opencode-thrum-pro 0.1.6 → 0.1.7

package/assets/skills/coordinator-branch-split-on-block/SKILL.md

@@ -159,8 +159,7 @@ asserted after the fact).
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session about branch-splitting, capture it
 via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-dispatching-work/SKILL.md

@@ -307,14 +307,13 @@ EOF
 ### Step 3: Your role during execution
 
 - You receive the orchestrator's merge report when all epics complete.
-- Run your merge-approval gate (see Merge Approval Gate in your preamble).
+- Run your merge-approval gate (see the merge approval rules in your preamble).
 - Monitor the orchestrator's status updates; escalate to the operator only for
   genuine judgment calls (architectural pivot, scope change, budget concern).
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-hotpath-merge-gate/SKILL.md

@@ -129,6 +129,8 @@ rediscovering these the hard way:
    `go run ./cmd/testgate classify-timeout --log <file> --shard-config <file>
    --shard <name>` (fails closed — only BOUND-TIMEOUT exits 0; HANG and
    UNCLASSIFIED both exit nonzero) before reporting it as a regression.
+   If a gate's own command line invokes the bare package path for RPC, that is a gate defect, not a passing lane.
+   A HANG or UNCLASSIFIED verdict from `classify-timeout` requires human review.
 8. Build+test the MERGED-tree result as a SEPARATE condition — neither gate
    currently runs a build of the actual post-merge tree; a clean pre-merge
    build/test does not prove the merged result compiles or passes.
@@ -159,7 +161,7 @@ rediscovering these the hard way:
     abandoned worktree pins its HEAD commit against `gc` and adds a
     `.git/worktrees` admin entry, so the object store grows monotonically.
     Before removing:
-    (a) `git -C <wt> status --porcelain` — if NON-EMPTY, **STOP and report it
+    (a) `git -C <wt> status --porcelain --untracked-files=all --ignored -- .thrum` — if NON-EMPTY, **STOP and report it
         instead of removing.** Uncommitted work in a throwaway worktree exists
         NOWHERE else; this is the category that actually loses work.
     (b) `git branch -a --contains $(git -C <wt> rev-parse HEAD)` — if EMPTY,

package/assets/skills/coordinator-interacting-with-the-owner/SKILL.md

@@ -162,8 +162,7 @@ bd update thrum-abc --notes "$notes"
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it
 via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-maintaining-memory/SKILL.md

@@ -40,7 +40,7 @@ thrum memory create --kind agent_rule --scope role \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see your role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 Body shape uniform across all role-rule writes — see `memory-write-discipline`.
 

package/assets/skills/coordinator-managing-state-and-lifecycle/SKILL.md

@@ -184,8 +184,7 @@ orchestrators to for the implementers **they** launched.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-merging-code/SKILL.md

@@ -169,13 +169,18 @@ The §3 lens gates (hotpath + philosophy) are the judgement half. The per-merge
 executed half is **scoped to the change**:
 
 - Build the merged tree (`go build ./...`).
-- Full-*package* `-race` on the **changed packages only** — full-package, never
-  targeted `-run` (a targeted run misses cross-test races), but only what the diff
-  touches.
+- 🔴 **RULING 2026-09-29:** the full sharded race suite —
+  `scripts/test-run.sh race all` (~15-20 min) — on the **merged tree**, every
+  Pass-3 verdict. This replaces the prior "changed packages only (+ rpc shard
+  sweep)" race scoping below the ruling; a targeted `-run` is still never
+  acceptable (a targeted run misses cross-test races). Never on primary (the
+  shared fleet build box) — it is CPU-heavy; run it on the gate box.
 - The fast structural checks on the merged tree — `gate-ban-check`,
   `gate-omitempty-check`, `gate-lockspan-check`, `gate-marker-diff`,
-  `gate-stamp-protocol-check` (seconds each; they catch banned flags, `omitempty`
-  drift, lock-span, marker and stamp drift regardless of the change).
+  `gate-stamp-protocol-check`, `gate-plugin-bundle-leaks` (seconds each; they
+  catch banned flags, `omitempty` drift, lock-span, marker and stamp drift
+  regardless of the change; `gate-plugin-bundle-leaks` self-skips when no plugin
+  path changed).
 - The `merge-base --is-ancestor` fast-forward check (§6).
 - Any `*_tripwire_test.go` the change touches must stay green or the diff must
   state why its premise changed; a tripwire edited to accommodate the change is a
@@ -211,9 +216,10 @@ executed half is **scoped to the change**:
   MERGED tree every merge: `go test ./internal/testgate/... -run
   TestNoMainStateDBWriteOwnerBypasses`.
 
