plumbbob 0.5.4 → 0.6.1

package/node_modules/checkride/templates/hybrid/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "./tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./dist"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["dist", "node_modules"],
+  "references": [
+    { "path": "./packages/core" }
+  ]
+}

package/node_modules/checkride/templates/monorepo/fallow.toml

@@ -0,0 +1,44 @@
+# Fallow: dead code, circular deps, duplication, complexity, architecture boundaries.
+# Docs: https://docs.fallow.tools
+
+entry = [
+  "apps/*/src/index.ts",
+  "libs/*/src/index.ts",
+  "apps/*/src/**/*.test.ts",
+  "libs/*/src/**/*.test.ts",
+  "apps/*/test/**/*.test.ts",
+  "libs/*/test/**/*.test.ts",
+  "test/**/*.test.ts",
+]
+
+# CLI/tooling deps used via command line or config files, not imported from source.
+ignoreDependencies = ["@ast-grep/cli"]
+
+[rules]
+unused-exports = "error"
+unused-files = "error"
+unused-dependencies = "error"
+circular-dependencies = "error"
+boundary-violation = "error"
+
+[duplicates]
+mode = "mild"
+minTokens = 50
+
+[health]
+maxCyclomatic = 15
+maxCognitive = 15
+
+# Architecture boundaries: libs are reusable internals; apps are deployable
+# leaves. libs may not import from apps.
+[[boundaries.zones]]
+name = "apps"
+patterns = ["apps/*/src/**"]
+
+[[boundaries.zones]]
+name = "libs"
+patterns = ["libs/*/src/**"]
+
+[[boundaries.rules]]
+from = "libs"
+allow = ["libs"]

package/node_modules/checkride/templates/monorepo/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+packages:
+  - 'apps/*'
+  - 'libs/*'
+
+allowBuilds:
+  '@ast-grep/cli': true
+  fallow: true

package/node_modules/checkride/templates/monorepo/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./libs/core" },
+    { "path": "./apps/{{name}}" }
+  ]
+}

package/node_modules/checkride/templates/shared/cspell.json

@@ -0,0 +1,35 @@
+{
+  "version": "0.2",
+  "language": "en",
+  "files": ["**/src/**/*.ts", "**/test/**/*.ts", "**/*.md"],
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/dist/**",
+    ".check/**",
+    "pnpm-lock.yaml",
+    "package.json",
+    "CHANGELOG.md"
+  ],
+  "words": [
+    "checkride",
+    "biome",
+    "cspell",
+    "devDeps",
+    "esbuild",
+    "eslint",
+    "fallow",
+    "knip",
+    "markdownlint",
+    "NodeNext",
+    "noemit",
+    "oxlint",
+    "oxlintrc",
+    "pnpm",
+    "sgconfig",
+    "stryker",
+    "tsbuildinfo",
+    "tsconfig",
+    "tsgolint",
+    "vitest"
+  ]
+}

package/node_modules/checkride/templates/shared/gitignore

@@ -0,0 +1,10 @@
+node_modules/
+dist/
+.check/
+.fallow/
+.stryker-tmp/
+coverage/
+*.log
+*.tsbuildinfo
+.DS_Store
+.pnpm-store/

package/node_modules/checkride/templates/shared/markdownlint-cli2.jsonc

@@ -0,0 +1,11 @@
+{
+  "config": {
+    "default": true,
+    "MD013": false,
+    "MD033": false,
+    "MD041": false,
+    "MD060": false
+  },
+  "globs": ["**/*.md"],
+  "ignores": ["**/node_modules/**", "dist/**", ".check/**", "CHANGELOG.md"]
+}

package/node_modules/checkride/templates/shared/npmrc

@@ -0,0 +1 @@
+save-exact=true

package/node_modules/checkride/templates/shared/oxlintrc.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "unicorn", "import"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "error",
+    "perf": "warn",
+    "style": "off"
+  },
+  "options": {
+    "typeAware": true
+  },
+  "rules": {
+    "typescript/no-floating-promises": "error",
+    "typescript/no-misused-promises": "error",
+    "typescript/no-explicit-any": "error",
+    "typescript/await-thenable": "error",
+    "typescript/no-unnecessary-type-assertion": "error",
+    "typescript/prefer-nullish-coalescing": "error",
+    "typescript/prefer-optional-chain": "error",
+    "no-console": "warn",
+    "eqeqeq": "error"
+  },
+  "overrides": [
+    {
+      "files": ["**/*.test.ts"],
+      "rules": {
+        "typescript/no-unsafe-type-assertion": "off"
+      }
+    }
+  ],
+  "ignorePatterns": ["dist/**", ".check/**", ".claude/**", "node_modules/**"]
+}

