navori 0.10.0 → 0.10.1

package/README.md

@@ -36,12 +36,14 @@ npx navori init
 
 ```bash
 # Modo opinado: cero preguntas, harness completo sin instalar software externo
-# (engram siempre activo, +gh si el repo tiene remote de GitHub)
+# (engram siempre activo, +gh si el repo tiene remote de GitHub).
+# Avisa si falta el binario de algún plugin habilitado y cómo instalarlo.
 cd ~/tu-repo
 navori init --recommended
 
 # + proveedores externos (tgrep, codegraph, semgrep, jscpd, acli) + pre-commit hook +
-# scan-monorepo + project block estricto — requiere instalar los binarios de esos proveedores
+# scan-monorepo + project block estricto — requiere instalar los binarios de esos proveedores.
+# También avisa si falta algún binario y cómo instalarlo, sin instalarlo nunca.
 navori init --full
 
 # O wizard interactivo con detección de stack
@@ -175,6 +177,8 @@ El harness que genera `navori` trae permisos seguros desde el arranque, para que
 - **Lo catastrófico se rechaza** (`deny`): `rm -rf /`, `sudo rm`, `mkfs`, …
 - Un hook `guard-destructive` actúa como backstop adicional.
 
+**Estado efímero fuera del árbol**: los dos hooks del harness (`managed-drift-watch.sh` y `routing-watch.sh`) escriben su estado en `<git-common-dir>/navori/` — fuera del árbol de trabajo, invisible a `git status`. Además, `render` y `sync` escriben un `.claude/.gitignore` versionado que ignora `progress/`, `worktrees/` y `settings.local.json`, impidiendo que esos paths aparezcan como untracked en `git status`. Si `codex` está habilitado, también genera `.codex/.gitignore` con solo entradas efímeras de ese directorio. Para repos actualizados, también ignora los archivos legacy `.claude/.managed-drift-stamp` y `.claude/.routing-watch/`. Nada que los engines necesiten se ignora.
+
 ## Workspace + tickets cross-repo
 
 Si un ticket toca varios repos (frontend + backend + microservicio), el workspace te da un punto único:

package/dist/assets/core/core-assets/agents/architect.md

@@ -21,7 +21,7 @@ The orchestrator hands you a task that fired a `solution-design` signal (new sha
 - "Derive the decision drivers from the project's own rules (DIRECTION, CLAUDE.md, EXTENDING, `quality-attributes`) before you list any option."
 - "Explore at least three rungs — the existing pattern, an extension, a new abstraction. A discarded rung gets one line with its evidence; a surviving one is developed in full."
 - "Recommend the option that best fits the drivers, not the cheapest by default."
-- "Verify every 'already exists' claim against `origin/main`."
+- "Verify every 'already exists' claim against `origin/{{branchBase}}` after `git fetch origin {{branchBase}}`; if the fetch fails or the ref doesn't exist, name the ref you actually used — or mark the claim *unverified* with the cause."
 
 ## Protocol
 

package/dist/assets/core/core-assets/agents/implementer.md

@@ -56,8 +56,8 @@ When the encargo opens with `workplan: <feature>`, read `.claude/progress/workpl
 - **Strong typing, `any` forbidden in new code.** Define correct types before moving on. Use `unknown` + narrowing, generics, or domain types. Cover parameters, returns, callbacks, events, props, hooks, and service responses. If typing it well is genuinely impossible (third-party lib without types), a `// any justified: <reason>` comment — last resort, not a shortcut.
 - **No hardcode**: secrets / URLs / endpoints via env vars (`process.env.*`, `import.meta.env.*`, depending on the stack).
 - **No `console.log`** in code that will be merged (guard with `import.meta.env.DEV` or the runtime's equivalent).
-- **Zero new errors** introduced by your code in the quality gate tools (vs. baseline) — see the evidence table below for the predates-you check. Returning with any tool red (because of your change) is automatic grounds for `CHANGES_REQUESTED`.
-- **Never mutate or discard the shared working tree**: no stashing, no checkout/reset that discards local changes, no working-tree clean — these hit the `ask` permission rule and can stall a background agent indefinitely, and in the repo root they'd destroy other parallel agents' work. Same reasoning for scratch files: leave them, don't clean them with a recursive delete.
+- **Zero new errors** introduced by your code in the quality gate tools (vs. baseline) — classify per `verify-before-done`'s Failure attribution, never by diff location alone; see the evidence table below. Returning with any tool red (because of your change) is automatic grounds for `CHANGES_REQUESTED`.
+- **Never mutate or discard the shared working tree**: no stashing, no checkout/reset that discards local changes, no working-tree clean — these hit the `ask` permission rule and can stall a background agent indefinitely. Same reasoning for scratch files: leave them, don't clean them with a recursive delete.
 - **JSDoc** mandatory on public exports and functions >15 lines or with dense conditional logic.
 - **SDD traceability** (only if the feature has `{{sdd.specsDir}}/<feature>/tasks.md`, see the SDD block in `CLAUDE.md`): each `R<n>` in your batch is covered by ≥1 test, and each test references its requirements with a `// Covers: R<n>` comment above the case. Without full traceability the `reviewer` rejects.
