opencode-thrum-pro 0.1.12 → 0.1.14

package/assets/commands/thrum-compact-extended.md

@@ -226,6 +226,11 @@ if [ "$SNAPSHOT_OK" = 1 ] && [ "$SESSION_OK" = 1 ]; then
   # all, so this is caught synchronously, not inferred later from silence.
   thrum tmux send "$AGENT" "/compact"
   SEND_RC=$?
+  # Exit 0 may print "ACCEPTED (non-turn command)": the runtime acknowledged the
+  # command without starting a model turn (for example compaction began). That is
+  # SUCCESS - continue to the next step exactly as for a plain exit 0.
+  # Exit 4 UNCONFIRMED means no acknowledgement was seen: inspect the pane before
+  # doing anything else.
   # Exit 3 = HELD, exit 4 = VERDICT UNKNOWN (thrum tmux send --help). In both
   # the "/compact" text is ALREADY TYPED into this pane and Enter was withheld
   # or unconfirmed. NEVER fall through to the raw retry below: it would append a

package/assets/commands/thrum-compact.md

@@ -223,6 +223,11 @@ if [ "$SNAPSHOT_OK" = 1 ] && [ "$SESSION_OK" = 1 ]; then
   # turn regardless, so the delay costs nothing.
   thrum tmux send "$SESSION" "/compact"
   SEND_RC=$?
+  # Exit 0 may print "ACCEPTED (non-turn command)": the runtime acknowledged the
+  # command without starting a model turn (for example compaction began). That is
+  # SUCCESS - continue to the next step exactly as for a plain exit 0.
+  # Exit 4 UNCONFIRMED means no acknowledgement was seen: inspect the pane before
+  # doing anything else.
   # Exit 3 = HELD (Enter withheld), 4 = VERDICT UNKNOWN: "/compact" is already
   # typed in the pane. Do NOT retype it (that yields "/compact/compact"); report
   # and stop so a human/coordinator can inspect the pane.

package/assets/skills/coordinator-assessing-agent-completion/SKILL.md

@@ -159,7 +159,7 @@ across background sub-agents that examine each worktree read-only and RETURN a v
 they never reap. Per worktree each reports: sleeping-agent marker present?; branch
 containment (ancestor of trunk / pushed / UNMERGED-with-commit-list); only-copy authored
 content (docs/plans/specs, undelivered reports, restart snapshots), ignoring regenerable
-dirt (`scripts/thrum-*.sh`, `.thrum/redirect`, `runtime_config.json`). Fence them READ-ONLY
+dirt (`thrum-*.sh` helper scripts, `.thrum/redirect`, `runtime_config.json`). Fence them READ-ONLY
 (no checkout/reset/stash/clean/rebase/commit/push, no `worktree remove`, no `agent delete`,
 no `rm`). You consolidate and decide.
 
@@ -251,28 +251,25 @@ Once you've classified an agent as idle, its `gopls` process (if any) is a
 second, independent reclaim candidate — an idle agent's gopls is dead weight
 sitting in RAM.
 
-`scripts/reap-idle-gopls.sh` matches each running `gopls` process to its
-owning agent (ppid chain → tmux pane_pid → `thrum team --json` session) and
-uses `tmux_state` as a cheap first-pass filter — anything not idle by that
-signal is skipped outright. That filter is bounded, not authoritative: it
-does not replace this skill's own idle/finished judgment, which still comes
-from the transcript per the rules above. Run the script alongside the scan
-above, apply the same transcript-based gate to whatever it surfaces, and
-fold the result into a single combined table: idle agent · gopls PID ·
-RSS-MB.
+Match each running `gopls` process to its owning agent (ppid chain → tmux
+pane_pid → `thrum team --json` session) and use `tmux_state` as a cheap
+first-pass filter — anything not idle by that signal is skipped outright. That
+filter is bounded, not authoritative: it does not replace this skill's own
+idle/finished judgment, which still comes from the transcript per the rules
+above. Do this alongside the scan above, apply the same transcript-based gate to
+whatever it surfaces, and fold the result into a single combined table: idle
+agent · gopls PID · RSS-MB.
 
