omniconductor 0.3.0

package/adapters/claude/hookify-templates/block-server-secret-in-client.local.md.template

@@ -0,0 +1,36 @@
+---
+name: block-server-secret-in-client
+enabled: true
+event: file
+action: block
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: ${CONDUCTOR_CLIENT_GLOB}
+  - field: new_text
+    operator: regex_match
+    pattern: ${CONDUCTOR_SERVER_SECRET_PATTERN}
+---
+
+🚨 **CRITICAL — server-only secret in client-bundled code (blocked)**
+
+A server-only secret pattern was added to a file that ships in the client bundle. **Blocked.**
+
+### Why this is critical
+
+- Client bundles are downloadable by every user of the app. A server secret placed in client code is extractable from the shipped bundle.
+- A single exposure means the key must be rotated immediately (incident response), not just edited out.
+- Build tooling will happily inline the value — there is no compile-time guard unless one is added (this rule is that guard).
+
+### The correct split
+
+| Surface | Key type |
+|---|---|
+| Client (browser / mobile) | Public / anon key only — scoped, safe to ship |
+| Server (API route / server action / serverless function / build script) | Secret / privileged key — never imported into client paths |
+
+### If this matched a genuine server-only file
+
+The path matched `${CONDUCTOR_CLIENT_GLOB}` but is actually server-only — move it under a server-only directory, or narrow `CONDUCTOR_CLIENT_GLOB` for this project. Then retry.
+
+**block — operation halted. Relocate the secret to a server-only path and retry.**

package/adapters/claude/hookify-templates/warn-any-type-added.local.md.template

@@ -0,0 +1,44 @@
+---
+name: warn-any-type-added
+enabled: true
+event: file
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.(ts|tsx)$
+  - field: new_text
+    operator: regex_match
+    pattern: :\s*any\b
+---
+
+⚠️ **`: any` type added — TypeScript discipline (recipe `coding-conventions.md` ABSOLUTE)**
+
+A TypeScript file gained a `: any` type annotation. The framework's coding-conventions recipe (`core/recipes/coding-conventions.md`) marks `any` as forbidden: it bypasses the type system the project pays to maintain.
+
+### Alternatives
+
+| Use case | Replacement |
+|---|---|
+| Unknown shape from external data | `unknown` + type guard / Zod schema |
+| Temporary prototype | TODO comment + explicit `as Type` assertion |
+| Untyped library | `// @ts-expect-error <reason>` + open a typing PR upstream |
+| Variadic params | Generic `<T>` or discriminated union |
+| Test mock | `Partial<T>` or test-runner-specific mock helpers |
+
+### Legitimate exceptions (rare)
+
+- `Record<string, any>` where any-key any-value JSON is the actual contract — even here, prefer `unknown`.
+- `catch (e: any)` in pre-TS-4.4 code; modern codebases should use `unknown`.
+
+### Quick search
+
+```bash
+grep -rn ":\s*any\b" <project-source-dir> --include="*.ts" --include="*.tsx" | wc -l
+# Target: 0
+```
+
+### Project-local note
+
+If your project does NOT use TypeScript (pure JavaScript), delete this rule. If your project allows `any` in specific paths (e.g., test fixtures), edit the `file_path` regex to exclude those paths.
+
+**Warn-only — operation proceeds. Pre-merge review (Q2) may upgrade this to a blocker if the issue scores ≥ 80.**

package/adapters/claude/hookify-templates/warn-commit-without-pre-commit-review.local.md.template