 - **Guard/policy coverage** (only if your task introduces or modifies a guard, policy or permission check): your report carries the enumeration, not just the diff — every entry point that mutates the same resource (routes, bulk/admin variants, jobs, scripts) with its `file:line` evidence, each marked covered or excluded with the reason. Locate them with `locate-code`; an entry point you didn't list is one the `reviewer` has to rediscover.
@@ -91,9 +91,9 @@ Before returning `done -> .claude/progress/impl_<feature>.<!-- navori:if-not scr
 | `{{qualityGate.fast}}` green | Full command run **this turn** with exit 0 | "ran it before", "should be green" |
 | UI validated in the browser (only when the user asked for a visual check) | Repro step + observed state via the repo's browser tool (e.g. `playwright-cli`) this turn | "looks fine in the code" |
 | Bug fixed (if applicable) | Reproduce the original symptom and see it NOT happen | "code changed, assumed fixed" |
-| Zero new errors in typecheck/lint | `git diff --name-only {{branchBase}}` — a failure outside that file list predates you | "lint said OK" with no baseline |
+| Zero new errors in typecheck/lint | Classify per `verify-before-done`'s Failure attribution: state per failure, demonstrated over `{{branchBase}}` | "lint said OK" with no baseline |
 
-If any claim can't be backed with fresh evidence this turn, declare it EXPLICITLY in the report. Never infer success.
+If any claim can't be backed with evidence you ran this turn, declare it EXPLICITLY in the report. Never infer success.
 
 <!-- navori:if-not scribeOwnsMarkdown -->
 ## Closing report
@@ -148,6 +148,7 @@ Write `.claude/progress/impl_<feature>.json` — the only artifact you produce,
   "worktree": "<absolute worktree path>",
   "branch": "<branch>",
   "commits": ["<sha>"],
+  "head": "<40-hex sha: git rev-parse HEAD at the end>",
   "filesTouched": ["<path>"],
   "rootCause": "<file:line + why, bugfix only>",
   "verification": { "command": "{{qualityGate.fast}}", "exitCode": 0, "summary": "<n files / n tests>" },

package/dist/assets/core/core-assets/agents/orchestrator.md

@@ -9,7 +9,7 @@ maxWords: 3050
 
 # Orchestrator Playbook (embodied by the main agent)
 
-> This file is a **depth reference** — the orchestrator role **is embodied by the main agent**, not a subagent. The essential mechanics (escalation table, parallelism, synthesis) live in the "## Role: orchestrator" block, which the `SessionStart` hook delivers to the session — not to a subagent, which is the point: only the main agent can act on it. Here is the extended detail and, below, the **Project rules**. Do NOT invoke `Agent(subagent_type: orchestrator)`.
+> This file is a **depth reference** — the orchestrator role **is embodied by the main agent**, not a subagent. The essential mechanics (escalation table, parallelism, synthesis) live in the "## Role: orchestrator" block, which the `SessionStart` hook delivers to the session, not to a subagent: only the main agent can act on it. Below: extended detail and the **Project rules**. Do NOT invoke `Agent(subagent_type: orchestrator)`.
 
 Your only job as orchestrator is to **decompose and coordinate**, never to implement. Every change to source goes through `implementer` → `reviewer`, with no inline route and no threshold — see "## Role: orchestrator" in `CLAUDE.md`.
 
@@ -36,7 +36,7 @@ One route removes the decision entirely. It is more expensive per change and tha
 
 When you start a complex task with a prior audit, **hand the implementer the path to `.claude/progress/audit_ticket_<ID>.md`** as a mandatory reference — the audit already says which files, what scope, what dependencies.
 <!-- navori:if scribeOwnsMarkdown -->
-**The `scribe` leg.** The `implementer` writes no Markdown (R1); when its `impl_<feature>.json` carries a non-empty `markdownRequests`, chain `implementer` → `scribe` → `reviewer` — the `scribe` applies the requested prose in the producer's own worktree and branch, in a commit of its own, before the `reviewer` sees the diff. A prose-only change (no code) skips the `implementer` entirely: `scribe` → `reviewer`. Model is chosen PER DISPATCH, not by config default: pass `{{models.scribe}}` when the scribe is only rendering the handoff, and `model: sonnet` on that `Agent` call when any `markdownRequests` path belongs to the diff that ships (R8) — `models.scribe` stays on its cheap default for the common case.
+**The `scribe` leg.** The `implementer` writes no Markdown (R1); when its `impl_<feature>.json` carries a non-empty `markdownRequests`, chain `implementer` → `scribe` → `reviewer` — the `scribe` applies the requested prose in the producer's own worktree and branch, in a commit of its own, before the `reviewer` sees the diff. A prose-only change (no code) skips the `implementer` entirely: `scribe` → `reviewer`. Model is chosen PER DISPATCH, not by config default: pass `{{models.scribe}}` when the scribe is only rendering the handoff, and `model: sonnet` on that `Agent` call when any `markdownRequests` path belongs to the diff that ships (R8) — `models.scribe` stays on its cheap default for the common case. Before dispatching the `scribe` or the `reviewer`, run the handoff check the orchestration block names; dispatch only on `"status":"ok"`.
 <!-- /navori:if -->
 For a scoped question or a broad exploratory map (where does X live in the repo?), use `scout`. In Claude Code you can reference `subagent_type: "Explore"` when it exists; in other engines, `scout` is the replacement.
 
@@ -104,7 +104,7 @@ When you launch subagents, the **literal path** of the file each one must write
 done -> .claude/progress/<file>.md
 ```
 