 - Killing an idle agent's gopls is a no-op — it respawns on the agent's next
   LSP request. Never destructive to the agent itself.
-- **NEVER kill a pool or active-worker gopls.** The script excludes by ROLE
-  (orchestrator, gate, coordinator, brainstormer, researcher — the roles
-  that are never reap targets) plus the non-idle-state skip above, plus one
-  named exception for a role-uncovered pool agent. It also runs a canary
-  self-check before printing anything: if it can't prove the exclusion still
-  resolves correctly, it aborts loudly instead of printing a kill-list.
-  Do not override or bypass any of this.
-- Same framing as the rest of this skill: the script **produces information,
-  you decide**. It is read-only and dry-run — it prints a kill-list, it never
-  kills anything.
+- **NEVER kill a pool or active-worker gopls.** Exclude by ROLE (orchestrator,
+  gate, coordinator, brainstormer, researcher — the roles that are never reap
+  targets) plus the non-idle-state skip above. Before building any kill-list,
+  prove the exclusion still resolves correctly; if you cannot, abort rather than
+  print one. Do not override or bypass any of this.
+- Same framing as the rest of this skill: this step **produces information, you
+  decide**. It is read-only — it yields a candidate list, it never kills
+  anything.
 
 ## 🔴 Footguns — never do these (each measured, each cost real time or state)
 

package/assets/skills/coordinator-deploying-a-node/SKILL.md

@@ -48,14 +48,14 @@ If the project has no WAL/SHM, this section is N/A — skip and note.
 
 ## 4. Never wrap service start/restart in a blind timeout
 
-🔴 **On macOS, the restart command is NOT `service.restart_command` — it is `service.mac_restart_command`** (Thrum: `scripts/mac-daemon-restart-via-cron.sh`, run from inside the repo). A daemon restarted from a terminal or agent pane gets its Local Network (TCC) permission attributed to that terminal and is silently denied LAN peer dials (`no route to host`): peers go dark while the node itself looks healthy, and `PPID 1` does NOT prove it was re-parented correctly. Check the node's OS before choosing the command; this has been forgotten on primary repeatedly. After a mac restart, verify the peers on the LAN reconnect, not just the version.
+🔴 **On macOS, use `service.mac_restart_command`, not `service.restart_command`.** (Example — Thrum adapter: `service.mac_restart_command` preserves Local Network (TCC) permission.) A daemon restarted from a terminal or agent pane gets its Local Network (TCC) permission attributed to that terminal and is silently denied LAN peer dials (`no route to host`): peers go dark while the node itself looks healthy, and `PPID 1` does NOT prove it was re-parented correctly. Check the node's OS before choosing the command. After a mac restart, verify the peers on the LAN reconnect, not just the version.
 
 Run the project's service restart command (`fleet.deployment.thrum.service.restart_command`, or `service.mac_restart_command` on macOS, or product equivalent) without a blind timeout wrapper. A timeout that kills a migrating restart mid-migration manufactures a half-migrated store.
 
 - Adapter flag `service.never_timeout` is true.
 - Signal-window rules are adapter data: `migration.signal_rules` (`SIGQUIT` fatal-always, `SIGUSR1` fatal-before-socket). Respect them — do not send fatal signals in the forbidden window.
 
-> Example — Thrum project: restart via `thrum daemon restart`, never wrapped in `timeout`; mac path via `scripts/mac-daemon-restart-via-cron.sh`.
+> Example — Thrum adapter: use the configured `service.mac_restart_command` on macOS; use `service.restart_command` otherwise. Never wrap either in `timeout`.
 
