omniconductor 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -5,6 +5,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/); versioning is [S
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-07-07
+
+### Added
+- **`git-hygiene` recipe + `stop-git-hygiene-guard` Stop hook** — opt-in shared-repo discipline (G1–G7): no unrequested worktrees, push-don't-hoard, merge=delete-branch, backup≠applied (verify by real code), no reckless force/rebase on shared repos, bundle PRs for CI, session-end hygiene check. Prevents the failure where merged work *looks* lost (orphan worktrees / local-only commit hoarding / stale merged branches) and burns reconciliation time. Recipe body installs on all six tools; the Stop-hook reminder is Claude-only (ADR-034), non-blocking, self-gated on the recipe. Recipe count **11 → 12**, hook templates **7 → 9** (the 0.3.0 `stop-trajectory-log` count was also un-synced). — **ADR-037**.
+
 ## [0.4.1] — 2026-07-06
 
 ### Fixed (docs)

package/README.md

@@ -6,11 +6,11 @@ Write your project's rules, workflow, and discipline ONCE. Install into any AI c
 
 > Born from one year of production iteration at LFamily Labs — the rules, agents, hooks, and memory patterns that survived real shipping pressure.
 
-> **Status (v0.4.0 — 2026-07-05)**: All 6 adapters ship a working `transform.sh` — **Claude Code** (full: rules + hooks + sub-agents + per-call model routing), **Cursor**, **GitHub Copilot** (one install covers 5 IDEs), **Gemini CLI** (`GEMINI.md` + `.gemini/styleguide.md`), **Codex** (`AGENTS.md`), **Windsurf / Devin Desktop** (`.windsurfrules` + `.devin/rules/*.md`). Published to npm as [`omniconductor`](https://www.npmjs.com/package/omniconductor) (v0.4.0). Output is emit-verified (format-validator + CI on all 6); live runtime consumption by Gemini / Codex / Windsurf is adopter-pending — see [`docs/ADAPTER-LIVE-VERIFICATION.md`](./docs/ADAPTER-LIVE-VERIFICATION.md). Manual install ([`docs/MANUAL-INSTALL.md`](./docs/MANUAL-INSTALL.md)) remains a fallback.
+> **Status (v0.5.0 — 2026-07-07)**: All 6 adapters ship a working `transform.sh` — **Claude Code** (full: rules + hooks + sub-agents + per-call model routing), **Cursor**, **GitHub Copilot** (one install covers 5 IDEs), **Gemini CLI** (`GEMINI.md` + `.gemini/styleguide.md`), **Codex** (`AGENTS.md`), **Windsurf / Devin Desktop** (`.windsurfrules` + `.devin/rules/*.md`). Published to npm as [`omniconductor`](https://www.npmjs.com/package/omniconductor) (v0.5.0). Output is emit-verified (format-validator + CI on all 6); live runtime consumption by Gemini / Codex / Windsurf is adopter-pending — see [`docs/ADAPTER-LIVE-VERIFICATION.md`](./docs/ADAPTER-LIVE-VERIFICATION.md). Manual install ([`docs/MANUAL-INSTALL.md`](./docs/MANUAL-INSTALL.md)) remains a fallback.
 >
-> **New in 0.4.0**: instruction-fidelity-first **token economy** — reduce tokens without distorting your instructions: lossless context editing before lossy compaction, an output-brevity discipline, and a new "verbose output" anti-pattern (ADR-035/036; [`docs/CONTEXT-EDITING-GUIDE.md`](./docs/CONTEXT-EDITING-GUIDE.md)). **In 0.3.0**: an opt-in **self-improvement / Reflector loop** (reads session trajectories + git and *proposes* lessons — propose-only — on all six tools; `--recipes=self-improvement`, ADR-030/032/033) + a first-party-verified **compatibility-matrix correction** (all six tools ship hooks / sub-agents / per-task model routing, retiring the old "Claude-only" view; ADR-031). Full history: [`CHANGELOG.md`](./CHANGELOG.md).
+> **New in 0.5.0**: an opt-in **`git-hygiene` recipe** — shared-repo discipline (no orphan worktrees, push-don't-hoard, merge=delete-branch, backup≠applied) that stops merged work from *looking* lost; Claude adds a non-blocking Stop-hook reminder, other tools use the rule text (ADR-037). **In 0.4.0**: instruction-fidelity-first **token economy** (lossless context editing before lossy compaction + output-brevity discipline; ADR-035/036, [`docs/CONTEXT-EDITING-GUIDE.md`](./docs/CONTEXT-EDITING-GUIDE.md)). **In 0.3.0**: opt-in **self-improvement / Reflector loop** (propose-only; ADR-030/032/033) + a first-party-verified **compatibility-matrix correction** (all six tools ship hooks / sub-agents / model routing; ADR-031). Full history: [`CHANGELOG.md`](./CHANGELOG.md).
 >
-> Marketplace listing (VSCode Marketplace + Open VSX) remains **Phase 2** (post-0.4) — see ADR-023.
+> Marketplace listing (VSCode Marketplace + Open VSX) remains **Phase 2** (post-0.5) — see ADR-023.
 