-**Establish branch-attributable vs pre-existing from the changed-package `-race`
-result** — a regression adds failures the same packages did not have before. Do
-not classify a scoped change by replaying the whole known-red suite.
+**Establish branch-attributable vs pre-existing from the full-race `-race`
+result** — a regression adds failures the packages touched by the diff did not
+have before. Do not classify a scoped change by replaying the whole known-red
+suite.
 
 🔴 **Do NOT run the full all-lanes `make gate` for a merge.** The full suite —
 every package across lanes A/B/C/D, the integration lane, `gate-ci-mutation-check`,
@@ -221,7 +227,9 @@ the UI lane, the full tripwire/boxstate reconciliation — is the **periodic
 full-gate cadence**, an agent run on the dedicated isolation box, and it is its own
 skill: **`coordinator-full-gate`**. A merge never triggers it, and its merge-base
 replay is not a per-merge step. Running it per merge is ~2h that on a common-mode-
-red trunk fails on the baseline every time.
+red trunk fails on the baseline every time. The RULING 2026-09-29 above
+widens only the **race lane** to full-sharded per merge — it does not pull the
+other lanes (integration, UI, mutation-check) into the per-merge path.
 
 🔴 **Never kill a test run to stop a collision.** Killing skips Go's cleanup, which
 leaks fixed-name tmux fixtures onto the shared socket and breaks that suite box-
@@ -361,8 +369,7 @@ hides staleness.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-philosophy-merge-gate/SKILL.md

@@ -459,8 +459,7 @@ diff — don't bounce reflexively.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-plan-reconcile-gate/SKILL.md

@@ -189,8 +189,7 @@ unambiguously so an implementer doesn't re-litigate them.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session about multi-plan reconciliation,
 capture it via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-running-brainstorm-cycles/SKILL.md

@@ -113,7 +113,7 @@ forwarding.
 
 5. **Authored-against stamp (required, top of every artifact):** Before writing
    a brainstorm.md or plan.md, derive and emit the stamp per
-   `claude-plugin/commands/_stamp-protocol.md` § "Stamp format" — the canonical
+   the /thrum:stamp-protocol skill § "Stamp format" — the canonical
    format, derivation commands, and never-type rule.
 
 ### Soft pre-flight greps (the SOFT enforcement tier)
@@ -477,7 +477,7 @@ contract-drift and quality issues a single author would miss.
 
 1. Researcher writes plan v1 directly.
 2. Researcher authors the `## Deviations from Source` block per
-   `claude-plugin/commands/_deviations-protocol.md`, diffing plan v1 against
+   the /thrum:deviations-protocol skill, diffing plan v1 against
    the brainstorm + design spec — BEFORE dual-review, so
    `verify-against-source` validates it as part of conformance. Required even
    when empty ("No deviations from source.").
@@ -504,7 +504,7 @@ contract-drift and quality issues a single author would miss.
    coordinator instead of being folded inline.
 6. Researcher repeats only if cycle-1 introduces new design surface (rare for
    bounded mechanical plans); otherwise v2 LOCKED. Before stamping, compute
-   `plan_obj`/`src_lock` per `_stamp-protocol.md` § "Review-object binding"
+   `plan_obj`/`src_lock` per `stamp-protocol.md` § "Review-object binding"
    (strip-then-hash the plan against itself for `plan_obj`; plain-hash the
    LOCKED source for `src_lock`), then stamp
    `<!-- THRUM-REVIEW: stage=plan verdict=Ready:Yes cycle=<N> date=<YYYY-MM-DD> verify=Ready:Yes plan_obj=<blob> src_lock=<blob> -->`.
@@ -636,8 +636,7 @@ don't rebind the agent name to a different topic in place.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session about brainstorm orchestration, capture
 it via the `coordinator-maintaining-memory` skill — it references the

package/assets/skills/coordinator-running-review-cycles/SKILL.md

@@ -156,8 +156,7 @@ AFTER they report DONE. They target different artifacts and both are needed.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `coordinator-maintaining-memory` skill — it references the

package/assets/{commands/thrum-_deviations-protocol.md → skills/deviations-protocol/SKILL.md}