@@ -0,0 +1,52 @@
+---
+name: warn-commit-without-pre-commit-review
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: regex_match
+    pattern: \bgit\s+commit\s+-m\b
+---
+
+⚠️ **Pre-commit code review (Q1) reminder before `git commit`**
+
+A `git commit` is about to run. Per `core/universal-rules/quality-gates.md` Q1 (pre-commit code review), an automated reviewer must inspect the diff before commit. HIGH-confidence issues (severity ≥ 75) are blockers; LOWER severity becomes follow-up.
+
+### Reviewer routing (model selection)
+
+| Diff size / nature | Reviewer model |
+|---|---|
+| Multi-file (3+ files cross-cutting) | Opus-tier |
+| Single-file change | Sonnet-tier |
+| Type-design heavy diff | Specialized type-design reviewer if available |
+| Error-handling heavy diff | Specialized silent-failure-hunter if available |
+
+When in doubt, upgrade one tier.
+
+### Exemptions (no review needed)
+
+- 100% docs-only changes (`docs/**`, `*.md` only).
+- Auto-generated lockfile bumps.
+- Auto-generated codegen output (e.g., types from a schema).
+- Hookify rule config files (`.claude/hookify.*.local.md`) — config, not code.
+
+Mixed PRs (docs + code) are NOT exempt — any code in the diff triggers review.
+
+### What "block on HIGH-confidence" means
+
+If the reviewer reports any issue with confidence ≥ 75 and severity ≥ HIGH:
+
+1. Commit must NOT proceed.
+2. Fix the issue or document a justified exception in the commit message.
+3. Re-run reviewer on the updated diff.
+4. Only when no HIGH-confidence issues remain: commit.
+
+### Verification prompt (orchestrator self-check)
+
+> "Is this diff trivial (docs-only / lockfile / codegen) or substantive? If substantive, run Q1 reviewer first. If trivial, note the exemption category in the commit message."
+
+### Origin
+
+Production pattern: pre-merge review (Q2) caught build-blocker issues that pre-commit review (Q1) would have caught earlier and cheaper. Promoted Q1 to ABSOLUTE.
+
+**Warn-only — operation proceeds. Bypassing Q1 puts the burden on Q2.**

package/adapters/claude/hookify-templates/warn-console-direct.local.md.template

@@ -0,0 +1,55 @@
+---
+name: warn-console-direct
+enabled: true
+event: file
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: ${CONDUCTOR_SOURCE_GLOB}
+  - field: new_text
+    operator: regex_match
+    pattern: console\.(error|log|warn)\s*\(
+---
+
+⚠️ **Direct `console.error/log/warn` call — use the project's logger helper**
+
+Production code added a direct `console.*` call. The framework's coding-conventions recipe (`core/recipes/coding-conventions.md`) prefers a centralized logger helper over raw console for several reasons:
+
+### Why a logger helper
+
+- **Observability**: production logs route to an error-aggregation service automatically.
+- **Context**: helper attaches contextual metadata (user ID, request ID, trace ID) the raw console drops.
+- **Log level discipline**: error / warn / info / debug routed differently per environment.
+- **PII safety**: client `console.*` is visible to users; helper can mask sensitive fields.
+
+### Standard pattern
+
+```ts
+// ❌ Avoid in production code
+catch (e) {
+  console.error('Failed:', e)
+  return { error: 'Failed' }
+}
+
+// ✅ Use the project logger
+import { logError } from '<project>/lib/utils/errorLogger'
+
+catch (e) {
+  logError('<scope>', e, { userId, contextId })
+  return { data: null, error: 'Failed' }
+}
+```
+
+### Exemptions
+
+- Test / spec files (most projects exclude `*.test.{ts,tsx}` and `*.spec.{ts,tsx}` from the file_path regex).
+- Build / CLI scripts under `scripts/` — direct stdout is the contract.
+- Server-side runtime where stdout *is* the log channel (e.g., serverless functions where stdout → platform log aggregator).
+
+The default `${CONDUCTOR_SOURCE_GLOB}` already excludes test files via the recommended pattern. Adjust if your project organizes tests differently.
+
+### Project-local note
+
+If your project does NOT have a logger helper module, this rule should be paired with introducing one (see `core/recipes/coding-conventions.md` "Error Handling"). Without the helper, the rule is just noise.
+
+**Warn-only — operation proceeds.**

package/adapters/claude/hookify-templates/warn-create-table-without-access-control.local.md.template

@@ -0,0 +1,35 @@
+---
+name: warn-create-table-without-access-control
+enabled: true
+event: file
+action: warn
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.sql$
+  - field: new_text
+    operator: regex_match
+    pattern: CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?\w
+  - field: new_text
+    operator: not_contains
+    pattern: ENABLE ROW LEVEL SECURITY
+---
+
+⚠️ **New table without row-level access control**
+
+A `CREATE TABLE` was added but the same change does not enable row-level access control.
+
+### Required pattern
+
+```sql
+CREATE TABLE <table> ( ... );
+ALTER TABLE <table> ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "<name>" ON <table>
+  FOR <operation>
+  TO <explicit-role>          -- name the role; never rely on a permissive default
+  USING (<owner-predicate>);
+```
+
+A policy with no explicit role grants access by default — a security hole. Read-only reference tables may scope SELECT broadly but should still enable access control.
+
+**warn — operation proceeds; message injected. Do not merge a table without access control.**

package/adapters/claude/hookify-templates/warn-current-work-without-remaining-tasks.local.md.template