 ## 5. Install from the delivered artifact (never rebuild on the node)
 

package/assets/skills/coordinator-hotpath-merge-gate/SKILL.md

@@ -122,12 +122,13 @@ rediscovering these the hard way:
    starves and hits the configured `-timeout` wall in both the race and
    non-race lane. The gate's OUTPUT must show the sharded runner actually
    executed for RPC (`race-shard` / `package-shard --mode norace`, or
-   `scripts/test-run.sh race|norace ./internal/daemon/rpc`, or `make gate`
+   the project's sharded test runner (race or norace lane) on `./internal/daemon/rpc`, or `make gate`
    which shards both lanes automatically) — not just that some RPC test ran.
    A bound-timeout with ZERO test failures is a FALSE RED, not a finding:
    distinguish it from a genuine hang/deadlock via
    `go run ./cmd/testgate classify-timeout --log <file> --shard-config <file>
-   --shard <name>` (fails closed — only BOUND-TIMEOUT exits 0; HANG and
+   --shard <name> --pkg-dir <package dir>` (shard configs are hash-placed, so
+   `--pkg-dir` is required) (fails closed — only BOUND-TIMEOUT exits 0; HANG and
    UNCLASSIFIED both exit nonzero) before reporting it as a regression.
    If a gate's own command line invokes the bare package path for RPC, that is a gate defect, not a passing lane.
    A HANG or UNCLASSIFIED verdict from `classify-timeout` requires human review.
@@ -200,6 +201,14 @@ when the ledger-equality test alone would pass.
 
 ## Delta re-gate continuity — walk the whole branch, read the whole function
 
+**When a delta re-gate exists at all:** only after a gate found a failing test
+or a blocking finding that the change itself causes, and the author pushed a
+fix for it. Then the gate reruns only the lanes that were red plus the packages
+the fix touches. A delta re-gate is NEVER asked for because trunk moved, because
+the branch merged trunk, because a generated file was regenerated, or because a
+minor finding was fixed: a green run lands as it is (coordinator-merging-code,
+"LAND ON GREEN").
+
 **Why:** A commit introducing a lock can be an ancestor of a delta-re-gate's
 base and never appear in any walked diff, even when a later commit edits the
 gating condition on that call. Root cause: the gate is delta-scoped. The diff

package/assets/skills/coordinator-merging-code/SKILL.md

@@ -26,6 +26,78 @@ authority for this branch in practice (check with your team, or your
 project's own operational convention); if that is not you, route the merge
 to them the same as if the map had named them explicitly.
 
