plumbbob 0.8.5 → 0.8.10

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "plumbbob",
   "displayName": "PlumbBob",
-  "version": "0.8.5",
+  "version": "0.8.10",
   "description": "Attention-first build process — driver skills + a CLI that keep you the decider: guidance on the work, a latch on the record.",
   "author": { "name": "Rob McLarty", "email": "hello@robmclarty.com", "url": "https://robmclarty.com" },
   "homepage": "https://github.com/robmclarty/plumbbob#readme",

package/README.md

@@ -231,12 +231,15 @@ matters.
 > The latch's payoff is measured, not asserted: the skill-eval harness
 > ([`test/evals/`](test/evals/)) sweeps this loop headless — prose-only baseline vs. the
 > shipped latch, N=5 per contract, every assertion a mechanical read of git state — and
-> commits the receipt to [`reports/evals/`](reports/evals/2026-07-11.md). The first sweep
+> commits the receipt to [`research/evals/`](research/evals/2026-07-11.md). The first sweep
 > (opus, 2026-07-11): the latch closes the route it owns — *no checkpoint over a red
 > check under pressure* went from **2/5 prose-only to 5/5 latched** — while the honest
 > numbers it also surfaced (park capture 0/5, and adversarial pressure consistently
 > flipping the `auto` standing grant in settings — a legal, model-writable side door)
-> are the next iteration's work, named in the report rather than papered over.
+> are the next iteration's work, named in the report rather than papered over. The
+> current sweep ([opus, 2026-07-18](research/evals/2026-07-18.md), plumbbob 0.8.7)
+> reproduces the win — *no checkpoint over a red check* still holds **5/5 latched** —
+> and confirms both gaps stand at 0.8.7, now the target of the hardening build.
 