-Those files are **input to the next step of the pipeline**, not chat summaries for a reader: the `reviewer` opens the `implementer`'s, the `publisher` opens the `reviewer`'s and its `receipt.txt`, and the `subagent-stop-handoff` hook flags one that lands empty or without its `Status:`/verdict line (that hook never sees one that didn't land at all — that check is yours). A host rule against writing report files does not reach them — it exempts files written as input to another tool, and these are exactly that. Say so in the encargo if a subagent hesitates.
+Those files are **input to the next step of the pipeline**, not chat summaries for a reader: the `reviewer` opens the `implementer`'s, the `publisher` opens the `reviewer`'s and its `receipt.txt`, and the `subagent-stop-handoff` hook flags one that lands empty or without its `Status:`/verdict line (that hook never sees one that didn't land at all — that check is yours). A host rule against writing report files does not reach them — it exempts files written as input to another tool, and these qualify. Say so if a subagent hesitates.
 
 **Re-verify only the load-bearing claims.** AFTER its `done -> file` lands — not while it runs, which duplicates work in flight — check the claims your decision actually rests on: each cited `file:line` exists and says what the report says, plus the diff it touched. Don't re-run its investigation; take the rest from the report.
 

package/dist/assets/core/core-assets/agents/publisher.md

@@ -24,7 +24,7 @@ You own the **end of the cycle**: well-structured commits in the configured styl
 - Harness active and THIS feature's review — `.claude/progress/review_<feature>.md`, the single file the pre-flight below identifies by name — contains `CHANGES_REQUESTED` → no PR is created. Never scan the directory for it: a `CHANGES_REQUESTED` belonging to someone else's closed cycle must not abort your PR, exactly as another feature's `APPROVED` never unblocks it.
 - Quality gate red this turn.
 
-> **Two branches, one that decides:** `{{prTarget}}` is the PR's target branch — the one `gh pr create --base` receives and the one every diff below is computed against. The fork point (the branch this one was branched from) is a separate setting the repo declares on its own; in most repos the two name the same branch and the distinction costs you nothing. Where they differ, the fork-point diff is NOT the PR's, so the target always wins and you never have to work out which of the two a given name refers to.
+> **Two branches, one that decides:** `{{prTarget}}` is the target for `gh pr create --base` and every diff below. The fork point is a separate setting; in most repos both name the same branch. Where they differ, the target branch wins — the fork-point diff is never the PR's.
 
 ## Mandatory pre-flight
 
@@ -100,11 +100,11 @@ For every live-file `DRIFT`, the JSON provides the approved blob and the exact i
 
 ### Gate: `{{qualityGate.full}}` green before the PR
 
-The PR gate is the FULL one, `{{qualityGate.full}}` — **not** the fast one, `{{qualityGate.fast}}`. What each of the two actually runs comes from this repo's config and is deliberately not restated here: never assume the fast gate covers a step the full one names, because which steps sit in which gate is a per-project decision. `full` must be green over the diff that ships. Two paths:
+The PR gate is the FULL one, `{{qualityGate.full}}`, not `{{qualityGate.fast}}`. Which steps sit where is a per-project decision; don't assume the fast gate covers all full steps. Three paths:
 
-- **Reviewed (the normal path):** the `reviewer` already ran `{{qualityGate.full}}` green over this same diff in Pass 2 (evidence in `review_<feature>.md`, this cycle) and you **don't edit code** — trust it, don't re-run. That trust holds only while the diff hasn't drifted, which is what the content receipt check above is for — YOU run it; no hook repeats it. The one mechanical backstop left on `git commit` is `quality-gate-pre-commit`, which re-runs `{{qualityGate.fast}}` and blocks if it fails. Duplication and security scans come from the `jscpd` and `semgrep` plugins and only run if this repo installed them — don't assume a net that may not be there.
-- **Declared inline (no reviewer):** there's no review evidence to trust — YOU run `{{qualityGate.full}}` green in pre-flight before `gh pr create`. If it can outlive the Bash timeout, follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row: run its chained steps one by one in the foreground, never background them — you won't be re-woken to read the result.
-- ▶️ **Re-run `{{qualityGate.full}}` by hand** whenever the diff changed since the review (rebase/merge/follow-up edit) or there's no fresh evidence over the diff being committed — stale evidence doesn't count.
+- **Reviewed:** the reviewer ran `{{qualityGate.full}}` green in Pass 2 (see `review_<feature>.md`). Skip re-running **only** when `navori receipt check` reports `"fresh":true`. The `quality-gate-pre-commit` hook re-runs `fast` on `git commit` and blocks if it fails. Duplication and security scans come from the `jscpd` and `semgrep` plugins and only run if this repo installed them — don't assume a net that may not be there.
+- **`"fresh":false`:** no trustworthy evidence — YOU run `{{qualityGate.full}}` green in pre-flight before `gh pr create`. Follow `.claude/skills/verify-before-done/SKILL.md`'s subagent row if it outlives the timeout.
+- **Declared inline (no reviewer):** no review evidence either — run `{{qualityGate.full}}` yourself.
 
 Never open the PR with the gate red.
 
@@ -119,35 +119,35 @@ Never open the PR with the gate red.
 4. If you touch potentially sensitive files (`.env*`, credentials, odd lockfiles), **flag the user before staging**.
 5. `git add <files>` (prefer explicit over `git add -A`).
 6. `git commit -m "..."` with a HEREDOC for the body if applicable.
-7. Validate with `git status` that the commit landed.
-8. **Consume the receipt:** `rm -f .claude/progress/receipt.txt`. The approval is now frozen into the commit; leaving it armed could false-block a later feature that touches the same file.
+7. Validate with `git status` that the commit landed. Foreign modified files are reported as an observation and never discarded, restored or reverted.
+8. **Consume the receipt:** `mv -f .claude/progress/receipt.txt .claude/progress/receipt.consumed.txt`. The approval is now frozen into the commit; renaming it (instead of deleting it) keeps the evidence on disk without it being rearmed — a plain `check` never reads a consumed receipt again, only the opt-in flag documented in `cierre-sesion.md` does.
 
 ## PR flow
 
-1. **Gather context** (curated, don't dump the whole repo). The PR diff is against `{{prTarget}}` (what GitHub will show):
+1. **Gather context** (curated, not the whole repo). The PR diff is against `{{prTarget}}`:
    - `git log origin/{{prTarget}}..HEAD --oneline` — commits included.
    - `git diff origin/{{prTarget}}...HEAD --stat` — always.
-   - `git diff origin/{{prTarget}}...HEAD` — only if the diff < 500 lines. If larger, use only the stat + file list + the hunks of the 2–3 most relevant files.
-   - **Commit drag** — only when the fork point and the target are different branches. Don't assert that they differ: let the shell settle it, so the ordinary case (both names resolve to the same branch, nothing can drag) simply doesn't run instead of producing a comparison of a branch with itself.
+   - `git diff origin/{{prTarget}}...HEAD` — only if diff < 500 lines. If larger, stat + file list + hunks of 2–3 most relevant files only.
+   - **Commit drag** — only when fork point and target differ. Let the shell settle it:
 
      ```bash
-     base={{branchBase}}                                        # the fork point, as the repo declares it
+     base={{branchBase}}
      if [ "$base" != "{{prTarget}}" ]; then
        git fetch origin "$base" --quiet
        git rev-list --count "origin/{{prTarget}}..origin/$base"
      fi
      ```
 
-     A count > 0 means the fork point is ahead of `{{prTarget}}` and your PR drags those foreign commits: warn the user and suggest rebasing onto `{{prTarget}}` before opening.
-   - Ticket if applicable: branch name (e.g. `BT-1234-fix-x` → `BT-1234`) or a reference in the first commit.
-   - `.claude/progress/impl_<feature>.md` if it exists — non-obvious decisions.
+     Count > 0 means your PR drags foreign commits: warn the user and suggest rebase.
+   - Ticket if applicable: branch name (e.g. `BT-1234-fix-x` → `BT-1234`) or first commit.
+   - `.claude/progress/impl_<feature>.md` — non-obvious decisions.
 