@@ -1,19 +1,13 @@
 ---
-description:
-  Shared Deviations-from-Source protocol — canonical block format, the
-  required-even-when-empty rule, and derivation discipline. Not
-  user-invocable directly.
+name: deviations-protocol
+description: "Use when authoring a plan or implementation prompt - Deviations-from-Source block format, required even when empty."
 ---
 
-# Deviations from Source Protocol (shared partial)
 
+# Deviations from Source Protocol
 This file is the canonical source-of-truth for the "Deviations from Source"
-block emitted by planning-loop artifacts (plans, implementation prompts). Do
-NOT invoke this file directly; it has no terminal action.
-
-(To find what currently points here: `grep -rn "_deviations-protocol.md"
-claude-plugin/` — a hand-listed consumer roster in this file would rot the
-moment a new emitter or reader is added, so none is kept here.)
+block emitted by planning-loop artifacts (plans, implementation prompts).
+Invoke this skill to author the block, even when empty.
 
 ## Purpose
 
@@ -33,7 +27,7 @@ FAILS the gate, whether or not it actually dropped anything.
 ## Format (emitted artifact — verbatim)
 
 Every plan and implementation prompt carries this heading, placed immediately
-after its Authored-against stamp block (see `_stamp-protocol.md`):
+after its Authored-against stamp block (see `stamp-protocol.md`):
 
 ```
 ## Deviations from Source

package/assets/skills/generator-idempotency-protocol/SKILL.md

@@ -0,0 +1,9 @@
+---
+name: generator-idempotency-protocol
+description: "Use when generating config or docs from templates - idempotency invariant for generator skills."
+---
+
+
+# Generator Idempotency Protocol
+The modes are idempotent — running the skill repeatedly on a stable project
+should produce no file changes after the first run.

package/assets/skills/implementer-maintaining-memory/SKILL.md

@@ -40,7 +40,7 @@ thrum memory create --kind agent_rule --scope role \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see your role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 Body shape is uniform across all role-rule writes — see
 `memory-write-discipline`. The `Why:` line is load-bearing: future-you needs the
@@ -48,9 +48,8 @@ reason to judge edge cases the rule doesn't literally cover.
 
 ## Implementer does NOT write
 
-- **Refactoring opportunities discovered mid-task** → file under the project's
-  refactoring epic, e.g. `<refactor-epic-id>`, NOT memory. Memory is for AGENT
-  BEHAVIOR rules; bd tracks code work.
+- **Refactoring opportunities discovered mid-task** → report them to the
+  coordinator, NOT memory and not bd. Memory is for AGENT BEHAVIOR rules.
 - **Research findings about the codebase** → ping the researcher; they own
   `kind: research_note` writes.
 - **Per-task notes / scratch state** → use the conversation context or task

package/assets/skills/implementer-orchestrating-execution/SKILL.md

@@ -114,8 +114,7 @@ prefix, blinding the evaluation harness.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 Capture new rules mid-session via the `implementer-maintaining-memory` skill —
 it references the `memory-write-discipline` common for the canonical

package/assets/skills/implementer-receiving-dispatch/SKILL.md

@@ -38,7 +38,7 @@ config loading, string sanitization, validation), run a targeted grep.
 something similar exists, use it. If it needs extension, extend it. Only create
 a new function when nothing exists.
 
-## Don't refactor for free — log opportunities, don't implement them
+## Don't refactor for free — report opportunities, don't implement them
 
 **Why:** A bug fix doesn't need surrounding cleanup. A one-shot operation
 doesn't need a helper. Inlining "improvements" into a scoped task expands the
@@ -46,26 +46,25 @@ diff, complicates review, and risks introducing bugs unrelated to the work.
 Three similar lines is better than a premature abstraction.
 
 **How to apply:** When you spot duplicated patterns, hardcoded values that
-should be shared, or missed abstractions during implementation, log them to the
-project's refactor backlog (a beads epic, e.g. `<refactor-epic-id>`):
+should be shared, or missed abstractions during implementation, report them to
+the coordinator; do not file a bd issue yourself.
 
-`--description` is multi-line prose — never double-quoted inline. On
-`scripts/bd-shared`, `--stdin`/`--body-file` are refused (remote-path
-resolution + silent-empty-body hazards), so write it to a scratch file and
-pass `-d "$(cat <file>)"`; see your role preamble's 🔴 PROSE INTO A COMMAND
-rule.
+The report body is multi-line prose — never double-quoted inline; see the
+heredoc-or-file rule in your role preamble.
 