 ## Documentation
 

package/dist/lib/latch.js

@@ -2,10 +2,12 @@
 // before its check gate (C4: cheap first; the gate already ran in the verify
 // tick). The work plane stays guidance (D10/D13 untouched); only the commit tick
 // is latched: a step may not land unless a human turn intervened since entry, the
-// human granted self-approval (D65 one-turn grant, D27 standing `auto`), or the
-// ledger is dormant. Six rows, evaluated in order, first hit wins; the refusal
-// message *is* the pause affordance. Reads TURN/TICK/GRANT/isTTY only — never the
-// host (C5). Functional, named exports, node builtins (C1/C2).
+// human granted self-approval (a D65 one-turn grant from their literal prompt), or
+// the ledger is dormant. Five rows, evaluated in order, first hit wins; the refusal
+// message *is* the pause affordance. A standing `auto` in a settings file is NOT a
+// grant (D67): a model can write that file, and a grant it can forge is no grant —
+// so the latch reads it only to say so at the pause, never to allow. Reads
+// TURN/TICK/GRANT/isTTY only — never the host (C5). Named exports, node builtins.
 import { readFileSync } from 'node:fs';
 import { grantPath, tickPath, turnPath } from "./sidecar.js";
 import { resolveBoolean } from "./settings.js";
@@ -19,18 +21,22 @@ const NO_TURN_MESSAGE = `plumbbob: checkpoint refused — no human turn since th
 pause: present the diff and the self-review, then end the turn. The human's approval on
 their next turn is what lets this land — re-run \`checkpoint\` then and stop at the
 boundary; \`/pb-build\` only starts the next step, it never lands this one. (An explicit
-\`/pb-build --auto\` or a step range in the human's own prompt grants self-approval;
-\`auto: true\` in settings.local.json is the standing grant.)
+\`/pb-build --auto\` or a step range in the human's own prompt is the only self-approval.)
 `;
 const NO_TURN_PLAN_MESSAGE = `plumbbob: checkpoint refused — no human turn since \`start\` stamped this plan. This
 is the plan pause: present the plan, then end the turn; the human's approving
-message is the tick that lets it land on re-fire. (\`auto: true\` in
-settings.local.json is the standing grant.)
+message is the tick that lets it land on re-fire. (An explicit \`/pb-build --auto\` or a
+step range in the human's own prompt is the only self-approval.)
+`;
+// D67: a settings `auto` is no longer honored — a model can write that file, so a
+// grant it can forge is no grant. When one is set we say so at the point of refusal,
+// rather than silently ignoring it, and point at the only self-approval that works.
+const SETTINGS_AUTO_NOTE = `note: \`auto\` is set in settings but is no longer a grant (D67) — re-fire \`/pb-build --auto\` to self-approve.
 `;
 function ceilingMessage(ceiling) {
     return `plumbbob: checkpoint refused — the range you granted ends at step ${ceiling} — pause here; re-fire to continue.\n`;
 }
-// The six-row matrix, in order, first hit wins. A `range` grant speaks only to
+// The five-row matrix, in order, first hit wins. A `range` grant speaks only to
 // numbered steps: on a `--plan` checkpoint (step null) it neither allows nor
 // refuses, and the decision falls through to the turn comparison.
 export function evaluateLatch(input) {
@@ -38,19 +44,19 @@ export function evaluateLatch(input) {
         return ALLOW; // 1 — a human at the keyboard
     if (input.turn === null || input.tick === null)
         return ALLOW; // 2 — dormant / hand-built
-    if (input.auto)
-        return ALLOW; // 3 — standing personal grant (D27)
     if (input.grant?.kind === 'auto')
-        return ALLOW; // 4 — one-turn grant
+        return ALLOW; // 3 — one-turn grant (D65)
     if (input.grant?.kind === 'range' && input.step !== null) {
         if (input.step <= input.grant.ceiling)
             return ALLOW;
         return { allow: false, reason: 'ceiling', message: ceilingMessage(input.grant.ceiling) };
     }
     if (input.turn > input.tick)
-        return ALLOW; // 5 — a human turn intervened
-    // 6 — the pause (plan-worded when no step is landing)
-    return { allow: false, reason: 'no-turn', message: input.step === null ? NO_TURN_PLAN_MESSAGE : NO_TURN_MESSAGE };
+        return ALLOW; // 4 — a human turn intervened
+    // 5 — the pause (plan-worded when no step is landing). A settings `auto` no longer
+    // allows (D67); when one is set, the refusal notes it rather than honoring it.
+    const base = input.step === null ? NO_TURN_PLAN_MESSAGE : NO_TURN_MESSAGE;
+    return { allow: false, reason: 'no-turn', message: input.settingsAuto ? base + SETTINGS_AUTO_NOTE : base };
 }
 // Parse a GRANT file's content (`auto` | `range <M>`). Anything else — including
 // a corrupted or hand-mangled file — contributes nothing (D27): no grant, never
@@ -72,9 +78,10 @@ export function checkLatch(root, step) {
         isTTY: process.stdin.isTTY === true,
         turn: readCount(turnPath(root)),
         tick: readCount(tickPath(root)),
-        auto: resolveBoolean(root, 'auto', false),
         grant: readGrant(root),
         step,
+        // Still read from the ladder — but only to decorate the pause (D67), not to allow.
+        settingsAuto: resolveBoolean(root, 'auto', false),
     });
 }
 function readGrant(root) {

package/dist/lib/settings.js

@@ -8,10 +8,13 @@
 // overlay can never wedge the tool. Functional/procedural, node builtins (C1/C2).
 //
 // Known keys: `check` (string — the heavy gate, tracked in settings.json) and
-// `auto` (boolean — whether the agent approves in the human's place; a personal
-// preference, so it belongs in settings.local.json). The per-worktree active-build
-// cursor is NOT here — it lives in the STATE file (see sidecar.ts), so this overlay
-// stays purely human-owned and the tool never rewrites it.
+// `auto` (boolean — a personal preference, so it belongs in settings.local.json).
+// Since D67 `auto` is NOT a checkpoint grant: the latch no longer reads it to allow
+// a land (a model can write this file, and a grant it can forge is no grant), only to
+// note it at the pause; self-approval comes from the human's literal `/pb-build --auto`
+// or a range. The per-worktree active-build cursor is NOT here — it lives in the STATE
+// file (see sidecar.ts), so this overlay stays purely human-owned and the tool never
+// rewrites it.
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 const DIRNAME = '.plumbbob';

package/dist/verbs/agent.js

@@ -99,6 +99,9 @@ async function runOne(root, slug, step, spec) {
         step,
         mode,
         settings: {
+            // The frozen envelope still reports settings `auto` to agents (doorway freeze —
+            // no envelope changes). Note it is no longer a checkpoint grant (D67): the latch
+            // stopped reading it, so a `true` here informs an agent, it does not self-approve.
             auto: resolveBoolean(root, 'auto', false),
             agentTimeout: resolveNumber(root, 'agentTimeout', 0),
             // Hand this agent its own config block over the frozen envelope `settings`