 ---
 
@@ -21,7 +21,7 @@ Write your project's rules, workflow, and discipline ONCE. Install into any AI c
 - [Tool coverage matrix](#tool-coverage-matrix)
 - [Install paths (3 options)](#install-paths)
 - [Cross-platform: Mac and Windows](#cross-platform-mac-and-windows)
-- [Recipes catalog (11)](#recipes-catalog)
+- [Recipes catalog (12)](#recipes-catalog)
 - [`transform.sh` options reference](#transformsh-options-reference)
 - [Update / Maintenance / Uninstall](#update--maintenance--uninstall)
 - [Token measurement & KPI baseline](#token-measurement--kpi-baseline)
@@ -248,7 +248,7 @@ For tools without an adapter (Gemini / Codex / Windsurf), or for adopters in con
 
 ## Recipes catalog
 
-11 opt-in recipes layer project-specific discipline on top of the 5 universal rule bundles. Universal rules always install; recipes are pick-and-mix.
+12 opt-in recipes layer project-specific discipline on top of the 5 universal rule bundles. Universal rules always install; recipes are pick-and-mix.
 
 | Recipe | Install when | Adds |
 |---|---|---|
@@ -263,6 +263,7 @@ For tools without an adapter (Gemini / Codex / Windsurf), or for adopters in con
 | `database-discipline` | Relational store + migrations + dev/prod split | Migration-first schema changes, access-control on new tables, dev/prod parity |
 | `design-system` | Design-token system in use | Tokens over raw hex, component reuse, accessibility + spacing scale adherence |
 | `self-improvement` | Want periodic, human-approved review of your sessions | A **Reflector** reads recent session trajectories + git and **proposes** lessons-learned to `docs/REFLECTION-PROPOSALS.md` (propose-only; you apply). Emits a session-end trajectory hook, a `/reflect` command, a reflector agent, a deterministic prune, and a weekly runner + scheduling guide — on all six tools. See ADR-030/032/033. |
+| `git-hygiene` | Any git project — esp. multi-session/agent repos or protected branches | Shared-repo discipline (G1–G7): no unrequested worktrees, push-don't-hoard, merge=delete-branch, backup≠applied (verify by real code), no reckless force/rebase on shared repos, bundle PRs for CI, session-end hygiene check. Claude adds a non-blocking Stop-hook reminder; other tools use the rule text. See ADR-037. |
 