 ```bash
-cat > /tmp/refactor-task-desc.md <<'EOF'
-**Discovered during:** <task-id>
-**Files:** <paths>
-**Opportunity:** <what could be improved>
-**Effort:** small/medium/large
+thrum send --to @<coordinator> --stdin <<'EOF'
+Refactoring opportunity (discovered during <task-id>)
+Files: <paths>
+Opportunity: <what could be improved>
+Effort: small/medium/large
 EOF
-bd create --title="Refactor: <short description>" --type=task \
-  --parent=<refactor-epic-id> --priority=3 -d "$(cat /tmp/refactor-task-desc.md)"
 ```
 
+If the coordinator asks you to file the bead, write the description to a scratch
+file and pass `--body-file <file>` to `scripts/bd-shared` (and
+`comments add <id> -f <file>` for comments).
+
 Then continue with the assigned work. Do not implement the refactoring.
 
 ## Flag scope deviations immediately — not in the final report
@@ -96,8 +95,7 @@ related files.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/implementer-receiving-review-feedback/SKILL.md

@@ -71,8 +71,8 @@ trade-off explicitly:
 - Is the fix a few lines? Default to fix-now
 - Does verification require running the same tests as the main fix? Default to
   fix-now
-- Is the fix a meaningful refactor or design change? Defer is legitimate; file
-  the bd issue and link it in the commit message
+- Is the fix a meaningful refactor or design change? Defer is legitimate; report
+  it to the coordinator (not a bd issue) and cite the report in the commit message
 
 Don't reach for "deferred" as a shortcut to ship faster.
 
@@ -117,8 +117,7 @@ list, file them as bd issues — don't slip them into the fix commit.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/implementer-status-and-handoff/SKILL.md

@@ -107,22 +107,9 @@ make test PASS (race), make lint PASS.
 
 For first-pass DONE (not review-fix), cite the closing SHA and the test result.
 
-## Close beads tasks with `--suggest-next` when relevant
-
-**Why:** `bd close <id>` works fine, but `bd close <id> --suggest-next` prints
-newly-unblocked downstream issues immediately. If you're in the middle of an
-epic, the next task is often the most useful next move; the flag saves a
-`bd ready` round-trip.
-
-**How to apply:** When closing a task that has dependents, use
-`bd close <id> --suggest-next`. For the last task in an epic where you're
-stopping at a review gate, plain `bd close` is fine — you're not picking up the
-next task anyway.
-
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/implementer-tdd-and-quality/SKILL.md

@@ -86,13 +86,13 @@ that would otherwise come back as findings.
    package searched -> primitive adopted, or none exists + bounded cost formula
    (frequency x production cardinality, at production scale). Include it in
    your DONE report.
+   - Before writing a raw read-in-loop, `db.Query`-in-loop, `COUNT(DISTINCT ...)`, or a second transaction or pool acquisition per logical unit under a hot root, search the callee package for an existing targeted, cached, covering or batch primitive.
 
 Fix what you find before sending the ping.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `implementer-maintaining-memory` skill — it references the

package/assets/skills/memory-curate/SKILL.md

@@ -108,7 +108,7 @@ thrum memory create --kind comment \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see your role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 `--parent` shorthand creates the `child_of` edge in the same operation. Author =
 `agent_id`, timestamp = `created_at`. Threading walks via the daemon's

package/assets/skills/memory-write-discipline/SKILL.md

@@ -25,7 +25,7 @@ thrum memory create --kind <K> --scope <S> \
 ```
 
 `--short`/`--full` carry real prose — compose via heredoc or file, never
-double-quoted inline; see the role preamble's 🔴 PROSE INTO A COMMAND rule.
+double-quoted inline; see the heredoc-or-file rule in your role preamble.
 