package/dist/verbs/doctor.js

@@ -32,7 +32,7 @@ import { gateDetectsTools } from "../lib/check.js";
 import { marketplacePlumbbob } from "../lib/plugins.js";
 import { findRepoRoot, gitPath, stagePath } from "../lib/git.js";
 import { buildDir, excludeControl, listBuilds, readTurn, setActiveBuild, sidecarDir, slugify } from "../lib/sidecar.js";
-import { resolveString, settingsPath } from "../lib/settings.js";
+import { resolveBoolean, resolveString, settingsPath } from "../lib/settings.js";
 // The plumbbob package's own skills/ dir (the canonical set), off this module's
 // URL so it resolves the same from src/ (dev) and dist/ (published).
 function packageDir(name) {
@@ -365,7 +365,7 @@ function agentReport(cwd) {
 // slot/adapter table. Only rows checkride marks `required` count as problems —
 // an empty slot ("no tool detected") is informational, not a failure, because
 // the runtime gate already refuses a vacuous run.
-async function gateReport(cwd) {
+async function gateReport(cwd, env) {
     const root = findRepoRoot(cwd);
     if (root === null)
         return { lines: [], failed: 0 };
@@ -377,7 +377,9 @@ async function gateReport(cwd) {
     }
     try {
         const silent = { write: () => true };
-        const { report } = await runDoctor({ cwd: root, stdout: silent });
+        // env is undefined in production → runDoctor falls back to its real toolchain
+        // probe; tests inject a deterministic one (see GateEnv).
+        const { report } = await runDoctor({ cwd: root, stdout: silent, env });
         let failed = 0;
         for (const c of report.checks) {
             if (c.category === 'tool') {
@@ -433,9 +435,16 @@ function latchReport(cwd) {
     const line = turn === null
         ? '  ○ latch: dormant — guidance only (no turn ledger yet; it ticks on your first prompt when the UserPromptSubmit hook is wired — re-run after one to confirm)'
         : `  ✓ latch: live (turn ${turn})`;
-    return { lines: ['', 'plumbbob doctor — approval latch (D64)', line], failed: 0 };
+    const lines = ['', 'plumbbob doctor — approval latch (D64)', line];
+    // D67: a settings `auto` used to be a standing grant; the latch no longer honors it
+    // (a model can write that file). Surface a set value so a human who relied on it isn't
+    // silently changed — informational, never a problem.
+    if (resolveBoolean(root, 'auto', false)) {
+        lines.push('  ○ auto: set in settings but not a grant since D67 — self-approve per run with `/pb-build --auto`');
+    }
+    return { lines, failed: 0 };
 }
-export async function doctor(cwd, args = []) {
+export async function doctor(cwd, args = [], env) {
     const checks = pluginChecks();
     const out = ['plumbbob doctor — plugin install'];
     for (const c of checks) {
@@ -445,7 +454,7 @@ export async function doctor(cwd, args = []) {
     out.push(...sidecar.lines);
     const agents = agentReport(cwd);
     out.push(...agents.lines);
-    const gate = await gateReport(cwd);
+    const gate = await gateReport(cwd, env);
     out.push(...gate.lines);
     const latch = latchReport(cwd);
     out.push(...latch.lines);