@@ -0,0 +1,36 @@
+---
+name: warn-current-work-without-remaining-tasks
+enabled: true
+event: file
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: ${CONDUCTOR_CURRENT_WORK_PATH}$
+---
+
+⚠️ **Cross-doc status flip check — REMAINING_TASKS sync reminder**
+
+You are editing `${CONDUCTOR_CURRENT_WORK_PATH}`. In the same turn, `${CONDUCTOR_REMAINING_TASKS_PATH}` likely also needs an update.
+
+This rule enforces the same-turn cross-doc flip pattern from `core/universal-rules/spec-as-you-go.md` §3 and the broader workflow from `core/universal-rules/workflow.md`. The originating production project caught this gap repeatedly: CURRENT_WORK was updated, but REMAINING_TASKS still showed the same item as `⏳`, producing stale-context confusion in the next session.
+
+### Cross-doc flip checklist
+
+When CURRENT_WORK gets a new completion / progress entry, also touch:
+
+1. **`${CONDUCTOR_REMAINING_TASKS_PATH}`** — flip the matching task ID to ✅ (or update the status column).
+2. **`docs/specs/<area>.md`** — frontmatter `last-updated: <today>`, plus body sections affected by the change.
+3. **`docs/plans/<plan>.plan.md`** (if applicable) — frontmatter `status: APPROVED → SHIPPED` once the plan completes.
+4. **`docs/runbooks/<runbook>.md`** (if applicable) — close the corresponding manual checklist item.
+
+### Common skip patterns to watch for
+
+- **External-dependency completion** (vendor approvals, DNS records propagated, third-party service activations): the user often reports "X is done" verbally — the manual completion does NOT auto-update REMAINING_TASKS. Update both.
+- **Phase progression**: CURRENT_WORK gains a "Phase N complete" entry but REMAINING_TASKS' phase table column doesn't move. Update both.
+- **Sub-task completion**: CURRENT_WORK records the sub-task; REMAINING_TASKS' parent task remains `⏳` because not every sub-task is done. Update the relevant rows; leave the parent until truly done.
+
+### Origin
+
+Repeated stale-doc occurrences in production work where one of the two files was treated as the "real" log and the other rotted. Promoted to a same-turn rule because cross-session context loss is expensive.
+
+**Warn-only — operation proceeds. The reminder is the value.**

package/adapters/claude/hookify-templates/warn-gh-pr-create-without-pre-merge-review.local.md.template

@@ -0,0 +1,38 @@
+---
+name: warn-gh-pr-create-without-pre-merge-review
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: regex_match
+    pattern: \bgh\s+pr\s+create\b
+---
+
+⚠️ **Pre-merge code review (Q2) required before merge**
+
+A PR is being created. Per `core/universal-rules/quality-gates.md` Q2 (pre-merge code review), the PR must pass a structured review BEFORE merge — distinct from Q1 (pre-commit review on the diff).
+
+### Q2 procedure
+
+1. **CI green check**: `gh pr checks <#>` or wait for the GitHub UI to show all checks passing.
+2. **Run the pre-merge reviewer** — typically a multi-reviewer parallel pass with a scoring model that aggregates findings.
+3. Findings score ≥ 80 → BLOCK_MERGE; fix and re-run review.
+4. Findings score 75-79 → judgment call (escalate to human if ambiguous; build-blocker guard violations bump to 80).
+5. Findings score ≤ 74 → optional follow-up comment, do not block merge.
+6. Approve → merge.
+
+### Exemptions
+
+- 100% `docs/**` or `*.md`-only PRs.
+- Auto-generated lockfile updates.
+- Auto-generated codegen-only PRs.
+
+### Auto-reminder integration
+
+If your project uses `core/hooks/stop-r6-review-check.sh.template` (installed by the Claude adapter), it injects a reminder on session-stop when push + open PR is detected, with a cool-down to avoid spam.
+
+### Origin
+
+Production pattern: a PR was merged that had passed Q1 pre-commit review but skipped Q2 pre-merge review. Q2 would have caught a build-blocker (i18n score 75) — the orchestrator was explicitly called out for the skip. Promoted Q2 to ABSOLUTE.
+
+**Warn-only — operation proceeds. The PR exists; the responsibility to run Q2 before merge is now on the orchestrator.**

package/adapters/claude/hookify-templates/warn-hardcoded-text-without-i18n-key.local.md.template