package/node_modules/checkride/templates/shared/rules/no-class.yml

@@ -0,0 +1,8 @@
+id: no-class
+message: Prefer functional/procedural style over classes. Use modules and closures instead.
+severity: error
+language: typescript
+rule:
+  any:
+    - kind: class_declaration
+    - kind: abstract_class_declaration

package/node_modules/checkride/templates/shared/rules/no-deep-sibling-import.yml

@@ -0,0 +1,15 @@
+id: no-deep-sibling-import
+message: |
+  Deep-module boundary: don't reach past a sibling module's index.
+  Use `import { ... } from '../<sibling>/index.js'` instead of
+  `'../<sibling>/<internal>.js'`.
+severity: error
+language: typescript
+files:
+  - '**/src/**/*.ts'
+rule:
+  all:
+    - kind: import_statement
+    - regex: "from\\s+['\"]\\.\\./[^/]+/[^'\"]+['\"]"
+    - not:
+        regex: "from\\s+['\"]\\.\\./[^/]+/index\\.js['\"]"

package/node_modules/checkride/templates/shared/rules/no-default-export.yml

@@ -0,0 +1,9 @@
+id: no-default-export
+message: Avoid default exports. Named exports give agents stable, discoverable names.
+severity: error
+language: typescript
+files:
+  - '**/src/**/*.ts'
+rule:
+  any:
+    - pattern: export default $$$

package/node_modules/checkride/templates/shared/rules/require-js-extension.yml

@@ -0,0 +1,21 @@
+id: require-js-extension
+message: |
+  NodeNext resolution requires an explicit `.js` (or `.mjs` / `.json`) extension
+  on relative imports. Use `'./foo.js'`, not `'./foo'` or `'./foo.ts'`.
+severity: error
+language: typescript
+files:
+  - '**/src/**/*.ts'
+  - '**/test/**/*.ts'
+rule:
+  any:
+    - all:
+        - kind: import_statement
+        - regex: "from\\s+['\"]\\.{1,2}/"
+        - not:
+            regex: "from\\s+['\"]\\.{1,2}/[^'\"]*\\.(js|mjs|json)['\"]"
+    - all:
+        - kind: export_statement
+        - regex: "from\\s+['\"]\\.{1,2}/"
+        - not:
+            regex: "from\\s+['\"]\\.{1,2}/[^'\"]*\\.(js|mjs|json)['\"]"

package/node_modules/checkride/templates/shared/sgconfig.yml

@@ -0,0 +1,2 @@
+ruleDirs:
+  - rules

package/node_modules/checkride/templates/shared/tsconfig.base.json

@@ -0,0 +1,28 @@
+{
+  "compilerOptions": {
+    "target": "ES2024",
+    "lib": ["ES2024"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "exactOptionalPropertyTypes": true,
+    "noImplicitOverride": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "noFallthroughCasesInSwitch": true,
+
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "types": ["node"],
+
+    "composite": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true
+  }
+}

package/node_modules/checkride/templates/shared/vitest.config.ts.template

@@ -0,0 +1,27 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    include: ['**/src/**/*.{test,spec}.ts', '**/test/**/*.{test,spec}.ts'],
+    exclude: ['**/node_modules/**', '**/dist/**'],
+    reporters: ['default'],
+    coverage: {
+      provider: 'v8',
+      include: ['**/src/**/*.ts'],
+      exclude: [
+        '**/src/**/*.{test,spec}.ts',
+        '**/src/**/*.d.ts',
+        '**/node_modules/**',
+        '**/dist/**',
+      ],
+      reporter: ['text', 'json-summary', 'json'],
+      reportsDirectory: '.check/coverage',
+      thresholds: {
+        lines: 70,
+        functions: 70,
+        branches: 70,
+        statements: 70,
+      },
+    },
+  },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plumbbob",
-  "version": "0.5.4",
+  "version": "0.6.1",
   "description": "Attention-first build process: 12 skills + a CLI that keep you the decider — guidance, not enforcement.",
   "keywords": [
     "claude-code",
@@ -56,6 +56,9 @@
   "dependencies": {
     "checkride": "0.1.6"
   },
+  "bundleDependencies": [
+    "checkride"
+  ],
   "scripts": {
     "clean": "rm -rf dist",
     "build": "tsc -p tsconfig.build.json",

package/skills/pb-build/SKILL.md

@@ -4,12 +4,12 @@ description: The optional engine — read the next planned step from intent, imp
 argument-hint: "[step-number] [--auto]"
 disable-model-invocation: true
 model: opus
-allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob build:*), Bash(plumbbob check:*), Bash(plumbbob checkpoint:*), Bash(git diff:*)
+allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob build:*), Bash(plumbbob check:*), Bash(plumbbob checkpoint:*), Bash(plumbbob agent:*), Bash(git diff:*)
 ---
 