 2. **Draft title and body**:
    - **Title**: follows the configured commit style (`{{commits}}`), ≤70 chars, imperative and without a trailing period.
    - **Body**: the repo's exact template (below). No empty sections.
 
 3. **Validate** before firing `gh`:
-   - Every body bullet backed by the diff or the implementer's report. **No handoff on disk** (`impl_<feature>.*`, `review_<feature>.md`) → draft from the diff and the issue only; drop any claim neither backs (#1001).
+   - Every claim in the title and body — path, command, count or decision — traces to the cycle's handoffs (`impl_<feature>.*`, `review_<feature>.md`), `git log`/`git diff` against the base, or the spec; nothing else backs a claim, so no inferred path, command, count or decision goes in. **No handoff on disk** → draft from the diff and the issue only. A fact you can't trace is omitted, or reported to the orchestrator — never filled in (#1001, #1028).
    - If you mention a file that is NOT in `--stat`, remove it.
    - No emojis. No AI attribution: no `Co-Authored-By` trailer for an AI, no "Generated with…" footer, no mention of Claude or any other AI tool in the title or body.
 
@@ -189,7 +189,7 @@ Never open the PR with the gate red.
 
 Every comment, review or ticket update you publish — on a PR, an issue or a Jira ticket — follows one rule: **the body lives in a file, never inline.** Bodies inline in a command truncate or mis-render under the shell's own quoting, and an inline `--body` gives the pre-flight nothing to inspect before it fires.
 
-1. Write the text into a file inside the progress directory (e.g. `.claude/progress/comment_<feature>.md`). The content comes ONLY from a handoff artifact already on disk (`impl_<feature>.md`, `review_<feature>.md`, the PR/issue itself) — never invent technical claims that aren't already written down somewhere upstream.
+1. Write the text into a file in `.claude/progress/` (e.g. `comment_<feature>.md`). Content comes ONLY from handoff artifacts on disk (`impl_<feature>.md`, `review_<feature>.md`, the PR/issue) — never invent claims not already documented.
 2. Publish it with the flag that reads the file, per channel:
 
    | Channel | Command | File flag |
@@ -253,6 +253,7 @@ wc -c CLAUDE.md                                  # after
 
 ## Hard rules
 
+- ❌ A stop report (gate red, missing review, protected branch, etc.) is the last action of this cycle. Do not continue investigating, re-running the gate, or calling `git`/`gh` after emitting it. If flaky, the next invocation decides.
 - ❌ Never push with `--force` to `{{branchBase}}` or another protected branch.
 - ❌ Never skip hooks (`--no-verify`) unless the user explicitly asks.
 - ❌ Never ask for a merge / approve the PR yourself. Your job ends with the URL.

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -149,7 +149,7 @@ Write `.claude/progress/review_<feature>.md`:
 | Check | Status | Evidence |
 |---|---|---|
 | `{{qualityGate.full}}` | [x] / [ ] | <output or exit code from this turn> |
-| Zero new errors vs baseline | [x] / [ ] | <failing paths cross-checked against `git diff --name-only origin/{{prTarget}}`, this turn> |
+| Failure attribution | [x] / [ ] | <state per failure (per `verify-before-done`) + the run over `origin/{{prTarget}}` that demonstrates it, this turn> |
 
 ### Conventions (CLAUDE.md + orchestrator's Project rules)
 - <repo-specific check>: [x] / [ ]
@@ -184,7 +184,7 @@ CHANGES_REQUESTED -> .claude/progress/review_<feature>.md
 - ❌ Never include as a blocker (in "Issues ≥80") a finding with confidence <80.
 - ✅ Apply `.claude/skills/verify-before-done/SKILL.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
 - ❌ Never approve with `{{qualityGate.full}}` red.
-- ❌ Never approve if the new code **adds new errors or warnings** vs baseline.
+- ❌ Never approve a failure legitimately classified *introduced (demonstrated)* per `verify-before-done`'s Failure attribution, and never classify one *pre-existing* by diff location alone.
 - ❌ Never approve new code with explicit or implicit `any` without a valid `// any justified: <reason>`.
 - ❌ Don't block or escalate a screen change to a human for lack of browser validation — the default gate is the diff + tests; require a visual check only when the user explicitly asked for one.
 - ✅ On APPROVED, write the content receipt (`.claude/progress/receipt.txt`) so the commit is bound to the reviewed bytes.

package/dist/assets/core/core-assets/agents/scribe.md

@@ -26,6 +26,10 @@ This role is registered ahead of the typed-handoff migration. Until a producer/c
 <!-- /navori:if-not --><!-- navori:if scribeOwnsMarkdown -->
 You are the sole author of the Markdown that lands in the diff. Two jobs, in this order when both apply: **render** a producer's JSON evidence into its prescribed Markdown handoff (R5), and **draft** the prose any `markdownRequests` entry asks for (R7) — reading the repo as needed for accuracy, never taking a design decision the request doesn't state. Preserve the producer's feature identity, status, evidence, files and verification exactly; add no claim the evidence doesn't carry.
 
