = ("skills", "agents", "assets")
+
 PT = re.compile(r"[ãõçáéíóúâêô"
                 r"ÃÕÇÁÉÍÓÚÂÊÔ]")
 
@@ -202,10 +214,10 @@ def rule3():
     helper = read("scripts/ll-tools.js")
     hn = len(helper.split("\n")) - 1
     hb = os.path.getsize(path("scripts/ll-tools.js"))
-    if hn > 700:
-        bad.append(("scripts/ll-tools.js", "%d lines, ceiling 700" % hn))
-    if hb > 32768:
-        bad.append(("scripts/ll-tools.js", "%d bytes, ceiling 32768" % hb))
+    if hn > 760:
+        bad.append(("scripts/ll-tools.js", "%d lines, ceiling 760" % hn))
+    if hb > 36000:
+        bad.append(("scripts/ll-tools.js", "%d bytes, ceiling 36000" % hb))
     checked += 1
     pack_json_override = os.environ.get("LL_PACK_JSON")
     if pack_json_override:
@@ -367,6 +379,40 @@ def rule8():
         bad.append((parts[0], "line %s matches the private word list" % (parts[1] if len(parts) > 1 else "?")))
     return bad, len(files)
 
+def rule9():
+    # The prose the owner reads. Fixtures are exempt: scripts/fixtures/*/PROGRESS.md
+    # keeps the old wording as the proof that a 3.0.0 file still parses.
+    prose = [f for f in TRACKED
+             if f.split("/")[0] in ("skills", "agents", "assets")
+             or f.startswith("scripts/evals/cases/")]
+    # The helper is scanned for the retired wording only: its epilogue regex reads both
+    # spellings on purpose, so the alternation is not a question line on anyone's screen.
+    # An eval assert is not a screen: it names the forbidden id inside the pattern it
+    # scores, so the question-line scan skips it. The retired count wording is still
+    # scanned there, and in the helper, for everyone.
+    files = sorted(f for f in set(prose)
+                   if not re.fullmatch(r"scripts/evals/cases/[^/]+/assert\.sh", f))
+    extra = sorted(f for f in set(prose) if f not in files)
+    bad = []
+    for f in files + extra + ["scripts/ll-tools.js"]:
+        # The Portuguese label is prose the owner reads: scanned over skills/, agents/ and
+        # assets/ whole, not only on a question line, and not over the helper.
+        scan_band = f.split("/")[0] in BAND_PT_TREES
+        for i, line in enumerate(read(f).split("\n"), 1):
+            if OLD_COUNT in line:
+                bad.append((f, "line %d: the retired count wording %r is still here" % (i, OLD_COUNT)))
+            if scan_band:
+                hit = BAND_PT.search(line)
+                if hit:
+                    bad.append((f, "line %d: the internal label %r is on the owner's screen"
+                                % (i, hit.group(0))))
+            if f not in files or not QUESTION_LINE.search(line):
+                continue
+            for word in JARGON:
+                if word in line:
+                    bad.append((f, "line %d: a question or count line names %r" % (i, word)))
+    return bad, len(files) + len(extra) + 1
+
 RULES = [
     (1, "skill frontmatter", rule1),
     (2, "agent frontmatter", rule2),
@@ -376,6 +422,7 @@ RULES = [
     (6, "identical copies", rule6),
     (7, "language", rule7),
     (8, "private word list", rule8),
+    (9, "plain questions", rule9),
 ]
 
 failed = False