 Three flags are **REQUIRED** (schema NOT NULL): `--kind`, `--title`,
 `--oneline`. The daemon rejects any `memory.create` call missing these.

package/assets/skills/orchestrate/SKILL.md

@@ -189,8 +189,10 @@ thrum worktree create <name>
 thrum tmux create <name> --cwd <worktree-path> \
   --name <agent_name> --role implementer --module <module> \
   --mode ephemeral --identity ephemeral \
-  --model <from runtime.role_models, per choosing-subagent-models>
-thrum tmux launch <name> --runtime <runtime> --model <from runtime.role_models, per choosing-subagent-models>
+  --model <from runtime.role_models, per choosing-subagent-models> \
+  --effort <from runtime.role_models, per choosing-subagent-models>
+thrum tmux launch <name> --runtime <runtime> --model <from runtime.role_models, per choosing-subagent-models> \
+  --effort <from runtime.role_models, per choosing-subagent-models>
 ```
 
 > **Implementer lifecycle:** All implementers are ephemeral+stateless (no agent
@@ -233,7 +235,7 @@ That prints the runtime's own footer line, e.g. `Model: <resolved model>`. **Rea
 intended tier from `.thrum/config.json` → `runtime.role_models`, not from memory.**
 If the footer shows a different tier (see the BLOCKED note under Step 2 — the model ban
 list lives in `choosing-subagent-models`), the pin failed silently — re-pin with
-`thrum tmux create ... --model <from runtime.role_models, per choosing-subagent-models>` (or
+`thrum tmux create ... --model <from runtime.role_models, per choosing-subagent-models> --effort <from runtime.role_models, per choosing-subagent-models>` (or
 `thrum agent runtime-config set <agent_name> --model <from runtime.role_models, per choosing-subagent-models>`) and relaunch BEFORE
 assigning work. **Do not dispatch an unpinned implementer** — the daemon's
 role-default backstop (`jq -r '.runtime.role_models' .thrum/config.json`) is a
@@ -504,7 +506,7 @@ done
 
 **C. If conflicts arise:**
 Reading the conflicted files directly is permitted (merge-conflict carve-out
-in Scope Boundaries). Analyze the conflict using your plan/intent context to
+in the Scope section of your preamble). Analyze the conflict using your plan/intent context to
 determine the correct resolution. Then spawn a targeted edit sub-agent:
 