+## Preflight the handoff
+
+Before you read, edit or commit anything, run `navori handoff check <feature> --for scribe --cwd <checkout you will edit> --json`. Any result whose `status` is not `"ok"` is `BLOCKED`: report it in chat and write nothing. Edit and commit only inside the `worktree` the JSON returns, not necessarily the cwd you started from.
+
 ## Render the handoff (R5, R6)
 
 The `implementer` (or another JSON-handoff producer) leaves `.claude/progress/impl_<feature>.json`. Read it:

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -815,6 +815,7 @@ fi
 #        this rule still surfaces. This rule is the seatbelt; that one is the net.
 managed_dir='\.claude/(agents|skills|hooks)|\.agents/skills|\.codex/(agents|hooks)|\.cursor/rules'
 managed_path="(CLAUDE\.md|AGENTS\.md|\.claude/settings\.json|\.codex/config\.toml|(${managed_dir})/[^[:space:];&|]+)"
+managed_rewrite_msg="shell rewrite of a navori-managed file — edit the source asset and run 'navori render --apply' (or 'navori sync'); a direct write invalidates the block hash and freezes it. If the target is outside this project (e.g. a scratchpad), write it with '>' or 'tee' and an absolute path instead"
 # The redirect check reads `scan`, NOT `segments`: the split rewrites every `|`
 # into a newline, so `>| CLAUDE.md` (forced clobber) would be torn in half and
 # the target would land in a segment of its own. Reading the unsplit copy is
@@ -824,10 +825,64 @@ managed_path="(CLAUDE\.md|AGENTS\.md|\.claude/settings\.json|\.codex/config\.tom
 # `-[a-zA-Z]*i[a-zA-Z]*[^[:space:]]*` accepts the backup-suffix spellings that
 # are the everyday form on both platforms: GNU `sed -i.bak`, BSD `sed -i ''`.
 # Missing them would have left the rule covering the tutorial spelling only.
-if printf '%s' "$scan" | grep -qE "(^|[^>])>\|?[[:space:]]*(\./)?${managed_path}([[:space:]]|\$)" \
-  || printf '%s' "$segments" | grep -qE "(^|[[:space:]])sed[[:space:]]+(-[a-zA-Z]*i[a-zA-Z]*[^[:space:]]*|--in-place)([[:space:]]|=).*${managed_path}" \
-  || printf '%s' "$segments" | grep -qE "(^|[[:space:]])tee[[:space:]]+([^-][^[:space:]]*[[:space:]]+)*(\./)?${managed_path}([[:space:]]|\$)"; then
-  block "shell rewrite of a navori-managed file — edit the source asset and run 'navori render --apply' (or 'navori sync'); a direct write invalidates the block hash and freezes it"
+# Case-INSENSITIVE (`-i`), same reasoning as the heredoc script-extension check
+# above (~line 319): APFS is case-insensitive by default, so `> .CLAUDE/AGENTS/a.md`
+# writes the same file as `.claude/agents/a.md` and must not slip past a
+# case-sensitive match.
+if printf '%s' "$scan" | grep -qiE "(^|[^>])>\|?[[:space:]]*(\./)?${managed_path}([[:space:]]|\$)" \
+  || printf '%s' "$segments" | grep -qiE "(^|[[:space:]])sed[[:space:]]+(-[a-zA-Z]*i[a-zA-Z]*[^[:space:]]*|--in-place)([[:space:]]|=).*${managed_path}" \
+  || printf '%s' "$segments" | grep -qiE "(^|[[:space:]])tee[[:space:]]+([^-][^[:space:]]*[[:space:]]+)*(\./)?${managed_path}([[:space:]]|\$)"; then
+  block "$managed_rewrite_msg"
+fi
+
+# 6b (#1034). The `>`/`>|`/`tee` arms above only ever match a BARE or
+# `./`-relative managed path, by design — `sed -i`'s own arm is unanchored
+# (`.*managed_path`) so it already catches an absolute target as a side effect,
+# but `>`/`tee` never reach `managed_path` at all for an absolute one, in or out
+# of the project (confirmed empirically, challenge_1027.md CONCERN 1). #1027
+# proposed closing that by RESOLVING the target against the filesystem at
+# check-time (`cd -P`, symlink checks) to decide "inside vs outside" — rejected
+# (challenge_1027.md BLOCKER 1): an ordinary `rm <target> && ln -s <managed
+# file> <target> && tee <target>` in the SAME command swaps what the literal
+# path resolves to between the check and the write, so a filesystem check is
+# TOCTOU-defeated by construction, not by an adversarial trick.
+#
+# What stays textual and TOCTOU-proof: matching an absolute target whose
+# CHARACTERS start with this project's own path — no `cd`, no `pwd -P`, no
+# `[ -L ]`, so there is nothing for a same-command `rm`/`ln -s` to invalidate.
+# Two forms reach that:
+#   - the RESOLVED value of $CLAUDE_PROJECT_DIR, regex-escaped so a literal
+#     char in the path (this repo's own path has a space and a hyphen, "Dev -
+#     Docs") is never read as a metacharacter;
+#   - the UNRESOLVED variable text itself, `$CLAUDE_PROJECT_DIR` /
+#     `${CLAUDE_PROJECT_DIR}`, which an agent can compose into a redirect
+#     without ever expanding it (so this arm doesn't depend on the value).
+# Quoted and unquoted forms both matter, and NOT just as "the whole target is
+# quoted or it isn't": `"$CLAUDE_PROJECT_DIR"/CLAUDE.md` — quoting only the
+# variable expansion, then continuing unquoted — is ordinary POSIX style a
+# legitimate command uses unprompted, so the quote has to be optional AROUND
+# THE PREFIX TOKEN ITSELF (both the literal value and the `$VAR`/`${VAR}` text),
+# not only at the two ends of the whole match (#1034 round 2 review). A path
+# with a space in it (like this repo's) also HAS to be quoted somewhere to be
+# valid shell at all, so this isn't a cosmetic tolerance.
+# Absolute paths OUTSIDE the project (any other prefix) stay allowed on
+# purpose — the block message above offers exactly that escape (#1036), and a
+# sibling directory that merely shares the prefix (`<proj>-otro/CLAUDE.md`)
+# does not match either: the pattern requires a literal `/` (optionally
+# quoted) right after the project path, and a sibling has `-otro/…` there
+# instead.
+# Without `$CLAUDE_PROJECT_DIR` set, this arm is skipped entirely — same
+# behavior as before #1034 — rather than matching against an empty prefix.
+if [ -n "${CLAUDE_PROJECT_DIR:-}" ]; then
+  # Strip a trailing slash before escaping: `CLAUDE_PROJECT_DIR=/proj/` would
+  # otherwise need a doubled `//` to line up with `/${managed_path}` below and
+  # silently stop matching (round 2 review, informational note 1).
+  cpd_literal=$(printf '%s' "${CLAUDE_PROJECT_DIR%/}" | sed -E 's#[^a-zA-Z0-9_/ -]#\\&#g')
+  abs_managed_path="[\"']?(${cpd_literal}|\\\$\\{?CLAUDE_PROJECT_DIR\\}?)[\"']?/${managed_path}[\"']?"
+  if printf '%s' "$scan" | grep -qiE "(^|[^>])>\|?[[:space:]]*${abs_managed_path}([[:space:]]|\$)" \
+    || printf '%s' "$segments" | grep -qiE "(^|[[:space:]])tee[[:space:]]+([^-][^[:space:]]*[[:space:]]+)*${abs_managed_path}([[:space:]]|\$)"; then
+    block "$managed_rewrite_msg"
+  fi
 fi
 