@@ -0,0 +1,21 @@
+---
+name: warn-hardcoded-text-without-i18n-key
+enabled: true
+event: file
+action: warn
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.(tsx|jsx)$
+  - field: new_text
+    operator: regex_match
+    pattern: >\s*[A-Z][a-zA-Z]{3,}(\s+[A-Z]?[a-zA-Z]+)*\s*<
+---
+
+⚠️ **Hardcoded user-facing text — possible missing i18n key**
+
+A literal user-facing string was rendered directly in a component. On a multi-locale project, user-facing text must come from a translation key, not a hardcoded literal.
+
+If this string is not user-facing (a test id, a constant, a non-translated proper noun), proceed.
+
+**warn — operation proceeds; message injected.**

package/adapters/claude/hookify-templates/warn-on-gh-pr-merge.local.md.template

@@ -0,0 +1,33 @@
+---
+name: warn-on-gh-pr-merge
+enabled: true
+event: bash
+conditions:
+  - field: command
+    operator: regex_match
+    pattern: \bgh\s+pr\s+merge\b
+---
+
+⚠️ **PR merge — 4-spot status flip required (same turn)**
+
+A PR merge command was issued. Per `core/universal-rules/spec-as-you-go.md` §3 and the audit-stale-pattern rule, every merge requires immediate cross-doc status flips in the same turn. Skipping this produces stale documentation that audit dispatches in subsequent sessions waste cycles re-investigating.
+
+### Same-turn 4-spot flip
+
+1. **`${CONDUCTOR_REMAINING_TASKS_PATH}`** — flip the corresponding task ID to ✅ (run `grep -n` for stale `⏳` markers tied to the merged work).
+2. **`docs/plans/<plan>.plan.md`** — frontmatter `status: APPROVED → SHIPPED`; body's "Out of scope" / "Sprint buffer" / "Deferred" sections updated accordingly.
+3. **`docs/runbooks/<runbook>.md`** — close the user-manual checklist items + summary table rows the merge resolves.
+4. **`${CONDUCTOR_CURRENT_WORK_PATH}`** — append a `+N` entry: PR number, merge sha, one-line summary, follow-up actions.
+
+### Additional checks
+
+- **`docs/audits/<latest>.md`** — close findings the merge resolves (preserve historical dated snapshots).
+- **`docs/specs/<area>.md`** — frontmatter `last-updated: YYYY-MM-DD` plus body sections (per `core/universal-rules/spec-as-you-go.md` §1).
+
+### Origin
+
+Production pattern: PR merged, CURRENT_WORK updated, but REMAINING_TASKS / plan frontmatter / runbook checklists left stale for days. Subsequent audit dispatches surfaced the stale items as findings, wasting cycles on already-resolved work.
+
+**Merge is not the end of a task. The 4-spot flip is.**
+
+**Warn-only — operation proceeds. Treat the reminder as a gate before declaring the task done.**

package/adapters/claude/hookify-templates/warn-plan-spec-without-remaining-tasks.local.md.template