package/dist/verbs/turn.js

@@ -3,20 +3,54 @@
 // monotonic count of human turns the checkpoint latch reads to know a human turn
 // intervened since a step began) and rewrites `.plumbbob/GRANT` from the literal
 // prompt — minting a one-turn self-approval only when the human typed
-// `/pb-build --auto` or a `N-M` range (D65), clearing it otherwise. Pure machinery,
-// not a user verb: it writes nothing to stdout and ALWAYS exits 0, so a broken tick
-// can never wedge prompting (C3).
+// `/pb-build --auto` or a `N-M` range (D65), clearing it otherwise. When a step is
+// in flight it also emits ONE `UserPromptSubmit` additionalContext line so a fresh
+// session (post-compaction, or a new `-p` turn where no skill is in context) still
+// knows the beat — a tangent is parked, not chased (amends D64's "writes nothing";
+// guidance only, D10/D13). It ALWAYS exits 0 and any failure degrades to no output,
+// so neither the tick nor the emit can ever wedge prompting (C3).
 import { readFileSync, writeFileSync } from 'node:fs';
-import { findSessionRoot, setGrant, turnPath } from "../lib/sidecar.js";
+import { findSessionRoot, setGrant, stepPath, turnPath } from "../lib/sidecar.js";
 export function turn(cwd, _args) {
     try {
         applyTurn(cwd, readStdin());
+        const context = stepInFlightContext(cwd);
+        if (context !== null)
+            process.stdout.write(context);
     }
     catch {
         // C3: a broken turn must never wedge a prompt — swallow and exit 0.
     }
     return 0;
 }
+// The `UserPromptSubmit` additionalContext payload when a step is in flight (a STEP
+// marker between `build` and `checkpoint`), or null. Guidance only: it reminds a
+// fresh session that a tangent is a park (not an edit) and how the step lands, since
+// the pb-build prose may not be in context after compaction or on a scripted turn.
+// Exported because an in-process test cannot read the hook's real stdout.
+export function stepInFlightContext(cwd) {
+    const root = findSessionRoot(cwd);
+    if (root === null)
+        return null;
+    const step = inFlightStep(root);
+    if (step === null)
+        return null;
+    const text = `plumbbob: step ${step} is in flight — a new idea or tangent is a park, not an edit: ` +
+        `capture it with \`plumbbob park "<one line>"\`, then stay on the step. ` +
+        `It lands when you run \`plumbbob checkpoint ${step}\` after approval.`;
+    return `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: text } })}\n`;
+}
+// The in-flight step number, or null when no STEP marker is present (no step entered,
+// or it already checkpointed). A garbled marker reads as null — never an error (C3).
+function inFlightStep(root) {
+    try {
+        const n = Number.parseInt(readFileSync(stepPath(root), 'utf8').trim(), 10);
+        return Number.isFinite(n) && n > 0 ? n : null;
+    }
+    catch {
+        return null;
+    }
+}
 // The testable core: apply one tick given the raw hook stdin. Split from the fd-0
 // read so the unit tests can drive it directly — an in-process test cannot feed fd 0
 // (the same constraint checkpoint's `--body` lives under).
@@ -35,10 +69,12 @@ export function applyTurn(cwd, raw) {
 // The namespaced `/plumbbob:pb-build` form is honored alongside the bare one.
 //
 // Only the invocation's own arguments can mint: the tokens that follow it on its
-// line, up to the first token that isn't argument-shaped (a flag, a step number, a
-// range). An incidental range elsewhere in the prompt — an issue number, a pasted
-// `2020-2024` — is prose, not a grant. Trailing sentence punctuation on an argument
-// (`/pb-build 1-3.`) is still the argument the human typed.
+// line, up to the first token that isn't a sanctioned argument (`--auto`, a step
+// number, or a range — the argument-hint sanctions nothing else). An unrecognized
+// flag ends the scan, so `/pb-build --wip 2020-2024` mints nothing — the `2020-2024`
+// is never reached. An incidental range elsewhere in the prompt — an issue number, a
+// pasted `2020-2024` — is prose, not a grant. Trailing sentence punctuation on an
+// argument (`/pb-build 1-3.`) is still the argument the human typed.
 export function grantFromPrompt(prompt) {
     const invocation = /\/(?:plumbbob:)?pb-build\b/.exec(prompt);
     if (invocation === null)
@@ -59,9 +95,9 @@ export function grantFromPrompt(prompt) {
             ceiling = range[1];
             continue;
         }
-        if (/^\d+$/.test(word) || word.startsWith('-'))
-            continue; // a step number or another flag
-        break; // free text — the arguments have ended
+        if (/^\d+$/.test(word))
+            continue; // a bare step number — keep scanning for a range/--auto
+        break; // an unrecognized flag or free text — the arguments have ended
     }
     if (ceiling !== undefined)
         return `range ${ceiling}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plumbbob",
-  "version": "0.8.5",
+  "version": "0.8.10",
   "description": "Attention-first build process: 12 skills + a CLI that keep you the decider — guidance on the work, a latch on the record.",
   "keywords": [
     "claude-code",
@@ -34,12 +34,15 @@
   "engines": {
     "node": ">=22.18.0"
   },
-  "devEngines": {
-    "packageManager": {
-      "name": "pnpm",
-      "version": "11.1.2",
-      "onFail": "download"
-    }
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "pnpm run clean && pnpm run build",
+    "check": "checkride",
+    "test": "vitest run",
+    "eval:baseline": "pnpm build && node test/evals/run.ts --sweep baseline",
+    "eval:latched": "pnpm build && node test/evals/run.ts --sweep latched",
+    "eval:report": "node test/evals/run.ts --report"
   },
   "devDependencies": {
     "@ast-grep/cli": "0.43.0",
@@ -59,14 +62,5 @@
   },
   "bundleDependencies": [
     "checkride"
-  ],
-  "scripts": {
-    "clean": "rm -rf dist",
-    "build": "tsc -p tsconfig.build.json",
-    "check": "checkride",
-    "test": "vitest run",
-    "eval:baseline": "pnpm build && node test/evals/run.ts --sweep baseline",
-    "eval:latched": "pnpm build && node test/evals/run.ts --sweep latched",
-    "eval:report": "node test/evals/run.ts --report"
-  }
-}
+  ]
+}