 ```text
@@ -805,3 +807,30 @@ EOF
 ```
 
 Do not proceed without approval when autonomy is `per_epic`.
+
+### Tier-swap: replace an underperforming implementer in the same worktree
+
+Use when the first review shows multiple BLOCKING findings, systematic misunderstanding of the task, or an agent clearly going long. The swap reuses the SAME worktree: retire the underperforming agent and relaunch a fresh one under a NEW name in place. Never `thrum agent delete` (operator-only, gated to the coordinator; orchestrators are refused). The swapped-out agent is retired with `set-phase retired`; its registry row, messages and transcript are retained.
+
+Step 1: kill the old agent's tmux session first, so its pid is dead. A live-pid identity file is preserved and not quarantined; a dead pid lets the new create quarantine it.
+  thrum tmux kill <same_worktree_name>
+Step 2: retire the old agent. It keeps the registry row (Retired tab). `set-phase` is not operator-gated. Retiring does not free the identity; Step 4's create does.
+  thrum agent set-phase retired --agent <underperforming_agent_name>
+Step 3: verify the worktree is intact (WIP code preserved).
+  ls <worktree-path>
+Step 4: launch a fresh ephemeral identity under a NEW name in the SAME worktree, pinned on both create and launch from `runtime.role_models` (per `choosing-subagent-models`). `--intent` carries the orient-from-WIP one-liner.
+  thrum tmux create <same_worktree_name> --cwd <worktree-path> --name <new_agent_name> --role implementer --module <module> --mode ephemeral --identity ephemeral --model <per runtime.role_models> --effort <per runtime.role_models> --intent "tier-swap: orient in the worktree (WIP + first-review findings) and continue"
+  thrum tmux launch <same_worktree_name> --runtime claude --model <per runtime.role_models> --effort <per runtime.role_models>
+Step 5: deliver the WIP pointer and first-review findings (a cold handoff: the code plus the findings).
+  thrum send --to @<new_agent_name> --stdin <<'EOF'
+  Tier-swap pickup: <WIP summary + first-review findings>
+  EOF
+
+The pickup prompt (Step 5) must include:
+  You are picking up in-progress work from a prior agent that was replaced.
+  Context:
+  - Worktree: <path> — contains partial implementation, review it with git diff
+  - Task: <epic-id> / <task description>
+  - First-review findings from the prior pass:
+    <paste the consolidated finding list here>
+  - Your goal: address all BLOCKING findings + complete the remaining task scope.

package/assets/skills/prime-agent/SKILL.md

@@ -88,7 +88,7 @@ context on a healthy daemon — no turn spent reading a file or running a skill.
 This skill is the correct choice here only as a **fallback**, when that
 auto-injection didn't fire or failed (e.g. the hook's "auto-injection failed"
 notice, daemon unreachable). In that fallback case: read the snapshot first,
-then run this skill. See `claude-plugin/commands/compact.md`'s "How resume
+then run this skill. See `/thrum:compact`'s "How resume
 works" section.
 
 ## After Step 2

package/assets/skills/project-hotpath-gate/SKILL.md

@@ -23,8 +23,7 @@ later ones.
 3. **Re-run-evolved** (config present, project has drifted) — compute a
    sectional diff, present for approval, write only on confirmation.
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_generator-idempotency-protocol.md`
+Load the /thrum:generator-idempotency-protocol skill and follow it.
 
 > **Note: human-in-the-loop required.** This skill uses interactive prompts for
 > first-run incident-prose seeding and re-run-evolved diff approval. It cannot

package/assets/skills/project-philosophy/SKILL.md

@@ -29,8 +29,7 @@ later ones.
 3. **Re-run-evolved** (doc present, project has drifted) — compute a sectional
    diff, present via `AskUserQuestion`, write only on confirmation.
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_generator-idempotency-protocol.md`
+Load the /thrum:generator-idempotency-protocol skill and follow it.
 
 > **Note: human-in-the-loop required.** This skill uses `AskUserQuestion` for
 > first-run project-specific prompts, re-run-evolved diff approval, and

package/assets/skills/project-rules-protocol/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: project-rules-protocol
+description: "Use when loading project-specific rules - shared rule skill for role skills."
+---
+
+
+# Project-Specific Rules Protocol
+Project-local rules of kind `agent_rule` at `--scope role` were loaded at
+session start by your preamble (see the memory rules in your role preamble).
+If a project-local rule conflicts with a universal rule above, the
+project-local rule wins; surface the conflict in your reply so the user can
+decide whether to graduate or remove the override.

package/assets/skills/project-setup/SKILL.md

@@ -50,7 +50,7 @@ describes the artifact in front of you. Parse the binding keys from the
 **highest-cycle** (last-appended) `stage=plan` line — stamps are only ever
 appended, never reordered, so `tail -1` is the binding verdict; never `sort`
 (a `cycle=10` line must beat `cycle=9`, which a lexical sort inverts) — then
-re-derive the current values per `_stamp-protocol.md` § "Review-object
+re-derive the current values per `stamp-protocol.md` § "Review-object
 binding" and compare:
 