+## LAND ON GREEN — read this before anything else in this skill
+
+**If a green gate run comes in, that is enough. Land it in the same turn.**
+Sending a green change back costs hours on every landing and delays all
+development. Nothing below in this skill overrides this section; where another
+line seems to, this section wins.
+
+1. **Green run + clean merge against trunk = merge now**, in the turn the
+   verdict, or the request to land, arrives.
+2. **Trunk moving never invalidates a green run.** The gate takes trunk once for
+   its landing tree. Do not ask for a merge-forward, a fast-forward, a rebase or
+   a re-run because trunk has moved since.
+3. **No "delta gates".** A merge-forward followed by a second gate of the new
+   tip is the same send-back loop under another name. So is a "validation run",
+   a "confirmation run", a "re-pin", a "re-admit" or a "fresh full gate" of a
+   change that already has a green run. Do not ask for any of them.
+4. **Minor findings do not reopen a gate.** If a small commit on the branch
+   already fixes them, land the tip and name that commit in the merge message.
+   If they are not fixed, land and route the fix as a follow-up.
+5. **Generated-file conflicts are the gate's to regenerate**, as a
+   gate-authored commit on the landing ref, with no race re-run and no trip
+   back to the implementer.
+6. **No post-landing verification gate.** The next gate's landing tree contains
+   the landing and covers it.
+7. **Do not hold a ready change behind another landing** unless the two
+   actually conflict when merged.
+8. **A chain of branches built on top of each other lands as ONE merge.** They
+   build on each other; gate the top of the chain once (it contains the rest)
+   and merge it once. Do not gate or merge the links separately, and do not ask
+   for four merges when the chain has four links.
+9. **A request to land gets a merge or a named blocking finding**, with the
+   failing test name or the file and line. Never a status report, and never a
+   place in a queue.
+
+### What the per-landing gate runs (owner ruling, 2026-10-11) — no race on every landing
+
+**A full race is NOT run for every landing.** Landings go in on a non-race
+gate, and trunk is raced in batches. **Nothing gets to deploy without a race.**
+
+The per-landing gate:
+
+1. Landing tree on trunk, taken once.
+2. Build and vet (default and darwin).
+3. The NON-RACE lane (the project test runner's `norace` lane, one concrete package per
+   call) for the packages the diff touches. The non-race lane runs every test;
+   the race lane runs the same tests with the detector on.
+4. The structural checks (shard configs, census coverage, the guard tests the
+   change names); the gate regenerates generated files itself.
+5. Only where the change is itself a concurrency change — it adds or changes a
+   lock, a channel, a goroutine, a context-cancellation path, or a fence
+   against a concurrent actor — also the change's OWN focused race selectors
+   (the tests it adds), not the whole package under race.
+6. An explicit verdict with the landing ref. Green lands the same turn.
+
+The batch race:
+
+- After every FIVE landings, dispatch ONE full race of trunk
+  (the project test runner's `race all`) to one gate.
+- A failure is attributed to a landing by test name and stack trace and fixed
+  as a follow-up. Landings are not unwound, and other landings do not wait.
+- **A bundle is built only from a trunk commit that has a green full race.**
+  If the last batch race is older than trunk's tip, race the tip first.
+
+A non-race run may take a pool slot above the cap (lower load); a race run
+uses a normal slot.
+
+The only things that stop a landing: a failing test that the change itself
+causes, named; a blocking review finding, with file and line; a hand-written
+merge conflict (the implementer resolves that one conflict, and only the
+conflicting part is checked again); or no gate run at all, in which case the
+change goes on a gate as that gate's next job, not back to its author.
+
 > 🔴 **THE ONE THING MOST OFTEN GOT WRONG: YOU DO NOT RUN THE GATES. YOU DISPATCH
 > THEM TO THE GATE RUNNER.** See §3. A coordinator that walks the lenses inline
 > burns the one resource it cannot replace and leaves **no auditable verdict** —
@@ -49,10 +121,12 @@ agent and either one finding or an explicit zero, per axis. **An absent report a
 a clean report are different things**, and silence defaults to the reading you
 want. If an axis goes silent twice, re-route it rather than re-spawning.
 
-**A verdict attaches to an OBJECT.** If the branch takes a new commit after review
-— including a merge-forward — the prior verdicts do not transfer. **Re-dispatch the
-axes on the delta.** A fix produced in response to a finding is exactly where the
-next defect lives.
+**A review verdict attaches to the change it read.** If the branch takes a new
+commit that changes behaviour after review, a reviewer reads that commit before
+it lands. A merge of trunk into the branch, a regenerated generated file, or a
+commit that only fixes a minor finding the gate already named is NOT a new
+object: the prior review and the green gate run stand, and nothing is
+re-dispatched for it (see "LAND ON GREEN" above).
 
 **Consolidate into ONE numbered list** across all severities before anything goes
 back to the implementer. Never send partial findings; they fix batch 1 and miss
@@ -170,7 +244,7 @@ executed half is **scoped to the change**:
 
 - Build the merged tree (`go build ./...`).
 - 🔴 **RULING:** the full sharded race suite —
-  `scripts/test-run.sh race all` (~15-20 min) — on the **merged tree**, every
+  the project's sharded race test runner over all packages (~15-20 min) — on the **merged tree**, every
   Pass-3 verdict. This replaces the prior "changed packages only (+ rpc shard
   sweep)" race scoping below the ruling; a targeted `-run` is still never
   acceptable (a targeted run misses cross-test races). Never on primary (the