 # PlumbBob — build a step (the optional engine)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 This is the **bundled executor** — one way to turn a planned step into code. It is
 **optional** (D3): you can implement any step by hand, in a vibe session, or with
@@ -32,17 +32,43 @@ at the pause for your approval. **Re-firing `/pb-build` is itself the clock tick
 3. **Read the plan.** Read the step's **done-when**, its **seam**, and the
    **Decisions** and **Constraints** in `intent.md`. Build to *that* — the deciding
    already happened, off the chat.
+   - **Run any bound `before`-agents** *(D43/D59)*. If the build's `harness.json` binds
+     agents to this step's `before` slot, run `plumbbob agent run --step <n> --mode
+     before` first: each returns a validated envelope on stdout that plumbbob also
+     appends to the step's `handoff.json`, and its `summary`/`body` become **context you
+     read into the build** (that is the whole point of the slot — load the context in
+     before you write). No binding, or no harness, is a clean no-op — just build.
 4. **Implement** the step, and only that step, staying within the declared seam. A
    new problem or "ooh what if" that surfaces mid-build is a `/pb-park`, **not** an
    edit — capture it and stay on the step. If you genuinely cannot finish without
    touching more than the seam, that is scope drift: surface it to the human rather
    than sprawling.
+   - **If a `build`-slot agent is bound, delegate the diff to it** *(D43)*. Run
+     `plumbbob agent run --step <n> --mode build` and let that agent author the step's
+     code instead of writing it yourself; its envelope reports what it did. You still
+     own the verify tick below — the diff is reviewed the same way whoever wrote it (D3).
+   - **A manifest's `when` prose is your cue to fire an agent mid-build** *(D43/D55)*.
+     The three slots are the only *declarative* lifecycle points; there is no config for
+     "a salient moment in the middle." That is judgment, and you are the frontier model
+     in the room: when the work reaches the situation a bound agent's `when` (or a step
+     `note`) describes, fire `plumbbob agent run <name> --step <n>` yourself. Prose is
+     the orchestration language; you are the workflow engine.
+   - **Route a non-`done` envelope by its status** *(D52)*. An agent that returns
+     `blocked` couldn't finish (missing input, failed precondition): surface its `notes`,
+     let the human unblock, and re-run it — don't work around it. One that returns
+     `drift` finished but found the plan no longer matches reality: **stop and send the
+     human to `/pb-refine`** to repair the plan before continuing, rather than building
+     on a plan that's now wrong. A non-zero exit is a failed run: report it and stop.
 5. **Verify, through to the pause.** Run the verify tick exactly as `/pb-verify`
    does: `plumbbob check` (on red, read `.check/summary.json` and the failing slot's
    raw output under `.check/` for the actual diagnostics; while iterating on a fix,
    narrow the loop with `plumbbob check --bail --only <slots>` — the checkpoint gate
-   still runs everything) → self-review the diff against the done-when, the
-   Decisions, and the Constraints (a single structured read, D16) → validate → **PAUSE
+   still runs everything) → run any bound `after`-agents (`plumbbob agent run --step
+   <n> --mode after`) and fold their envelopes into the self-review as **advisory
+   input** — they inform, they never gate (checkride gates, the human is the clock; an
+   `after`-agent that could fail a step is the lock in autonomy's costume, D45) →
+   self-review the diff against the done-when, the Decisions, and the Constraints (a
+   single structured read, D16) → validate → **PAUSE
    for the human's approval** → only on approval, checkpoint with
    `plumbbob checkpoint <n> --body <<'BODY' … BODY` — a commit body **proportional to the
    step** (a line for a trivial change, a short paragraph for a meatier one; no TIL scan,
@@ -57,12 +83,17 @@ at the pause for your approval. **Re-firing `/pb-build` is itself the clock tick
 progress instead of approving each step. It does the same work, but **the agent reviews
 and approves in the human's place**, and it **chains**:
 