@@ -0,0 +1,44 @@
+---
+name: warn-plan-spec-without-remaining-tasks
+enabled: true
+event: file
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: docs/(plans|specs)/.*\.md$
+---
+
+⚠️ **Plan / spec edit — cross-doc flip check**
+
+You are editing `docs/plans/*.md` or `docs/specs/*.md`. In the same turn, `${CONDUCTOR_REMAINING_TASKS_PATH}` and `${CONDUCTOR_CURRENT_WORK_PATH}` likely also need updates.
+
+This rule enforces the 4-spot flip pattern from `core/universal-rules/spec-as-you-go.md` §3. The originating project caught this gap repeatedly: a plan flipped to "shipped" in body text but its frontmatter status stayed `APPROVED`, so audit dispatches kept finding it as a stale unfinished item.
+
+### 4-spot flip (same turn)
+
+1. **`${CONDUCTOR_REMAINING_TASKS_PATH}`** — task status / external-dependency list / phase checklist (search by task ID *and* keyword to catch drift).
+2. **This plan/spec frontmatter** — flip `status: APPROVED → SHIPPED` (or equivalent) directly in the YAML block, not just the prose.
+3. **`docs/runbooks/<runbook>.md`** — close any manual checklist tied to the change.
+4. **`docs/audits/<latest>.md`** — close findings that this change resolves (do NOT modify dated historical audit snapshots; create a follow-up note instead).
+
+### Frontmatter completeness (related — `core/universal-rules/spec-as-you-go.md` §1.2)
+
+When editing a spec body, also update:
+
+- `last-updated: YYYY-MM-DD` — today's date.
+- `last-tested: YYYY-MM-DD` (if the spec tracks it) — date of most recent verified pass.
+- `status` field, if present.
+- The `api_routes:` / `pages:` / `components:` / `services:` / `hooks:` lists, if you added or removed any.
+
+Body changes without frontmatter changes leave future audits unable to detect staleness.
+
+### Origin
+
+Two recurring patterns in production:
+
+1. Plan body text said "shipped" but frontmatter status stayed `APPROVED` → audit dispatch flagged plan as still pending → wasted investigation cycles.
+2. Spec body added new API routes but `api_routes:` frontmatter list wasn't extended → other agents loading the spec by route name missed the addition.
+
+Both promoted to same-turn ABSOLUTE per `spec-as-you-go.md`.
+
+**Warn-only — operation proceeds.**

package/adapters/claude/hookify-templates/warn-raw-hex-instead-of-token.local.md.template

@@ -0,0 +1,21 @@
+---
+name: warn-raw-hex-instead-of-token
+enabled: true
+event: file
+action: warn
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.(tsx|jsx|css|scss)$
+  - field: new_text
+    operator: regex_match
+    pattern: (style\s*=\s*\{\{[^}]*#[0-9a-fA-F]{6}|:\s*#[0-9a-fA-F]{6})
+---
+
+⚠️ **Raw hex color — use a design token**
+
+An inline raw hex color was added. Reference a design token (color variable) instead, so theming and dark-mode stay consistent.
+
+If this is an intentional one-off outside the token system (e.g. a third-party embed), justify it in the change and proceed.
+
+**warn — operation proceeds; message injected.**

package/adapters/claude/hookify-templates/warn-security-definer-without-search-path.local.md.template

@@ -0,0 +1,30 @@
+---
+name: warn-security-definer-without-search-path
+enabled: true
+event: file
+action: warn
+conditions:
+  - field: file_path
+    operator: regex_match
+    pattern: \.sql$
+  - field: new_text
+    operator: regex_match
+    pattern: SECURITY\s+DEFINER
+  - field: new_text
+    operator: not_contains
+    pattern: SET search_path
+---
+
+⚠️ **SECURITY DEFINER function without an explicit search_path**
+
+A `SECURITY DEFINER` function runs with the definer's privileges. Without `SET search_path`, a caller can shadow objects via their own schema and hijack the elevated execution.
+
+### Required
+
+```sql
+CREATE FUNCTION ... SECURITY DEFINER
+  SET search_path = <trusted-schemas>
+AS $$ ... $$;
+```
+
+**warn — operation proceeds; message injected.**

package/adapters/claude/hookify-templates/warn-stop-commit-without-current-work.local.md.template