package/assets/skills/coordinator-philosophy-merge-gate/SKILL.md

@@ -93,10 +93,10 @@ dispatch time — hand this list verbatim:
    **Exception: `internal/daemon/rpc` must NEVER be run monolithically** — a
    bare `go test [-race] ./internal/daemon/rpc` cannot finish inside any
    gate-length timeout. Run it through the sharded runner (`race-shard`,
-   `scripts/test-run.sh race ./internal/daemon/rpc`, or `make gate`) and confirm
+   the project's sharded race test runner on `./internal/daemon/rpc`, or `make gate`) and confirm
    the gate's output shows it executed. A bound-timeout with ZERO test failures
    is a false red: classify it with `go run ./cmd/testgate classify-timeout
-   --log <file> --shard-config <file> --shard <name>` (only BOUND-TIMEOUT exits
+   --log <file> --shard-config <file> --shard <name> --pkg-dir <package dir>` (only BOUND-TIMEOUT exits
    0) before reporting a regression. See item 7 of `coordinator-hotpath-merge-gate`.
 7. Build+test the MERGED-tree result as a SEPARATE condition — neither gate
    currently runs a build of the actual post-merge tree; a clean pre-merge

package/assets/skills/coordinator-rolling-out-to-nodes/SKILL.md

@@ -62,7 +62,7 @@ Build once per artifact on its `artifact.build_host` via `artifact.build_command
 ## 5. The staged order — canary, waves, prepare-and-hold, promotion gate
 
 > 🔴 **If any node fails during the rollout — canary or any wave — STOP THE ROLLOUT.** Do not roll, restart, or recommend
-> restarting any further node (including the build host / primary) until the failure is root-caused and fixed or the
+> restarting any further node (including the build host) until the failure is root-caused and fixed or the
 > owner explicitly decides to continue. A node that went down and was recovered by hand is a FAILURE, not a green.
 
 - **Canary first, alone.** One node (adapter `topology.canary`) rolls first. Its health must be observed green before any wave proceeds.
@@ -94,4 +94,4 @@ The node's local runbook is `coordinator-deploying-a-node` — reference that sk
 - If `fleet.deployment.thrum.products` exists (vestigial), STOP — products live only at `fleet.deployment.products`.
 - If a node reports success by exit code alone without observed-effect verification, treat as not-verified.
 - Never wrap a service restart in a blind timeout on the node (see node skill `service.never_timeout` and `migration.signal_rules`).
-- 🔴 A **macOS** node (including the build host / primary) restarted with the plain `service.restart_command` instead of `service.mac_restart_command` (Thrum: `scripts/mac-daemon-restart-via-cron.sh`). The daemon loses its Local Network permission and its LAN peers go dark while it looks healthy. Put the mac command in every macOS node's dispatch, and use it yourself when you roll the build host last.
+- 🔴 A **macOS** node restarted with the plain `service.restart_command` instead of `service.mac_restart_command` (Example — Thrum adapter: `service.mac_restart_command`). The daemon loses its Local Network permission and its LAN peers go dark while it looks healthy. Put the mac command in every macOS node's dispatch, and use it yourself when you roll the build host last.

package/assets/skills/diagnosing-fleet-and-daemon/SKILL.md

@@ -249,5 +249,5 @@ name the wrong path or wrong query explicitly, so the next reader recognises
 their own mistake rather than just reading the right answer; and if a claim is
 about runtime behaviour, say how it was measured.
 
-> *Dev-fleet only: after editing, run `scripts/sync-skills.sh` so every runtime
+> *Dev-fleet only: after editing, regenerate the runtime plugin mirrors so every runtime
 > plugin picks it up.*