 #### Decision tree
 
@@ -278,6 +279,7 @@ Want root-cause debugging? YES → debugging
 Relational DB + migrations? YES → database-discipline
 Design-token system?      YES → design-system
 Want weekly session self-review? YES → self-improvement
+Use git (esp. shared/multi-session)? YES → git-hygiene
 ```
 
 #### Recommended combos
@@ -302,7 +304,7 @@ Usage: bash adapters/<tool>/transform.sh <target-project> [options]
 | Option | Description |
 |---|---|
 | `<target-project>` | Project directory to install into (required). `.` for current dir. |
-| `--recipes=A,B,C` | Comma-separated recipes from the 11 in `core/recipes/`. |
+| `--recipes=A,B,C` | Comma-separated recipes from the 12 in `core/recipes/`. |
 | `--dry-run` | Preview only — no files written. |
 | `--measure-baseline` | Run `tools/measure-tokens.sh --latest` after install; save CSV; auto-show anti-patterns if cache hit < 95%. |
 | `--no-prompt` | Skip wizard, apply defaults (CI-safe). Combine with `--recipes` and `--measure-baseline` as needed. |
@@ -311,7 +313,7 @@ Usage: bash adapters/<tool>/transform.sh <target-project> [options]
 | `--force` | Bypass uninstall safety gates (active rebase/merge, missing manifest). |
 | `-h` `--help` | Print usage. |
 
-**Recipe names** (11): `web-mobile-parity`, `i18n`, `monorepo`, `branch-strategy`, `auto-mock-data`, `coding-conventions`, `tdd`, `debugging`, `database-discipline`, `design-system`, `self-improvement`.
+**Recipe names** (12): `web-mobile-parity`, `i18n`, `monorepo`, `branch-strategy`, `auto-mock-data`, `coding-conventions`, `tdd`, `debugging`, `database-discipline`, `design-system`, `self-improvement`, `git-hygiene`.
 
 #### File overwrite behavior
 
@@ -410,7 +412,7 @@ diff CLAUDE.md.conductor-backup-* CLAUDE.md
 
 #### "recipe not found" warning
 
-Check recipe name spelling. Available: `web-mobile-parity`, `i18n`, `monorepo`, `branch-strategy`, `auto-mock-data`, `coding-conventions`, `tdd`, `debugging`, `database-discipline`, `design-system`, `self-improvement`.
+Check recipe name spelling. Available: `web-mobile-parity`, `i18n`, `monorepo`, `branch-strategy`, `auto-mock-data`, `coding-conventions`, `tdd`, `debugging`, `database-discipline`, `design-system`, `self-improvement`, `git-hygiene`.
 
 #### "Tool doesn't recognize the new rules"
 
@@ -493,7 +495,7 @@ A: Open VSX. Cursor is a VSCode fork but cannot pull from Microsoft's marketplac
 
 **Q: My project uses Go / Python / Rust, not TypeScript.**
 
-A: Skip `coding-conventions` (TypeScript-specific). The 5 universal rule bundles and the other 10 recipes are stack-agnostic.
+A: Skip `coding-conventions` (TypeScript-specific). The 5 universal rule bundles and the other 11 recipes are stack-agnostic.
 
 **Q: Windows native PowerShell?**
 

package/adapters/claude/README.md

@@ -45,7 +45,7 @@ bash adapters/claude/transform.sh <target> [--dry-run]
 │   │   ├── quality-gates.md
 │   │   ├── operations.md
 │   │   └── meta-discipline.md
-│   ├── hooks/                                 # 7 hook scripts
+│   ├── hooks/                                 # 9 hook scripts
 │   │   ├── pretool-agent-routing.sh
 │   │   ├── pretool-commit-current-work-check.sh
 │   │   ├── pretool-commit-test-coverage-check.sh

package/adapters/claude/SUPPORTED-FEATURES.md

@@ -32,7 +32,7 @@ CONDUCTOR's universal `meta-discipline.md` rubric (token economy + model routing
 
 ## Hook execution model
 
-CONDUCTOR ships 7 hooks, all registered in the generated `.claude/settings.json` (written directly by `transform.sh` — there is no `settings.template.json`):
+CONDUCTOR ships 9 hooks, all registered in the generated `.claude/settings.json` (written directly by `transform.sh` — there is no `settings.template.json`):
 
 | Hook | Event | Purpose |
 |---|---|---|
@@ -58,9 +58,9 @@ The Claude adapter ships a working `transform.sh`. Verified by fresh-target inst
 
 | Feature claim | Verified-by-real-install | Verification command / observation |
 |---|---|---|
-| `transform.sh` emits 6 roles, 5 rules, 7 hooks, settings.json, docs | ✅ | `bash adapters/claude/transform.sh <tmp>` then inspect `<tmp>/.claude/` |
+| `transform.sh` emits 6 roles, 5 rules, 9 hooks, settings.json, docs | ✅ | `bash adapters/claude/transform.sh <tmp>` then inspect `<tmp>/.claude/` |
 | Sub-agent dispatch works | ✅ | `.claude/agents/{planner,builder,reviewer,helper,designer,scribe}.md` recognized by `/help` |
 | Lazy / always-loaded rules present | ✅ | `.claude/rules/{workflow,spec-as-you-go,quality-gates,operations,meta-discipline}.md` |
-| Hooks registered in settings.json | ✅ | `.claude/settings.json` `hooks:` block lists 4 PreToolUse + 3 Stop |
+| Hooks registered in settings.json | ✅ | `.claude/settings.json` `hooks:` block lists 4 PreToolUse + 5 Stop |
 | Stop hook blocks on missing spec update | ✅ | commit code without spec → `stop-session-log-check.sh` fires |
 | Idempotent re-run | ✅ | second run reports "SKIP (exists)" for every emitted file |

package/adapters/claude/transform-spec.md

@@ -31,7 +31,7 @@ core/docs-templates/specs/_example.md
 core/memory-pattern/README.md
 core/memory-pattern/EXAMPLES.md
 core/roles/*.md                                        # 6 role personas → .claude/agents/ (planner/builder/reviewer/helper/designer/scribe)
-core/hooks/*.sh.template                               # 7 hook templates
+core/hooks/*.sh.template                               # 9 hook templates
 adapters/claude/_native/CLAUDE.md.tpl                  # Claude-specific orchestrator manual template
 ```
 

package/adapters/claude/transform.sh

@@ -70,7 +70,7 @@ Options:
                         manifest are preserved.
   --force               Bypass uninstall safety checks (active worktrees, missing manifest)
 
-Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement
+Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene
 EOF
       exit 0
       ;;
@@ -593,7 +593,7 @@ if [ "$IS_ADOPTER_CASE" = "true" ] && [ "$NO_PROMPT" = "false" ] && [ "$DRY_RUN"
   # 3. Select recipes
   echo ""
   echo "Available recipes:"
-  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement"
+  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene"
   printf "Select recipes (comma-separated, or leave blank for none): "
   read -r _recipe_answer
   if [ -n "$_recipe_answer" ]; then
@@ -725,7 +725,7 @@ mkdir_if_real "$TARGET_ABS/.claude/hooks"
 # read guard) emit only if their templates are present in the CONDUCTOR core/ tree, allowing the
 # adapter to remain forward-compatible with P1.7 work in progress.
 INSTALLED_HOOKS=()
-for hook in pretool-agent-routing stop-session-log-check stop-r6-review-check stop-cache-hit-baseline-check pretool-large-file-read-guard pretool-commit-current-work-check pretool-commit-test-coverage-check stop-trajectory-log; do
+for hook in pretool-agent-routing stop-session-log-check stop-r6-review-check stop-cache-hit-baseline-check pretool-large-file-read-guard pretool-commit-current-work-check pretool-commit-test-coverage-check stop-trajectory-log stop-git-hygiene-guard; do
   src="$CORE_ROOT/hooks/$hook.sh.template"
   dest="$TARGET_ABS/.claude/hooks/$hook.sh"
   if [ ! -f "$src" ]; then
@@ -804,14 +804,15 @@ else
           { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-session-log-check.sh" },
           { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-r6-review-check.sh" },
           { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-cache-hit-baseline-check.sh" },
-          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-trajectory-log.sh" }
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-trajectory-log.sh" },
+          { "type": "command", "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/stop-git-hygiene-guard.sh" }
         ]
       }
     ]
   }
 }
 SETTINGS_EOF
-  log "  wrote $SETTINGS_PATH ($(printf '%s' "${INSTALLED_HOOKS[*]}" | /usr/bin/wc -w | /usr/bin/tr -d ' ') hook(s) installed in .claude/hooks; settings.json registers 8 core hooks: 4 PreToolUse + 4 Stop)"
+  log "  wrote $SETTINGS_PATH ($(printf '%s' "${INSTALLED_HOOKS[*]}" | /usr/bin/wc -w | /usr/bin/tr -d ' ') hook(s) installed in .claude/hooks; settings.json registers 9 core hooks: 4 PreToolUse + 5 Stop)"
   record_emit ".claude/settings.json" "<synthesized>" ""
 fi
 

package/adapters/codex/transform.sh

@@ -75,7 +75,7 @@ Output (single-file Codex model):
   <target>/AGENTS.md    Bundled intro + 5 universal rules + compressed workflow + recipes
   <target>/docs/*.md    Universal doc templates (CURRENT_WORK, REMAINING_TASKS, ...)
 
-Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement
+Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene
 
 What this adapter does NOT install (per ADR-004 honesty):
   - Hook guards (CONDUCTOR emits the Reflector hook when --recipes=self-improvement, ADR-032; other guards remain Claude-only, ADR-034)
@@ -448,7 +448,7 @@ if [ "$IS_ADOPTER_CASE" = "true" ] && [ "$NO_PROMPT" = "false" ] && [ "$DRY_RUN"
 
   echo ""
   echo "Available recipes:"
-  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement"
+  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene"
   printf "Select recipes (comma-separated, or leave blank for none): "
   read -r _recipe_answer
   if [ -n "$_recipe_answer" ]; then

package/adapters/copilot/transform.sh

@@ -87,7 +87,7 @@ Options:
                         Conductor-emitted files when none.
   --force               Bypass uninstall safety checks (active worktrees, missing manifest)
 
-Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement
+Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene
 
 Output (default):
   <target>/.github/copilot-instructions.md            (5 universal rules merged)
@@ -523,7 +523,7 @@ if [ "$IS_ADOPTER_CASE" = "true" ] && [ "$NO_PROMPT" = "false" ] && [ "$DRY_RUN"
 
   echo ""
   echo "Available recipes:"
-  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement"
+  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene"
   printf "Select recipes (comma-separated, blank for none): "
   read -r _recipe_answer
   if [ -n "$_recipe_answer" ]; then

package/adapters/cursor/transform.sh

@@ -67,7 +67,7 @@ Options:
                         manifest are preserved.
   --force               Bypass uninstall safety checks (active worktrees, missing manifest)
 
-Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement
+Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene
 