 # navori:user-section

package/dist/assets/core/core-assets/hooks/managed-drift-watch.sh

@@ -171,7 +171,23 @@ trap navori_audit_on_exit EXIT
 
 cd "${CLAUDE_PROJECT_DIR:-.}" 2>/dev/null || exit 0
 
-stamp=".claude/.managed-drift-stamp"
+# #1024: the stamp used to live at `.claude/.managed-drift-stamp`, written
+# unconditionally with no `gitignoreHarness` check — so under the default
+# `"off"` config the FIRST tool call in every session dirtied the tree, with no
+# `.gitignore` involved to catch it. `--git-common-dir` resolves to the SHARED
+# `.git` even when this hook runs inside an agent worktree, where `.git` is a
+# file pointing at the main checkout (#454's same scope note applies here).
+# Outside a git repo, or a corrupt/missing `.git`, there is nowhere safe to
+# persist this stamp: skip silently rather than fall back to `.claude/` — this
+# is a detector, not a gate, so losing one session's drift check costs less
+# than reintroducing the untracked-file problem it exists to prevent.
+common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+case "$common_dir" in
+  /*) ;;
+  *) common_dir="$PWD/$common_dir" ;;
+esac
+state_dir="$common_dir/navori"
+stamp="$state_dir/managed-drift-stamp"
 
 # sha1 tool, resolved once. `shasum` on macOS, `sha1sum` on most Linuxes; both
 # print `<hash>  <path>` for a file list, which is the format the stamp stores.
@@ -205,7 +221,7 @@ current=$(find $roots -type f -exec $sha {} + 2>/dev/null | sort || true)
 # current state as the baseline and say nothing. Reporting every block on the
 # first command would train the reader to ignore this hook by lunchtime.
 if [ ! -f "$stamp" ]; then
-  mkdir -p .claude 2>/dev/null || exit 0
+  mkdir -p "$state_dir" 2>/dev/null || exit 0
   printf '%s\n' "$current" > "$stamp" 2>/dev/null || true
   exit 0
 fi

package/dist/assets/core/core-assets/hooks/routing-watch.sh

@@ -72,11 +72,12 @@ set -uo pipefail
 #              right after that `case` ends the run before anything locates a
 #              stamp. Measured over the park, 53.8% of Bash calls — and Bash is
 #              80.4% of every tool call — so this is the dominant path.
-#   2 spawns — a session already `#delegated` or `#notified`: + `session_id`,
-#              which is what names the stamp, and the stamp check exits.
-#   4 spawns — an edit that actually counts: + `agent_id` (the subagent guard
+#   3 spawns — a session already `#delegated` or `#notified`: + `session_id`
+#              and `git rev-parse --git-common-dir` (#1024 — resolves where the
+#              stamp now lives, off `.claude/`), and the stamp check exits.
+#   5 spawns — an edit that actually counts: + `agent_id` (the subagent guard
 #              below) + the file path.
-#   5 spawns — a `Bash` whose PAYLOAD looked like a write but whose COMMAND is
+#   6 spawns — a `Bash` whose PAYLOAD looked like a write but whose COMMAND is
 #              not one: + `extract_cmd`, and the same probe re-applied to the
 #              command ends it one fork before the extraction pipeline.
 # The discard `case` therefore comes BEFORE `session_id`: a tool this hook does
@@ -210,7 +211,22 @@ fi
 sid=$(payload_field session_id | tr -cd 'A-Za-z0-9._-')
 [ -n "$sid" ] || sid="unknown-session"
 
-stamp_dir=".claude/.routing-watch"
+# #1024: the stamp dir used to live at `.claude/.routing-watch/`, written
+# unconditionally with no `gitignoreHarness` check — so under the default
+# `"off"` config an ordinary 4-file session dirtied the tree, with no
+# `.gitignore` involved to catch it. `--git-common-dir` resolves to the SHARED
+# `.git` even inside an agent worktree, where `.git` is a file pointing at the
+# main checkout — mirrors `managed-drift-watch.sh`'s identical fix. Outside a
+# git repo, or a corrupt/missing `.git`, there is nowhere safe to persist this
+# stamp: skip silently (fail-open, same discipline as every other exit here)
+# rather than fall back to `.claude/`.
+common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
+case "$common_dir" in
+  /*) ;;
+  *) common_dir="$PWD/$common_dir" ;;
+esac
+
+stamp_dir="$common_dir/navori/routing-watch"
 stamp="$stamp_dir/$sid"
 