package/assets/skills/implementer-receiving-dispatch/SKILL.md

@@ -62,7 +62,7 @@ EOF
 ```
 
 If the coordinator asks you to file the bead, write the description to a scratch
-file and pass `--body-file <file>` to `scripts/bd-shared` (and
+file and pass `--body-file <file>` to the project's shared `bd` wrapper (and
 `comments add <id> -f <file>` for comments).
 
 Then continue with the assigned work. Do not implement the refactoring.

package/assets/skills/orchestrate/SKILL.md

@@ -778,7 +778,7 @@ and report a confident verdict about it.
 - **Require the reviewer to report back the SHA it actually scanned.** If the
   SHA it reports is not the SHA you pinned, the verdict is VOID — re-dispatch.
   Do not accept a verdict that cannot name its own base.
-- Cite `origin/<branch>` (e.g. `git show origin/thrum-agents:path/to/file.go`),
+- Cite `origin/<branch>` (e.g. `git show origin/<base>:path/to/file.go`),
   never a working copy, when reasoning about tip state. A stale local clone
   produces confident, wrong impeachments — and sub-agents reading that same
   stale clone will "corroborate" it. That is echo, not corroboration.

package/assets/skills/persistent-watcher-archetype/SKILL.md

@@ -26,12 +26,28 @@ every agent in your `roster`:
    unreachable) is escalated to your `parent` every cycle until a coordinator
    or human removes it from your roster — never dropped, never silently
    given up on (see Escalation).
-2. **Watch its context% and warn.** Read its ctx% from YOUR OWN tmux
-   capture of its status bar — **never from a figure it claims about
-   itself** (a message, a memory-footer line, anywhere). If it's getting
-   close to the end and hasn't restarted, warn it. This is the exact
-   mechanism — a watcher that trusts the target's self-report would catch
-   none of them.
+2. **Watch context, warn, and compact only when exhausted.** Read ctx% from
+   YOUR OWN tmux capture of its status bar — **never from a figure it claims
+   about itself** (a message, a memory-footer line, anywhere). Reuse your
+   configured `restart_ctx_pct` as the target warning threshold (default
+   50%); this does not change its separate use for your own self-restart.
+   At that threshold, warn the target if it has not restarted. Do not compact
+   at the threshold alone. Compact only when a fresh pane capture shows the
+   target is out of context AND two consecutive fresh checks show it at rest,
+   using the idle criteria in "Declared-intent reminders" below. Never
+   interrupt an active turn.
+
+   Get the target runtime from that member's `runtime` field in
+   `thrum team --json`; do not guess. Send its verified compact command (`/compact` for Claude,
+   Codex, and OpenCode; `/summarize` for Cursor; no command for runtimes
+   without a verified equivalent) with one `thrum tmux send <session>
+   "<command>"` call. That call settles and withholds Enter if a dialog
+   appears; never send a separate Enter. Exit 3 (Enter withheld) or 4
+   (verdict unknown) requires a fresh capture before any retry. If a
+   cross-peer send fails (for example, `can_send_keys` is unavailable),
+   escalate to your `parent` instead of retrying or switching transports.
+   Never resend while the command is queued or already visible in the pane.
+   After sending, report one line to your `parent`.
 3. **All of it is judgment.** Read pane, judge (unblock / warn-on-ctx /
    escalate), act or escalate. Every cycle, every roster member.
 4. **Catch declared-but-unexecuted intent.** If a roster member's last
@@ -60,7 +76,7 @@ every agent in your `roster`:
 
 ### Approving or dismissing a modal: keys only, never text
 
-> 🔴 **NEVER answer a modal with a text payload — not even a single
+> 🔴 **For modal handling, NEVER answer with a text payload — not even a single
 > character, and never a bare positional argument to `thrum tmux send`.**
 > Plain text TYPES INTO the agent's input box; it does not act as a