-- Build the next step → `check` → self-review → **if the check is green AND the
+- Build the next step, running its slots in the same order as the default path
+  (D56): bound `before`-agents → implement (or the bound `build`-agent) → bound
+  `after`-agents → `check` → self-review → **if the check is green AND the
   self-review finds no done-when / Decision / Constraint mismatch, checkpoint** and move
-  straight on to the next planned step. Repeat.
+  straight on to the next planned step. Repeat. `--auto` adds no new machinery — the
+  `after`-agent output simply feeds the *existing* self-review halt condition.
 - **Stop and hand back to the human** the moment any of these is true: the check is red,
   the self-review finds a mismatch (surface exactly what, and do not checkpoint it), a
-  new decision is needed, or no planned steps remain.
+  bound agent returns `blocked` or `drift` (unblock-and-re-run, or `/pb-refine` — an
+  agent cannot advance the loop, C6), a new decision is needed, or no planned steps
+  remain.
 
 `--auto` is the only path that checkpoints without a human pause, and only because the
 human asked for it by name. The default — no flag — always ends at the pause.
@@ -76,3 +107,7 @@ human asked for it by name. The default — no flag — always ends at the pause
 - **Default ends at the pause.** Implement → verify → wait for approval; never
   checkpoint without it. Only an explicit `--auto` lets the agent approve in your place,
   and it still halts on a red check or any mismatch.
+- **Agents feed the beat; they never advance it** (C6/D45). `before` loads context,
+  `build` writes the diff, `after` is advisory — none can checkpoint, flip a step, or
+  chain. `blocked` → unblock and re-run; `drift` → `/pb-refine`. You are still the one
+  who verifies and (bar `--auto`) the human is still the clock.

package/skills/pb-finish/SKILL.md

@@ -8,7 +8,7 @@ allowed-tools: Read, Write, Bash(plumbbob status:*), Bash(plumbbob finish:*)
 
 # PlumbBob — finish the build (the close-out)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 `/pb-finish` ends the build: it captures what happened, then makes the final commit
 that closes the session. **Report by default** (D9) — no refuse-without-report gate,

package/skills/pb-harvest/SKILL.md

@@ -8,7 +8,7 @@ allowed-tools: Read, Edit, Bash(plumbbob status:*)
 
 # PlumbBob — harvest the park list
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 `/pb-harvest` is the complement of `/pb-park` (D7): you parked ideas as seeds during a
 build; now, at a boundary, you harvest them — decide what each one is.

package/skills/pb-park/SKILL.md

@@ -9,7 +9,7 @@ allowed-tools: Bash(plumbbob status:*), Bash(plumbbob park:*)
 
 # PlumbBob — park an idea (capture, don't chase)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 `/pb-park` is the **capture** half of the loop; `/pb-harvest` is where parked items
 get triaged later (D7). Capturing the instant an idea arrives — instead of acting on

package/skills/pb-plan/SKILL.md

@@ -4,12 +4,12 @@ description: "Frame a fresh goal and author the whole plan — Frame, Decisions,
 argument-hint: "[spec-path | intent]"
 disable-model-invocation: true
 model: opus
-allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob start:*), Bash(plumbbob checkpoint:*)
+allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob start:*), Bash(plumbbob checkpoint:*), Bash(plumbbob agent list:*)
 ---
 