 What this adapter does NOT install (per ADR-004 honesty + ADR-021):
   - Hook guards (CONDUCTOR emits the Reflector hook when --recipes=self-improvement, ADR-032; other guards remain Claude-only, ADR-034)
@@ -490,7 +490,7 @@ if [ "$IS_ADOPTER_CASE" = "true" ] && [ "$NO_PROMPT" = "false" ] && [ "$DRY_RUN"
 
   echo ""
   echo "Available recipes:"
-  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement"
+  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene"
   printf "Select recipes (comma-separated, or leave blank for none): "
   read -r _recipe_answer
   if [ -n "$_recipe_answer" ]; then

package/adapters/gemini/transform.sh

@@ -71,7 +71,7 @@ Options:
                         manifest are preserved.
   --force               Bypass uninstall safety checks (active worktrees, missing manifest)
 
-Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement
+Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene
 
 Gemini single-file model:
   - All 5 universal rules + selected recipes are bundled into one always-loaded GEMINI.md.
@@ -486,7 +486,7 @@ if [ "$IS_ADOPTER_CASE" = "true" ] && [ "$NO_PROMPT" = "false" ] && [ "$DRY_RUN"
 
   echo ""
   echo "Available recipes:"
-  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement"
+  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene"
   printf "Select recipes (comma-separated, or leave blank for none): "
   read -r _recipe_answer
   if [ -n "$_recipe_answer" ]; then

package/adapters/windsurf/transform.sh

@@ -67,7 +67,7 @@ Options:
                         manifest are preserved.
   --force               Bypass uninstall safety checks (active worktrees, missing manifest)
 
-Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement
+Recipes available: web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene
 
 What this adapter does NOT install (per ADR-004 honesty + ADR-021):
   - Hook guards (CONDUCTOR emits the Reflector hook when --recipes=self-improvement, ADR-032; other guards remain Claude-only, ADR-034)
@@ -453,7 +453,7 @@ if [ "$IS_ADOPTER_CASE" = "true" ] && [ "$NO_PROMPT" = "false" ] && [ "$DRY_RUN"
 
   echo ""
   echo "Available recipes:"
-  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement"
+  echo "  web-mobile-parity, i18n, monorepo, branch-strategy, auto-mock-data, coding-conventions, tdd, debugging, database-discipline, design-system, self-improvement, git-hygiene"
   printf "Select recipes (comma-separated, or leave blank for none): "
   read -r _recipe_answer
   if [ -n "$_recipe_answer" ]; then

package/core/hooks/README.md

@@ -14,6 +14,7 @@ CONDUCTOR's universal hook spec. Templates here are compiled into native shell s
 | `stop-r6-review-check.sh.template` | Session stop event | Remind to run pre-merge review on open PR | Claude `.claude/hooks/stop-r6-review-check.sh` |
 | `stop-cache-hit-baseline-check.sh.template` | Session stop event | Non-blocking diagnostic — reads the latest session JSONL, computes cache hit rate, reminds when below baseline (token-economy). Fail-open. Override env disables: `CONDUCTOR_SKIP_CACHE_CHECK=1`. | Claude `.claude/hooks/stop-cache-hit-baseline-check.sh` |
 | `stop-trajectory-log.sh.template` | Session stop event | Non-blocking — reads `transcript_path` + `session_id` from the Stop hook's **stdin** (exact provenance; no `~/.claude/projects` dir-scan) and **upserts** one pointer record per session (session id, transcript path, git HEAD, cwd) into `.conductor/trajectories/index.jsonl` for the Reflector (recipes/self-improvement.md). Same stdin approach as the non-Claude portable logger `core/reflector/trajectory-log.sh`. **Opt-in gated: no-ops unless `.conductor/reflect/` exists** (created only by the self-improvement recipe). Anchors to the project root; fail-open. Override: `CONDUCTOR_SKIP_TRAJLOG=1`. | Claude `.claude/hooks/stop-trajectory-log.sh` |
+| `stop-git-hygiene-guard.sh.template` | Session stop event | Non-blocking — detects git-hygiene collapse (extra worktrees, local-only commits not on any remote, abnormally many local branches) and injects a cleanup reminder per `recipes/git-hygiene.md` (G1/G2/G3/G7). **Opt-in gated: no-ops unless `.claude/rules/git-hygiene.md` exists** (created only by the git-hygiene recipe). Anchors to the project root; 15-min cool-down; fail-open, always exits 0. Overrides: `CONDUCTOR_SKIP_GIT_HYGIENE=1`, `CONDUCTOR_GIT_HYGIENE_BRANCH_MAX` (default 20). | Claude `.claude/hooks/stop-git-hygiene-guard.sh` |
 