 > keypress. If the modal isn't actually showing, or focus differs from what
@@ -438,7 +454,7 @@ problem rather than a clean tick.
 
 ## Relationship to the deterministic context-monitoring sweep
 
-You are NOT a replacement for `scripts/error-and-context-agent-sweep.sh`
+You are NOT a replacement for the fleet's deterministic context-monitoring sweep
 (the `context-monitoring` `thrum monitor` job, `@every 30m`,
 self-gated to ~30-60min effective) — the two COEXIST. The sweep stays the fleet-wide, always-on,
 zero-incremental-cost tripwire covering every agent, including ones with no

package/assets/skills/persistent-watcher-archetype/resources/roster-watch.sh

@@ -59,7 +59,7 @@
 # worktree-local copy) the moment this script or its cwd ever moves to a
 # feature worktree. `resolve_watch_params()` below replaces that implicit
 # assumption with the same explicit `.thrum/redirect`-following idiom
-# already used by `scripts/heartbeat-lib.sh:225-232` and
+# already used by the heartbeat library and
 # the check-inbox hook script.
 #
 # PORTABILITY FIX: both source scripts also hardcoded a single operator's
@@ -104,8 +104,8 @@ set -uo pipefail
 # both of which were independently reimplementing this same body).
 # ---------------------------------------------------------------------------
 # Args: worktree_root. Prints the redirect-resolved absolute .thrum/ dir.
-# Matches the idiom already used by scripts/heartbeat-lib.sh's
-# hb_sessions_dir() and the check-inbox hook script's SPOOL_THRUM
+# Matches the idiom already used by the heartbeat library's
+# session-dir helper and the check-inbox hook script's SPOOL_THRUM
 # resolution: no redirect file present (main repo) -> use the local .thrum/
 # as-is; redirect file present (feature worktree) -> follow it to the main
 # repo's .thrum/.

package/assets/skills/project-setup/SKILL.md

@@ -241,7 +241,7 @@ configuration from day one.
 ## Inputs
 
 Primary input: **plan file path** (output of writing-plans, e.g.
-`dev-docs/plans/2026-02-21-feature-plan.md`). The plan references the design doc
+`dev-docs/plans/YYYY-MM-DD-feature-plan.md`). The plan references the design doc
 — both are read in Phase 1.
 
 Also needed from CLAUDE.md or conversation context:
@@ -476,7 +476,7 @@ template's "Logging Refactoring Opportunities" section.
 If not found, create one:
 
 `--description` is multi-line prose — never double-quoted inline. Use
-`--body-file` to pass the content from a file instead; see the heredoc-or-file rule in your role preamble. `scripts/bd-shared` delivers `--body-file` (and
+`--body-file` to pass the content from a file instead; see the heredoc-or-file rule in your role preamble. The project's shared `bd` wrapper delivers `--body-file` (and
 `--stdin`) content: it reads the file on your box and pipes those bytes to bd,
 and an empty or blank body is refused loudly; only `-f`/`--file` and `--graph`
 (bulk-plan files) are refused there. Scratch files go in `/private/tmp` on macOS,
@@ -641,8 +641,8 @@ cat .thrum/redirect    # should point to <project-root>/.thrum
 cat .beads/redirect    # should point to <project-root>/.beads
 
 # If redirects are missing or wrong, fix them:
-# (from project root)
-./scripts/setup-worktree-thrum.sh <worktree-path>
+# (from the worktree; non-destructive and idempotent)
+thrum worktree adopt
 
 # Verify beads sees shared database
 bd where    # Should show <project-root>/.beads
@@ -673,14 +673,9 @@ thrum worktree create <worktree-name> --branch <branch-name> \
 thrum worktree setup <worktree-name> --branch <branch-name> \
   --name <agent-name> --role implementer
 
-# Alternative: shell script (does the same thing; the SCRIPT keeps its own
-# <worktree-path> <branch> --identity interface — distinct from the CLI above)
-./scripts/setup-worktree-thrum.sh \
-  <worktree-path> <branch-name> \
-  --identity <agent-name> --role implementer
 ```
 