 # PlumbBob — plan a goal (the whole-goal move)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 `/pb-plan` is the **whole-goal** move — it opens a session and gets the deciding out
 of your head and onto `intent.md` *before* any code. By default it authors the
@@ -60,14 +60,35 @@ an agent can follow with `/pb-build`. The argument only seeds how you get there.
    paths it touches). Later steps may be fuzzier than the first — that's fine; they get
    sharpened just-in-time when you reach them with `/pb-step`. Keep each small enough to
    verify in one review pass.
-5. **Commit the plan.** Once the human approves the frame and steps, run
+5. **Offer harness bindings** *(optional — D42/D43)*. If the build will lean on
+   user-authored agents, author `harness.json` in the build folder (beside `intent.md`)
+   and review it at the **same plan pause**, alongside the steps — bindings are
+   plan-adjacent configuration, so they converge with the plan. It binds agents to a
+   step's three lifecycle slots — `before` (context in), `build` (the diff), `after`
+   (advisory review) — with an optional prose `note`; a `defaults` block binds every
+   step. Run `plumbbob agent list` to see what's resolvable, per step:
+
+   ```json
+   {
+     "contract": 1,
+     "defaults": { "after": ["reviewer"] },
+     "steps": { "3": { "before": ["context-loader"], "note": "watch the auth seam" } }
+   }
+   ```
+
+   Keep it **bindings + prose only, never a conditional** (C3): the file says *which*
+   agent, not *when* — the host model reads each manifest's `when` prose and a step's
+   `note` and decides when to fire one mid-build. Skip the file entirely when no step
+   uses an agent — the loop runs identically without it (D54). The plan commit picks it
+   up automatically (it lives in the build folder).
+6. **Commit the plan.** Once the human approves the frame and steps, run
    `plumbbob checkpoint --plan` to commit the scaffold on its own — subject
    `plumbbob: plan — <title>`, only `.plumbbob/builds/<slug>/`, a `plan <sha>` line in
    `checkpoints` (D36). This keeps the first step's diff clean, so history reads
    baseline → plan → steps. Pass a proportional `--body` (the single-quoted stdin
    heredoc) when the rationale is worth carrying; skip it for a small plan. Do this
    only on the human's approval — the plan is their convergence.
-6. **Offer to stress-test it.** Suggest `/pb-refine` to attack the frame for holes (or
+7. **Offer to stress-test it.** Suggest `/pb-refine` to attack the frame for holes (or
    to repair the plan as it drifts). Optional, the human's call.
 
 ## The interview (mode 1)

package/skills/pb-refine/SKILL.md

@@ -9,7 +9,7 @@ allowed-tools: Read, Edit, Bash(plumbbob status:*)
 
 # PlumbBob — refine the plan
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 `/pb-refine` keeps `intent.md` honest. Use it at **any point** — right after `/pb-plan`
 to stress-test a fresh frame, or mid-build to repair a plan that drifted from what the

package/skills/pb-revert/SKILL.md

@@ -9,7 +9,7 @@ allowed-tools: Bash(plumbbob status:*), Bash(plumbbob revert:*)
 
 # PlumbBob — revert to a checkpoint (driver)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 This is a **driver skill** — a chat-side trigger for the mechanical `plumbbob revert` verb, so the whole workflow runs from the agent window instead of a terminal. It is `disable-model-invocation: true`: only the human fires it. It carries **no Edit and no Write tool** — its only action is to shell the verb and report the verb's output verbatim, including any refusal. The CLI is the source of truth: never retry a refused transition, and never edit a file to work around one.
 

package/skills/pb-spike/SKILL.md

@@ -9,7 +9,7 @@ allowed-tools: Bash(plumbbob status:*), Bash(plumbbob spike:*)
 
 # PlumbBob — spike an experiment (driver)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 This is a **driver skill** — a chat-side trigger for the mechanical `plumbbob spike` verb, so the whole workflow runs from the agent window instead of a terminal. It is `disable-model-invocation: true`: only the human fires it. It carries **no Edit and no Write tool** — its only action is to shell the verb and report the verb's output verbatim, including any refusal. The CLI is the source of truth: never retry a refused transition, and never edit a file to work around one.
 

package/skills/pb-status/SKILL.md

@@ -8,7 +8,7 @@ allowed-tools: Bash(plumbbob status:*)
 
 # PlumbBob — orient (the where-am-I move)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 This is a **thin driver** for `plumbbob status`. The dashboard above is your
 orientation — the intent, the step list, the parked/open-question counts, and the

package/skills/pb-step/SKILL.md

@@ -4,12 +4,12 @@ description: Revise the next increment just-in-time — sharpen the next undone
 argument-hint: "[what-changed]"
 disable-model-invocation: true
 model: opus
-allowed-tools: Read, Edit, Bash(plumbbob status:*)
+allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob agent list:*)
 ---
 
 # PlumbBob — revise the next step (the single-increment move)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 `/pb-plan` authors the **whole** step list up front, so `/pb-step` is the
 **just-in-time revision** move: it keeps the *next* undone step honest against what the
@@ -40,6 +40,14 @@ grew — but its everyday job is to sharpen, not to invent.
 3. **Get the human's OK**, then write it into `## Steps` in the standard format —
    `N. [ ] <title> — **done when:** <criterion>` with a `- seam:` sub-line. Revise the
    existing step in place; only append when you are genuinely adding an increment.
+4. **Revise the step's harness bindings if they drifted too** *(optional — D42)*. If the
+   build carries a `harness.json` (beside `intent.md`) and the reality that moved the
+   step also changed which agents it wants, sharpen that step's slot bindings
+   (`before`/`build`/`after`) and `note` at the same time — this is the just-in-time
+   counterpart to `/pb-plan`'s plan-time binding. `plumbbob agent list` shows what's
+   resolvable. Same rule as the plan move: bindings + prose only, never a conditional
+   (C3). Leave it untouched when the step's agents are still right, or when the build
+   uses none.
 