 The two `pretool-commit-*` templates are **soft `ask` warns**: they emit
 `{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":...}}`,

package/core/hooks/stop-git-hygiene-guard.sh.template

@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+#
+# CONDUCTOR universal hook template
+# hook_id: stop-git-hygiene-guard
+# trigger: stop
+# action: On session stop, detect git-hygiene-collapse states (orphan worktrees,
+#         local-only commits, abnormally many local branches) and inject a
+#         non-blocking cleanup reminder per the git-hygiene recipe (G1/G2/G3/G7).
+# compile_targets: claude
+# fallback: rule-text-reminder
+#
+# Generated by adapters/<tool>/transform.sh.
+#
+# Enforces:
+#   - recipes/git-hygiene.md (session-end hygiene: G1 worktrees, G2 push, G3 delete)
+#
+# Behavior (fail-open, non-blocking):
+#   1. No-op unless the git-hygiene recipe is installed (self-gate on
+#      .claude/rules/git-hygiene.md) — the guard ships with every Claude install
+#      but only acts for adopters who opted into the recipe.
+#   2. Reminder only. Emits {"decision":"block","reason":...} to surface the state
+#      to Claude; ALWAYS exits 0. Never hard-fails, never blocks session stop.
+#   3. Cools down (one reminder / 15 min) so it does not nag.
+#
+# Detects the states that make merged work look lost and burn reconciliation time:
+#   - worktrees beyond the main tree (G1),
+#   - local commits not on any remote (`git log --branches --not --remotes`) (G2),
+#   - abnormally high local branch count = merged branches never deleted (G3).
+#
+# Overrides (read at runtime, not compile-time placeholders):
+#   CONDUCTOR_SKIP_GIT_HYGIENE=1       silence for a deliberate transient state
+#   CONDUCTOR_GIT_HYGIENE_BRANCH_MAX   local-branch threshold (default 20)
+
+set -u
+
+[ "${CONDUCTOR_SKIP_GIT_HYGIENE:-}" = "1" ] && exit 0
+
+# Anchor to the project root. The emitted hook lives at <project>/.claude/hooks/,
+# so ../.. is the root — resolves the recipe gate + git checks regardless of cwd.
+_self_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd)" || exit 0
+_proj_root="$(cd "$_self_dir/../.." 2>/dev/null && pwd)" || exit 0
+cd "$_proj_root" || exit 0
+
+# Self-gate: only act when the git-hygiene recipe is installed.
+[ -f ".claude/rules/git-hygiene.md" ] || exit 0
+
+# Not a git repo → nothing to check.
+git rev-parse --git-dir >/dev/null 2>&1 || exit 0
+
+BRANCH_MAX="${CONDUCTOR_GIT_HYGIENE_BRANCH_MAX:-20}"
+
+# (1) Worktrees beyond the main tree.
+WT_COUNT="$(git worktree list 2>/dev/null | /usr/bin/grep -c . )"
+[ -n "$WT_COUNT" ] || WT_COUNT=1
+WT_EXTRA=$((WT_COUNT - 1))
+
+# (2) Local commits not on any remote (unpushed = at-risk / phantom-lost).
+LOCAL_ONLY="$(git log --branches --not --remotes --oneline 2>/dev/null | /usr/bin/grep -c . )"
+[ -n "$LOCAL_ONLY" ] || LOCAL_ONLY=0
+
+# (3) Local branch count (merged branches never deleted accumulate here).
+BRANCHES="$(git for-each-ref --format='%(refname:short)' refs/heads 2>/dev/null | /usr/bin/grep -c . )"
+[ -n "$BRANCHES" ] || BRANCHES=0
+
+# Nothing wrong → allow stop silently.
+if [ "$WT_EXTRA" -le 0 ] && [ "$LOCAL_ONLY" -le 0 ] && [ "$BRANCHES" -le "$BRANCH_MAX" ]; then
+  exit 0
+fi
+
+# Cool-down: at most one reminder per 15 min.
+FLAG="/tmp/conductor-git-hygiene-flag-${USER:-unknown}"
+if [ -f "$FLAG" ]; then
+  LAST="$(/bin/cat "$FLAG" 2>/dev/null || echo 0)"
+  NOW="$(/bin/date +%s 2>/dev/null || echo 0)"
+  if [ "$((NOW - LAST))" -lt 900 ]; then
+    exit 0
+  fi
+fi
+/bin/date +%s > "$FLAG" 2>/dev/null || true
+
+MSGS=""
+[ "$WT_EXTRA" -gt 0 ] && MSGS="${MSGS}${WT_EXTRA} extra git worktree(s) present (G1: remove unless a requested worktree is mid-use). "
+[ "$LOCAL_ONLY" -gt 0 ] && MSGS="${MSGS}${LOCAL_ONLY} local-only commit(s) not on any remote (G2: push them — this is exactly the 'phantom lost/unmerged feature' state). "
+[ "$BRANCHES" -gt "$BRANCH_MAX" ] && MSGS="${MSGS}${BRANCHES} local branches (G3: delete branches whose PRs merged, local+remote). "
+
+/bin/cat <<JSON
+{"decision":"block","reason":"[git-hygiene] ${MSGS}Before ending: run 'git worktree list' + 'git log --branches --not --remotes --oneline' and clean up per the git-hygiene recipe (push local-only work, remove orphan worktrees, delete merged branches). Backup != applied: verify features are on the target branch by real code, not by a backup branch. (Set CONDUCTOR_SKIP_GIT_HYGIENE=1 to silence a deliberate transient state.)"}
+JSON
+exit 0