-All three handle: branch creation, worktree creation, thrum redirect, beads
+Both handle: branch creation, worktree creation, thrum redirect, beads
 redirect, and `thrum quickstart` registration.
 
 #### For current worktree (small fixes)
@@ -894,8 +889,8 @@ Worktree ready at `{{WORKTREE_PATH}}` on branch `{{BRANCH_NAME}}`. Agent
 
 <!-- If worktree needs to be created by the implementation agent: -->
 
-./scripts/setup-worktree-thrum.sh {{WORKTREE_PATH}} {{BRANCH_NAME}} \
- --identity {{AGENT_NAME}} --role implementer
+thrum worktree create <worktree-name> --branch {{BRANCH_NAME}} \
+ --name {{AGENT_NAME}} --role implementer
 
 ---
 

package/assets/skills/project-setup/resources/implementation-agent.md

@@ -438,7 +438,7 @@ bd list --type=epic | grep -i refactor
 If no refactoring epic exists, create one:
 
 `--description` is multi-line prose — never double-quoted inline. Write it to a
-scratch file and pass `--body-file <file>`; see the heredoc-or-file rule in your role preamble. `scripts/bd-shared` delivers `--body-file` (and `--stdin`)
+scratch file and pass `--body-file <file>`; see the heredoc-or-file rule in your role preamble. The project's shared `bd` wrapper delivers `--body-file` (and `--stdin`)
 content: it reads the file on YOUR box and pipes those bytes to bd, and an empty
 or blank body is refused loudly. Only `-f`/`--file` and `--graph` (bulk-plan
 files) are refused there. Scratch files go in `/private/tmp` on macOS, where
@@ -563,7 +563,7 @@ EOF
 # NOTE: delivers only to agent(s) matching @implementer — see the mention-delivery
 # note under "Handling Blockers" above for the full rule.
 thrum send --mention @implementer --stdin <<'EOF'
-Heads up: I'm modifying internal/daemon/rpc.go which may overlap with your work
+Heads up: I'm modifying <shared-file> which may overlap with your work
 EOF
 
 # Update your intent when switching tasks

package/assets/skills/researcher-maintaining-memory/SKILL.md

@@ -52,7 +52,7 @@ findings yet. Each line ≤120 chars; cite a file area or epic if relevant.
 Example:
 
 ```text
-- Is the embedding adapter wired post-<epic>? (check internal/memory/embed/adapter_ollama.go)
+- Is the embedding adapter wired post-<epic>? (check the embedding adapter source)
 - thrum-abc monitor reliability follow-up still has 4 child bugs open
 - Open: does --scope role on memory.create auto-infer the role, or does it require explicit value?
 ```

package/assets/skills/thrum/resources/CLI_REFERENCE.md

@@ -1051,7 +1051,7 @@ thrum memory migrate-from-bd --rollback --confirm-rollback "DELETE 53"
 
 # Explicit manifest, hard purge:
 thrum memory migrate-from-bd --rollback \
-  --manifest dev-docs/migrations/2026-05-26T1500Z-bd-to-thrum-migration-manifest.json \
+  --manifest <migration-manifest.json> \
   --hard --confirm-rollback "DELETE 53"
 ```
 

package/assets/skills/thrum/resources/LISTENER_PATTERN.md

@@ -25,7 +25,7 @@ prevents duplicate listeners — spawning when one is already running is safe.
 Task(
   subagent_type="message-listener",
   model="<per choosing-subagent-models>",  # cheapest tier
-  prompt="Listen for Thrum messages.\nSTEP_1: /path/to/repo/scripts/thrum-startup.sh --listener-heartbeat\nSTEP_2: thrum wait --timeout 8m --after -15s --agent-name <agent_id>"
+  prompt="Listen for Thrum messages.\nSTEP_1: thrum-startup --listener-heartbeat\nSTEP_2: thrum wait --timeout 8m --after -15s --agent-name <agent_id>"
 )
 ```
 
@@ -59,7 +59,7 @@ Automatically respawn the listener if it dies or is lost after compaction.
 ```text
 CronCreate(
   cron="*/30 * * * *",
-  prompt="Check the listener PID file at .thrum/var/<agent_id>-listener.pid.\nIf the file does not exist, or if kill -0 <pid> fails (process not running),\nspawn a new listener:\n\nAgent(subagent_type=\"message-listener\", model=\"<per choosing-subagent-models>\", prompt=\"Listen for Thrum messages.\\nSTEP_1: /path/to/repo/scripts/thrum-startup.sh --listener-heartbeat\\nSTEP_2: thrum wait --timeout 8m --after -15s --agent-name <agent_id>\")"
+  prompt="Check the listener PID file at .thrum/var/<agent_id>-listener.pid.\nIf the file does not exist, or if kill -0 <pid> fails (process not running),\nspawn a new listener:\n\nAgent(subagent_type=\"message-listener\", model=\"<per choosing-subagent-models>\", prompt=\"Listen for Thrum messages.\\nSTEP_1: thrum-startup --listener-heartbeat\\nSTEP_2: thrum wait --timeout 8m --after -15s --agent-name <agent_id>\")"
 )
 ```