@@ -0,0 +1,47 @@
+---
+name: warn-stop-commit-without-current-work
+enabled: true
+event: stop
+conditions:
+  - field: transcript
+    operator: regex_match
+    pattern: git\s+commit\s+-m
+  - field: transcript
+    operator: not_contains
+    pattern: ${CONDUCTOR_CURRENT_WORK_PATH}
+---
+
+⚠️ **Session has commits but `${CONDUCTOR_CURRENT_WORK_PATH}` was never touched**
+
+The session transcript contains `git commit -m` evidence but no edits to `${CONDUCTOR_CURRENT_WORK_PATH}`. Per `core/universal-rules/spec-as-you-go.md` §3 (same-turn docs sync), every commit producing a behavior or content change requires a corresponding `${CONDUCTOR_CURRENT_WORK_PATH}` `+N` entry in the same turn.
+
+### Process before Stop
+
+1. **`${CONDUCTOR_CURRENT_WORK_PATH}`** — append `+N` entry:
+   - Date.
+   - Change summary (1-2 sentences).
+   - Commit sha.
+   - Affected scope (which area / module).
+   - Follow-up actions (if any).
+2. **`${CONDUCTOR_REMAINING_TASKS_PATH}`** — flip affected task IDs to ✅ or update status.
+3. **`docs/specs/<area>.md`** — frontmatter `last-updated` + body sections (per `core/universal-rules/spec-as-you-go.md` §1).
+4. **`docs/plans/<plan>.plan.md`** (if applicable) — frontmatter status flip.
+5. **`docs/runbooks/<runbook>.md`** (if applicable) — close checklist items.
+
+### Exceptions (rule does not apply cleanly)
+
+- **Pure auto-generated commits** (lockfile-only, codegen-only) — body content has nothing CURRENT_WORK could meaningfully record.
+- **Pure config-rotation commits** (e.g., dotfile housekeeping) — narrow exception; usually still merits a brief CURRENT_WORK note.
+
+Most ordinary feature / fix / refactor / docs commits warrant a CURRENT_WORK `+N` entry.
+
+### Anti-evasion
+
+- "I'll update CURRENT_WORK next turn" — next turn is not guaranteed (session may end / model may be replaced). Update in the same turn.
+- "Too small to log" — every commit appears in `git log` and gets searched. CURRENT_WORK is the first stop for that search; tiny commits are exactly the ones that benefit from a one-line entry.
+
+### Origin
+
+Repeated production pattern: PR merged, no CURRENT_WORK update, next session starts with stale context, agent re-investigates already-completed work. Promoted to ABSOLUTE same-turn rule.
+
+**Warn-only — operation proceeds. The reminder is the value; bypassing it costs the next session.**

package/adapters/claude/hookify-templates/warn-user-manual-completion.local.md.template

@@ -0,0 +1,40 @@
+---
+name: warn-user-manual-completion
+enabled: true
+event: prompt
+conditions:
+  - field: user_prompt
+    operator: regex_match
+    pattern: (했어|완료했|끝냈|활성화\s*했|등록했|push\s*했|푸시했|푸쉬했|deploy\s*했|배포했|머지했|merge\s*했|발급받았|승인됐|approved|done\s+manually|finished\s+manually|deployed|activated|registered)
+---
+
+⚠️ **User reports manual completion — immediate docs sync required**
+
+The user just reported a manual / external completion (vendor approval, DNS propagation, deploy, key issuance, dashboard configuration, etc.). Per `core/universal-rules/spec-as-you-go.md` §3 (real-time docs sync), this triggers an **immediate** same-turn update across multiple docs. **Do not defer.**
+
+### Same-turn updates
+
+1. **`${CONDUCTOR_CURRENT_WORK_PATH}`** — append `+N` entry: date, manual action description, outcome, references (file / env var / dashboard URL).
+2. **`${CONDUCTOR_REMAINING_TASKS_PATH}`** — flip the matching item to ✅ (e.g., user-manual list, A.x action items, external-dependency list, phase checklist).
+3. **`docs/specs/<area>.md`** — frontmatter `last-updated: <today>` + body section "Current state" updated.
+4. **Memory / reference docs** — if the manual action introduced new credentials, expiry dates, or vendor-specific facts, add or update the corresponding `reference_<name>.md` memory file.
+
+### Common manual-completion categories
+
+- External account signup / approval (payment provider, financial-data provider, identity provider, partner program).
+- DNS / Cloudflare records (DKIM, DMARC, SPF, DNSSEC).
+- Hosting platform env-var registration / redeploy trigger.
+- App store / marketplace submissions or approvals.
+- API key / token issuance.
+
+### Why this rule exists (origin)
+
+Production pattern: user reported a manual completion verbally; the orchestrator updated CURRENT_WORK and one memory file but missed REMAINING_TASKS / runbook / spec. Resulting stale state for several days, until a subsequent audit dispatch surfaced the discrepancy. The user explicitly flagged this as a recurring failure mode → promoted to same-turn ABSOLUTE.
+
+### Verification self-prompt
+
+> "Is the just-reported completion now reflected in `${CONDUCTOR_REMAINING_TASKS_PATH}` AND `${CONDUCTOR_CURRENT_WORK_PATH}` AND the relevant spec?"
+
+If any answer is no, update those documents in this same turn before proceeding.
+
+**Warn-only — operation proceeds. Treat the warn as a blocker on declaring the task done.**