 ## The hard contracts
 

package/skills/pb-verify/SKILL.md

@@ -3,12 +3,12 @@ name: pb-verify
 description: "The verify tick — run the check, self-review the diff against intent, validate the step's done-when, pause for your approval, then checkpoint. Executor-agnostic: it reads the diff, not who wrote it."
 disable-model-invocation: true
 model: opus
-allowed-tools: Read, Bash(plumbbob status:*), Bash(plumbbob check:*), Bash(plumbbob checkpoint:*), Bash(git diff:*), Bash(git status:*)
+allowed-tools: Read, Bash(plumbbob status:*), Bash(plumbbob check:*), Bash(plumbbob checkpoint:*), Bash(plumbbob agent:*), Bash(git diff:*), Bash(git status:*)
 ---
 
 # PlumbBob — verify a step (the tick)
 
-Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not found - install the dep and re-run: npm i -g plumbbob && plumbbob init"`
+Current session state (injected when this skill runs): !`plumbbob status 2>/dev/null || echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."`
 
 This is the **tick** — the one beat where the human is the clock. Whatever produced
 the current diff — `/pb-build`, your own hands, a vibe session, another harness —
@@ -24,17 +24,29 @@ this skill verifies it the same way: **it reads the diff, not the author** (D3).
    scrollback. Report what failed and do **not** pause for approval — there is
    nothing to approve yet. The human fixes it and re-invokes. (Exit 2 means the gate
    itself broke — a harness problem to surface, not a code failure.)
-2. **Self-review** *(a single structured read, D16)*. Read `git diff` and
+2. **Run any bound `after`-agents** *(optional — D45)*. If the build's `harness.json`
+   binds agents to this step's `after` slot, run `plumbbob agent run --step <n> --mode
+   after`. Their envelopes are **advisory input to the self-review, never a gate** —
+   `plumbbob check` already gated in step 1, and an `after`-agent that could fail a step
+   is the lock returning in autonomy's costume (D45). Fold a `done` envelope's
+   `summary`/`body` into the review below; route a non-`done` one by its status (D52): a
+   `blocked` agent couldn't finish — surface its `notes`, let the human unblock, re-run;
+   a `drift` agent found the plan no longer matches reality — stop and send the human to
+   `/pb-refine` to repair the plan before checkpointing. No binding, or no harness, is a
+   clean no-op.
+3. **Self-review** *(a single structured read, D16)*. Read `git diff` and
    `.plumbbob/intent.md`, then in one pass check the diff against:
    - the current step's **done-when** criterion — is it actually met?
    - the **Decisions** — does anything contradict a settled call?
    - the **Constraints** — are any violated?
+   - any **`after`-agent findings** from step 2 — advisory, weigh them, don't defer to them.
    Surface every mismatch plainly. You are reviewing, not building — do not fix anything.
-3. **Validate.** State, yes or no, whether the step's done-when is met, with the evidence.
-4. **PAUSE.** Present the check result, the self-review, and the validation, then
+4. **Validate.** State, yes or no, whether the step's done-when is met, with the evidence.
+5. **PAUSE.** Present the check result, the self-review (with any `after`-agent
+   findings), and the validation, then
    **stop and wait for the human's explicit approval.** This is the convergence beat;
    the human is the clock. Never checkpoint without it.
-5. **Checkpoint** *(only after approval)*. Run `plumbbob checkpoint`: it makes the WIP
+6. **Checkpoint** *(only after approval)*. Run `plumbbob checkpoint`: it makes the WIP
    commit, records the SHA, flips the step to done, appends the step to the build-log's
    `## Log`, and returns to DESIGN. The CLI owns the commit **subject**
    (`plumbbob: step N — <title>`); you own the **body**. Compose a body *proportional to
@@ -62,3 +74,6 @@ this skill verifies it the same way: **it reads the diff, not the author** (D3).
   it and end your turn.
 - **You review; you do not build.** If the self-review finds a problem, surface it
   and stop — fixing is a new build beat, not part of verify.
+- **`after`-agents advise; they never gate** (D45). Their output feeds the
+  self-review — checkride gates, the human approves. `blocked` → unblock and re-run;
+  `drift` → `/pb-refine` before checkpointing. No code path makes them blocking.