package/core/recipes/README.md

@@ -2,7 +2,7 @@
 
 Per ADR-013, CONDUCTOR ships project-specific recipes as OPT-IN. They are not loaded by default. Adopters select the recipes that match their project and the adapter wires them into the appropriate native location.
 
-## The 11 recipes
+## The 12 recipes
 
 | File | When to install |
 |---|---|
@@ -17,6 +17,7 @@ Per ADR-013, CONDUCTOR ships project-specific recipes as OPT-IN. They are not lo
 | `database-discipline.md` | Project has a relational store with migrations + dev/prod split. Ships 2 recipe-scoped hookify rules (SQL access-control + SECURITY DEFINER search_path) — see ADR-028 |
 | `design-system.md` | Project maintains a design-token system (color/spacing/typography tokens). Ships 1 recipe-scoped hookify rule (raw-hex-instead-of-token) — see ADR-028 |
 | `self-improvement.md` | Project wants a periodic, human-approved Reflector that distils session lessons into memory/rules. Propose-only; nothing auto-applies. Drives the `reflector` role — see ADR-030 |
+| `git-hygiene.md` | Any git project — esp. repos worked by multiple sessions/agents or with protected branches. Shared-repo discipline (no orphan worktrees, push-don't-hoard, merge=delete-branch, backup≠applied). Ships a Claude-only Stop-hook reminder (`stop-git-hygiene-guard`); other tools use the rule text — see ADR-037 |
 
 ## Selection patterns
 
@@ -27,7 +28,8 @@ Per ADR-013, CONDUCTOR ships project-specific recipes as OPT-IN. They are not lo
 | Multi-locale SaaS | `i18n` + `coding-conventions` + `tdd` + `debugging` |
 | Relational-DB-backed SaaS (migrations + dev/prod) | `database-discipline` + `coding-conventions` + `tdd` + `debugging` |
 | Token-driven design system (theming / dark-mode) | `design-system` + `coding-conventions` + `tdd` + `debugging` |
-| Full-stack SaaS with web + mobile + i18n | All 11 |
+| Full-stack SaaS with web + mobile + i18n | All 12 |
+| Any git repo, esp. shared / multi-session | add `git-hygiene` to any of the above |
 | Greenfield experiment | None — universal-rules + roles only is enough |
 