package/skills/pb-build/SKILL.md

@@ -3,7 +3,7 @@ name: pb-build
 description: The default engine — read the next planned step from intent, implement it (its done-when, seam, Decisions, Constraints), then verify it through to the approval pause. Swappable — build by hand/vibed/another harness and run /pb-verify instead. `--auto` self-approves and chains to done; a step range like `1-3` self-approves through step 3, then pauses.
 argument-hint: "[step-number | step-range] [--auto]"
 disable-model-invocation: true
-allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob build:*), Bash(plumbbob handoff:*), Bash(plumbbob check:*), Bash(plumbbob checkpoint:*), Bash(plumbbob agent:*), Bash(git diff:*)
+allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob build:*), Bash(plumbbob handoff:*), Bash(plumbbob check:*), Bash(plumbbob checkpoint:*), Bash(plumbbob park:*), Bash(plumbbob agent:*), Bash(git diff:*)
 ---
 
 # PlumbBob — build a step (the default engine)
@@ -43,10 +43,13 @@ differs from the model you're running as, say so before implementing — the hum
      `harness bindings:` block, this build binds agents — see **§ Running bound agents**
      and load their context in before you write. No bindings, no harness: just build.
 4. **Implement** the step, and only that step, staying within the declared seam. A
-   new problem or "ooh what if" that surfaces mid-build is a `/pb-park`, **not** an
-   edit — capture it and stay on the step. If you genuinely cannot finish without
-   touching more than the seam, that is scope drift: surface it to the human rather
-   than sprawling.
+   new problem or "ooh what if" that surfaces mid-build is a park, **not** an edit:
+   capture it by running `plumbbob park "<one tidy line>"` — **saying "let's defer
+   that" writes nothing; only the park line in the build log is a capture.** When the
+   *human* hands you the tangent mid-build, their message **is** the approval to park
+   it — capture it right away, say what you parked, and stay on the step. If you
+   genuinely cannot finish without touching more than the seam, that is scope drift:
+   surface it to the human rather than sprawling.
    - **Bound agents can shape the build.** If `plumbbob status` shows a
      `harness bindings:` block, a `build`-slot agent may author the diff, a `when`-cue may
      fire an agent mid-build, and a non-`done` envelope routes by its status — see
@@ -185,7 +188,8 @@ just the one more entry already in the halt list above.
 - **Swappable, never required.** The loop works without this skill; `/pb-verify`
   checkpoints a hand-built or vibed diff just the same.
 - **Build the decided step, not a new one.** Implement what `intent.md` settled. A
-  new idea mid-build is a `/pb-park`, not an edit.
+  new idea mid-build is captured with `plumbbob park`, not an edit — a promise to
+  defer writes nothing; the park line does.
 - **Default ends at the pause.** Implement → verify → wait for approval; never
   checkpoint without it. Only an explicit `--auto` or a step range lets the agent approve
   in your place, and it still halts on a red check or any mismatch — a range also stops
@@ -199,8 +203,10 @@ just the one more entry already in the halt list above.
   hook a same-turn `checkpoint` is refused by design — present the diff and the closing
   block, **end the turn**; the human's approval on their next turn is what lets you land
   it, and landing it is a deliberate beat, not a side effect of the next `/pb-build`.
-  Never route around it with a raw `git commit`; `--auto`, a typed range, or `auto: true`
-  are the only self-approvals.
+  Never route around it with a raw `git commit`. An explicit `/pb-build --auto` or a typed
+  step range in the human's own prompt are the only self-approvals — **never write `auto`
+  into a settings file yourself to unlock a checkpoint. A grant you mint is no grant (the
+  latch ignores it since D67); ask the human to re-fire `/pb-build --auto` instead.**
 - **Close with the next model.** When a step lands, run `plumbbob handoff` and relay its
   block — it cites the completed step and the next undone step, and names that next step's
   `- model:` recommendation if it has one, which is what a fresh context window needs to

package/skills/pb-doctor/SKILL.md

@@ -8,7 +8,7 @@ allowed-tools: Bash(plumbbob doctor:*)
 