 # Append a line unless it is already there. Silent on every failure: a stamp

package/dist/assets/core/core-assets/lib-skills/better-auth.md

@@ -0,0 +1,68 @@
+---
+name: better-auth
+description: Use when touching auth server config, session middleware, the auth client, or a Better Auth plugin (email OTP, bearer, rate limiting) — server/client wiring, session retrieval, schema. Not for a hand-rolled JWT/session implementation.
+metadata:
+  type: reference
+---
+
+# Better Auth — conventions
+
+Target version: Better Auth 1.7. On a different major, recheck the CLI command names and plugin pairing below — auth is a surface where a stale assumption becomes a security bug, not just a broken build.
+
+## The pattern
+
+One server config, mirrored by a matching client config — the plugin arrays on both sides must line up:
+
+```ts
+// server
+export const auth = betterAuth({
+  database: drizzleAdapter(db, { provider: 'pg' }),
+  secret,                          // >= 32 chars — see gotchas
+  trustedOrigins,                  // keep in sync with CORS
+  emailAndPassword: { enabled: true },
+  rateLimit: { enabled: true, storage: 'database' },
+  plugins: [emailOTP({ sendVerificationOTP }), bearer()],
+});
+
+app.on(['POST', 'GET'], '/api/auth/*', (c) => auth.handler(c.req.raw)); // before session routes
+
+// client
+export const client = createAuthClient({
+  baseURL,
+  plugins: [emailOTPClient()],
+  fetchOptions: { auth: { type: 'Bearer', token: () => storedToken } },
+});
+```
+
+## Gotchas that bite
+
+- **`secret` must be at least 32 characters**; gate it with a schema check (e.g. `z.string().min(32)`) at startup — it signs sessions/tokens.
+- **`trustedOrigins` is the same allowlist CORS needs — keep them in sync manually**; a request can pass CORS and still get rejected by auth.
+- **Mount `/api/auth/*` before any session-dependent route**; mounted later, that route sees no session even on a valid request.
+- **`auth.api.getSession({ headers: c.req.raw.headers })` in middleware, storing only `{ id, email }` in context**, not the raw session object.
+- **Client calls return `{ data, error }` (or throw on network failure) — unify that in one helper**; a missed ad hoc `if (error)` check treats a failed call as success.
+- **Server and client plugin arrays must pair up.** Server `emailOTP()` + `bearer()` needs client `emailOTPClient()` plus `fetchOptions.auth`, or the feature fails silently.
+- **Bearer transport means capturing `set-auth-token` and resending it as `Authorization: Bearer <token>`** — no cookie jar does it for you; no CSRF surface since it never rides on cookies.
+- **`sendVerificationOTP({ email, otp, type })` fires for every OTP type** — guard on `type` (e.g. `'forget-password'`) or you'll send the wrong email for other flows.
+- **Not every sensitive endpoint is rate-limited by default** — verify coverage and add a `customRules` entry if missing; on Workers the in-memory store never throttles, use `storage: 'database'`.
+- **Schema: `npx auth@latest generate`** (Prisma/Drizzle/Kysely) produces the schema/migration without applying it; **`npx auth@latest migrate`** applies it directly but only with the Kysely adapter — with Drizzle/Prisma, apply what `generate` produced via that ORM's own tool. A hand-maintained Drizzle schema mirroring Better Auth's shape also works — never rename a column there without a matching adapter change.
+
+## Before declaring done
+
+- `secret` length is enforced by a schema check, not just documentation.
+- `trustedOrigins` matches the CORS config for this same change.
+- Context carries only the minimal session shape; the raw session object doesn't leak past its middleware.
+- New/edited plugins are paired on both server and client.
+- `{{qualityGate.fast}}` green.
+
+If any item fails, fix it and re-run the whole list.
+
+<!-- navori:user-section -->
+## This repo's auth setup (your domain)
+
+<!-- user: add here what only applies to THIS repo. Suggestions:
+     - Which adapter/schema path is in use (CLI-generated vs. hand-maintained Drizzle schema) and why.
+     - The transport in use (cookies vs. bearer) per client (web vs. mobile).
+     - Which plugins are enabled and what each one is for.
+     - The rate-limit storage backend and any custom rules beyond the defaults.
+-->