 ## How adapters consume these files

package/core/recipes/git-hygiene.md

@@ -0,0 +1,60 @@
+---
+recipe_id: git-hygiene
+recipe_name: "Git Hygiene / Shared-Repo Discipline"
+applies_when: "any git project — especially repos worked by multiple sessions/agents or with protected branches"
+severity: STRONG (when installed)
+linked_rules:
+  - operations
+  - quality-gates
+  - meta-discipline
+---
+
+# Recipe — Git Hygiene / Shared-Repo Discipline
+
+> Opt-in recipe. Install for any project under git — strongly recommended when more than one session/agent may touch the repo, or when it has protected branches. It codifies the workflow-hygiene habits that stop *completed* work from *looking* lost. Install if you have ever spent time reconciling "where did my feature go" — you likely will again without it.
+
+## Why this exists
+
+Left undisciplined, an agent can turn a healthy repo into one where merged work looks stranded: it spins up `git worktree`s nobody asked for and never cleans them up, hoards commits locally instead of pushing, and never deletes branches after their PRs merge. The classic collapse — dozens of stale local branches, a pile of local-only commits, orphan worktrees — loses *nothing* (it's all merged), but it makes finished work read as **unmerged / lost**, triggers a false "it's only backed up, not applied" scramble, and burns large reconciliation time and trust. Prose alone gets forgotten, so this recipe is backed by a Claude Stop hook (below).
+
+## The 7 obligations
+
+### G1 — No worktrees unless explicitly requested
+The default work model is **normal branches in the single working tree**. Reach for `git worktree` only when the user explicitly asks, or a documented isolation need exists. If you create one, **remove it in the same session** (`git worktree remove`) and delete its branch. An orphan worktree's uncommitted/unpushed work reads as a phantom "lost / unmerged feature" to the next actor.
+
+### G2 — Push, never hoard
+The moment a commit is worth keeping, push it to a **named branch on origin**. Do not accumulate local-only commits. Invariant: at session end `git log --branches --not --remotes` is **empty**. Local-only piles are the direct cause of "unpushed/lost feature" panics and the cost of later diffing what is *actually* missing.
+
+### G3 — Merge means delete
+When a PR merges, immediately delete that branch **both local and remote** (`git branch -d/-D` + `git push origin --delete`). Stale pointers — especially a pre-squash local pointer left after a squash-merge — masquerade as an "unmerged feature" and are the #1 source of the illusion.
+
+### G4 — Backup ≠ applied
+Pushing to an isolated/backup branch is **not** integration. "It's backed up" and "the feature is on the target branch / live" are separate claims. Verify a feature is on your integration/target branch by reading the **actual code** there (file / symbol / value grep), never by the existence of a backup branch. This is `quality-gates.md` Q4 (verify-after-changes) applied to git: a backup is a safety net, never a completion verdict.
+
+### G5 — No reckless branch ops on a shared repo
+No force-push / rebase / reset / branch-move / protected-branch rewrite that a concurrent session or another actor might be building on. Minimize branch churn; when a branch operation's scope or reversibility is unclear, ASK (`meta-discipline.md` AMB-3/AMB-4 — non-trivially-reversible ops and protected-branch writes force ASK). **Another session's uncommitted/unpushed work is inviolable** — back it up and surface it, but never merge/delete/rewrite it on your own judgment.
+
+### G6 — Bundle PRs (CI economy)
+Bundle related work into as few PRs as reasonable — CI runs per PR and free-tier minutes are finite. Do not fragment one change into many PRs that each re-consume CI, and do not push docs-only commits mid-review that re-trigger the whole pipeline. Verify locally before the single push so the one CI run passes first try.
+
+### G7 — Session-end hygiene check
+Before finishing a session: **0 orphan worktrees · 0 local-only commits (all on origin) · merged branches deleted · current branch + working-tree state clear.**
+
+- [ ] `git worktree list` → only the main tree (unless a requested worktree is still mid-use)?
+- [ ] `git log --branches --not --remotes --oneline` → empty?
+- [ ] Merged PR branches deleted (local + remote)?
+- [ ] Not sitting on a stale/behind branch that hides completed work?
+
+## Conductor Integration
+
+- **Claude** — a Stop hook `stop-git-hygiene-guard` (from `core/hooks/`) fires a **non-blocking reminder** when it detects the collapse states: extra worktrees, local-only commits, or an abnormally high local-branch count. It always exits 0 (observation only, never blocks a session), self-gates on this recipe being installed, cools down between reminders, and honors `CONDUCTOR_SKIP_GIT_HYGIENE=1` (silence) and `CONDUCTOR_GIT_HYGIENE_BRANCH_MAX` (branch-count threshold, default 20).
+- **Cursor / Copilot / Gemini / Codex / Windsurf** — the hook is Claude-only (per `docs/DESIGN-DECISIONS.md` ADR-034; Windsurf also lacks Stop-style events). On these tools this recipe's rule text is the enforcement: run the G7 checklist manually at session end.
+- **Target branch** — G2/G3/G4 reference your *integration/target branch* (commonly `main`, or `develop` if you also install the `branch-strategy` recipe). Substitute your project's value.
+
+## Cross-References
+
+- `quality-gates.md` §4 (verify-after-changes) — G4's "verify by real code, not by a backup branch."
+- `meta-discipline.md` §3 (AMB-3/AMB-4) — G5's ASK-before-reckless-branch-op gate.
+- `meta-discipline.md` §5.7 (lossless-before-lossy compaction) — the *uncommitted-durability* layer beneath G2's *unpushed-hygiene* layer; complementary.
+- `branch-strategy.md` recipe — defines the target/integration branch model G2–G4 build on.
+- `core/anti-patterns/frequent-rule-file-edit.md` — G6's "don't re-trigger CI with churn" echoes the cost-of-churn principle.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omniconductor",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Multi-coding-agent workflow framework. Write your project's rules, workflow, and discipline ONCE — install into Claude Code, Cursor, GitHub Copilot, Gemini CLI, Codex, or Windsurf. Encodes the discipline developers most often skip — spec-before-code, review gates, session continuity — so your AI agents catch what's easy to miss.",
   "license": "Apache-2.0",
   "author": "LFamily Labs LLC",