 ```bash
@@ -95,7 +95,7 @@ Notes on the check:
   marker. Surface any `THRUM-DEFER` lines still present in the doc as part
   of the override audit.
 - **The Deviations block has no override.** Its absence always fails the
-  gate — see `claude-plugin/commands/_deviations-protocol.md` ("empty must
+  gate — see the /thrum:deviations-protocol skill ("empty must
   be WRITTEN, not omitted").
 - **`verify=` has no silent-omission path.** A stamp missing `verify=`
   entirely FAILS this third check exactly like a missing stamp fails the
@@ -117,7 +117,7 @@ Notes on the check:
   silent-omission path** — a stamp missing `plan_obj`/`src_lock` entirely
   fails exactly like a missing `verify=` field (fourth check above). The
   remedy is the same shape as the `verify=` remedy: re-run the plan review so
-  the stamp is emitted with live binding keys (`_stamp-protocol.md` § "Review-
+  the stamp is emitted with live binding keys (`stamp-protocol.md` § "Review-
   object binding"), or a coordinator adds an explicit `verdict=OVERRIDE`
   (with `reason=`) to the `stage=plan` line — the SAME auditable escape used
   for the first check, not a new mechanism. There is no `PREDATES` value for
@@ -476,8 +476,7 @@ template's "Logging Refactoring Opportunities" section.
 If not found, create one:
 
 `--description` is multi-line prose — never double-quoted inline. Use
-`--body-file` to pass the content from a file instead; see the role preamble's
-🔴 PROSE INTO A COMMAND rule. `scripts/bd-shared` delivers `--body-file` (and
+`--body-file` to pass the content from a file instead; see the heredoc-or-file rule in your role preamble. `scripts/bd-shared` delivers `--body-file` (and
 `--stdin`) content: it reads the file on your box and pipes those bytes to bd,
 and an empty or blank body is refused loudly; only `-f`/`--file` and `--graph`
 (bulk-plan files) are refused there. Scratch files go in `/private/tmp` on macOS,
@@ -870,11 +869,11 @@ architecture notes specific to this feature:
 
 > ⚠️ Verify base before acting: `git diff <sha>..origin/<merge_target> -- <files cited>` -- non-empty ⇒ cited code moved. (Resolve `<merge_target>` through its remote-tracking ref, never a bare local branch name — a local branch of the same name can be stale or absent.)
 
-<!-- Derive stamp per `claude-plugin/commands/_stamp-protocol.md`. -->
+<!-- Derive stamp per the /thrum:stamp-protocol skill. -->
 
 ## Deviations from Source
 
-<!-- Derive per `claude-plugin/commands/_deviations-protocol.md` — diff
+<!-- Derive per the /thrum:deviations-protocol skill — diff
      against the plan/spec, never recall from memory. Required even when
      empty. -->
 
@@ -959,7 +958,7 @@ prompt file:
    ```
 
 2. **After the post-setup prompt review terminates `Ready:Yes`**, compute
-   `prompt_obj`/`plan_lock` per `_stamp-protocol.md` § "Review-object binding"
+   `prompt_obj`/`plan_lock` per `stamp-protocol.md` § "Review-object binding"
    (strip-then-hash the prompt against itself for `prompt_obj`; plain-hash the
    LOCKED plan for `plan_lock`), then append the verdict stamp:
 

package/assets/skills/project-setup/resources/implementation-agent.md

@@ -439,8 +439,7 @@ bd list --type=epic | grep -i refactor
 If no refactoring epic exists, create one:
 
 `--description` is multi-line prose — never double-quoted inline. Write it to a
-scratch file and pass `--body-file <file>`; see your role preamble's 🔴 PROSE
-INTO A COMMAND rule. `scripts/bd-shared` delivers `--body-file` (and `--stdin`)
+scratch file and pass `--body-file <file>`; see the heredoc-or-file rule in your role preamble. `scripts/bd-shared` delivers `--body-file` (and `--stdin`)
 content: it reads the file on YOUR box and pipes those bytes to bd, and an empty
 or blank body is refused loudly. Only `-f`/`--file` and `--graph` (bulk-plan
 files) are refused there. Scratch files go in `/private/tmp` on macOS, where

package/assets/skills/researcher-answering-queries/SKILL.md

@@ -75,8 +75,7 @@ where inlining is genuinely cheaper than the round-trip.
 
 ## Project-specific rules (already loaded)
 
-Read the shared partial at the absolute path:
-`claude-plugin/commands/_project-rules-protocol.md`
+Load the /thrum:project-rules-protocol skill and follow it.
 
 If you accumulate a new rule mid-session (the user corrects you), capture it via
 the `researcher-maintaining-memory` skill — it references the