package/dist/assets/core/core-assets/lib-skills/eas-release.md

@@ -0,0 +1,55 @@
+---
+name: eas-release
+description: Use when touching eas.json build/submit profiles, deciding between an OTA update and a new native build, wiring per-environment env vars/secrets for a build, or preparing a store submission. Only applies to a repo that actually has eas.json — an Expo app without it doesn't use EAS and this skill doesn't apply. Not for expo-router (routing) or Uniwind (styling).
+metadata:
+  type: reference
+---
+
+# EAS Build/Submit/Update
+
+EAS CLI flags move between minors, so confirm any command against `eas --help` / the installed CLI version before relying on it. Not every Expo project uses EAS — check `eas.json` exists before applying anything here.
+
+## `eas.json` shape
+
+- `cli.version` pins the minimum EAS CLI version; `cli.appVersionSource: "remote"` means the store version is tracked by EAS, not read from the local Expo config.
+- `build.<profile>` — one block per build profile (e.g. `development`, `preview`, `production`). Fields seen in practice: `developmentClient`, `distribution` (`internal` vs store), `channel` (the EAS Update channel this build's runtime binds to), `autoIncrement`.
+- `submit.<profile>` — store submission config, keyed by the same profile names.
+
+## Channels, branches, and runtime compatibility
+
+- A **channel** is what a built binary listens on for OTA updates; an **update** is published to a **branch**, and a channel maps to a branch (by default, same name). A build's `channel` decides which branch its installs pull from.
+- **runtimeVersion** is the real compatibility gate, not the channel name: an OTA update only reaches a binary whose `runtimeVersion` matches. Three policies — `appVersion` (from the app's version string), `nativeVersion` (from native fields like `CFBundleVersion`/`versionCode`), `fingerprint` (a hash of the native project — a native-dependency change bumps it automatically, so a JS-only change stays compatible). No default; pick one explicitly.
+
+## OTA update vs new native build
+
+- **Safe as an OTA update**: JS/TS changes, assets, most React Native code — anything that doesn't touch native modules, permissions, `app.json`/`app.config.ts` native fields, or the Expo SDK version.
+- **Needs a new native build**: a new/updated native module, a config plugin change, a permission, an SDK upgrade. Under `fingerprint` this is automatic; under `appVersion`/`nativeVersion` it's a manual call — get it wrong and the update either misses everyone or crashes a binary that can't support it.
+
+## Env vars, secrets, and source maps
+
+- Per-environment values inject at build time via `eas.json`'s per-profile `env` block or EAS's environment-variable store, managed with `eas env:set`/`get`/`list`/`pull`/`push`/`delete`/`exec` — creating a variable goes through `env:set`, there is no `env:create`. Default environments: `development`, `preview`, `production`. Visibility: plain text, sensitive, or secret (secret never readable outside EAS's servers).
+- Source maps (e.g. Sentry) upload as a build/update step so stack traces resolve to real source — wire into CI, not a manual local step.
+
+## Store submission basics
+
+`submit.<profile>` in `eas.json` holds store-specific fields (e.g. an Apple/Google service account reference) — never a raw credential committed to the repo. A submission consumes a build already produced by `build.<profile>`; it doesn't rebuild.
+
+## Before declaring done
+
+Copy and check off:
+
+- [ ] `eas.json` actually exists in this repo before applying any of the above.
+- [ ] The change is classified correctly as OTA-safe vs native-build-required.
+- [ ] No secret/API key is hardcoded per environment — it goes through EAS env or the profile's `env` block.
+- [ ] `{{qualityGate.fast}}` green.
+
+If any item fails, fix it and re-run the whole list.
+
+<!-- navori:user-section -->
+## This repo's release process (your domain)
+
+<!-- user: add here what only applies to THIS repo. Suggestions:
+     - The branch-to-channel-to-environment mapping in use.
+     - The runtimeVersion policy chosen and why.
+     - Where secrets are managed (EAS env, a secrets manager) and who can rotate them.
+-->

package/dist/assets/core/core-assets/lib-skills/expo-router.md

@@ -0,0 +1,61 @@
+---
+name: expo-router
+description: Use when adding, moving, or protecting a route on Expo — file-based routing under app/, layouts and route groups, typed routes, redirects/auth guards, or reading URL/search params. Applies to repos already on expo-router. Not for a web SPA's router (TanStack Router/React Router) and not for the app's business logic, which belongs in src/features, not in app/.
+metadata:
+  type: reference
+---
+
+# expo-router — file-based routing (Expo SDK 57)
+
+Written for expo-router ~57 on Expo SDK 57. Check the version in `package.json` first; layout/typed-route APIs have moved between majors before — verify against the changelog on a major bump.
+
+## Wiring
+
+- The `expo-router` Expo plugin goes in `app.json`/`app.config.ts`'s `plugins`, and `"main": "expo-router/entry"` in `package.json`.
+- `experiments.typedRoutes: true` in the Expo config generates typed `href`s from the `app/` tree — a route that doesn't exist becomes a type error, not a runtime 404.
+- `scheme` in the Expo config is the deep-link scheme; every route under `app/` is reachable by it once the app is installed.
+
+## File-based routes
+
+- Every file under `app/` is a route; its path mirrors the file path (`app/settings/index.tsx` → `/settings`).
+- `_layout.tsx` wraps its directory (and nested layouts nest). Use it for a `Stack`/`Tabs` navigator, not for business logic.
+- A parenthesized segment (`app/(auth)/`) is a **group**: it organizes/nests layouts without adding a path segment.
+- Keep route files thin — read params, call a hook from `src/features/<feature>`, render. Logic, data fetching, validation live in `src/features`, not `app/`.
+
+## Auth guards and redirects
+
+- `<Redirect href="..." />` renders nothing and navigates immediately — use it for an unconditional bounce (e.g. an unauthenticated root redirecting to `/(auth)/sign-in`).
+- `Stack.Protected` (also on other layout navigators) conditionally mounts/unmounts a screen or group based on a `guard` boolean, without a remount flash — prefer it over a `Redirect` inside every protected screen when the whole group shares one guard.
+- Auth state itself is read from the app's own session hook (e.g. a Zustand store's `useSession()`), never re-derived inside a route file.
+
+## Search params: local vs global
+
+- `useLocalSearchParams()` only updates while its route is focused — the default for reading a route's own params.
+- `useGlobalSearchParams()` updates on every navigation event, even for routes that aren't focused — use it sparingly (a screen reacting to a param change in a sibling route), since it re-renders more often.
+
+## Gotchas that bite
+
+- **A non-route file in `app/`** (a shared component, a hook) still becomes routable unless it starts with `_` or lives outside `app/` — keep non-route files in `src/`.
+- **Typed routes require the generated types.** After adding/renaming a route, restart the dev server (`--clear` if it doesn't pick it up) so typed `href`s regenerate.
+- **Deep links need the scheme AND the route to exist** — a scheme without a matching `app/` path 404s at the router level even if the OS opens the app.
+
+## Before declaring done
+
+Copy and check off:
+
+- [ ] New route files are thin — logic lives in `src/features`, not `app/`.
+- [ ] Auth-protected routes use `Stack.Protected` or a `Redirect`, never a bare unauthenticated render.
+- [ ] `useGlobalSearchParams` is used only where cross-route reactivity is actually needed.
+- [ ] `expo export --clear` succeeds after any routing/layout change.
+- [ ] `{{qualityGate.fast}}` green.
+
+If any item fails, fix it and re-run the whole list.
+
+<!-- navori:user-section -->
+## This repo's routes (your domain)
+
+<!-- user: add here what only applies to THIS repo. Suggestions:
+     - The route groups in use and what each protects.
+     - Where the session/auth hook lives and its shape.
+     - Deep link scheme and any universal-link domains configured.
+-->