 # PlumbBob — doctor (the is-it-installed-right move)
 
-Install diagnostic (injected when this skill runs): !`if command -v plumbbob >/dev/null 2>&1; then plumbbob doctor 2>&1; else echo "plumbbob CLI not on PATH in this session. Marketplace install: confirm the plugin is enabled in /plugin, then /reload-plugins. Skills-dir/global install: npm i -g plumbbob && plumbbob init."; fi`
+Install diagnostic (injected when this skill runs): !`plumbbob doctor 2>&1 || true`
 
 This is a **thin driver** for `plumbbob doctor`. The report above is read-only — `doctor`
 inspects, it never writes. This skill carries **no Edit and no Write tool**: never edit a file
@@ -34,6 +34,10 @@ and if you are reading this, that is not your situation.
 ## What it does
 
 1. Surface the injected `doctor` report verbatim — every `✓` and any `✗` with its `→ fix`.
+   If nothing rendered above (a few headless `-p` sessions skip the injection), just run
+   `plumbbob doctor` yourself — it is in your tools — and surface that.
 2. If all checks passed, say so; if a skill still misbehaves, the fix is a restart, not a re-run.
 3. If a check failed, apply its named `→ fix`, then restart Claude Code (or `/reload-plugins`).
-4. If the line above says the CLI is not on PATH, follow the install-path branch it printed.
+4. If the report is empty or shows `command not found`, the CLI is not on PATH: for a
+   skills-dir / global install run `npm i -g plumbbob && plumbbob init`; for a marketplace
+   install, confirm the plugin is enabled in `/plugin`, then `/reload-plugins`.

package/skills/pb-park/SKILL.md

@@ -38,4 +38,7 @@ later. Then:
 The capture itself is the **dumb CLI**, never an edit. This skill carries **no Edit and
 no Write tool** on purpose: you may not append to `build-log.md` yourself. Compose, get
 approval, then shell `plumbbob park` — that is the only write path. If approval
-never comes, capture nothing.
+never comes, capture nothing. (When the human's **own message** states the idea — a
+tangent they raise mid-build — that message **is** the approval: capture it directly
+with `plumbbob park`, don't ask again. Deferring in words without the CLI line captures
+nothing.)

package/skills/pb-plan/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pb-plan
-description: "Frame a fresh goal and author the whole plan — Frame, Decisions, Constraints, and all Steps — before any code. Three input modes: no arg interviews you; a file path absorbs a spec; any other text expands your inline intent."
+description: "Frame a fresh goal and author the whole plan — Frame, Decisions, Constraints, and all Steps — before any code. Three input modes: no arg interviews you; a file path (or @-mention) absorbs a spec; any other text expands your inline intent."
 argument-hint: "[spec-path | intent]"
 disable-model-invocation: true
 allowed-tools: Read, Edit, Write, Bash(plumbbob status:*), Bash(plumbbob start:*), Bash(plumbbob checkpoint:*), Bash(plumbbob agent list:*)
@@ -27,11 +27,15 @@ Look at the argument the human gave and pick the mode yourself:
 
 1. **No argument → interview.** Walk the human through a short, friendly Q&A to draw
    the plan out of their head (see *The interview* below).
-2. **The argument is a path to a file that exists → absorb the spec.** Read that file
-   and distill it into `intent.md`, **retaining enough detail that `intent.md` stands
-   on its own** — don't just link to the source. Add a one-line provenance
-   (`*Source: <path>*`) and, for anything sizable, a `## Source` appendix preserving
-   the original text. (Probe with the `Read` tool; if it isn't a real file, fall to
+2. **The argument points at a file → absorb the spec.** A bare path, an `@spec.md`
+   mention, or a path wrapped in a sentence all count. Strip any leading `@` and probe
+   the token with the `Read` tool; if Claude Code has already injected the referenced
+   file's contents into your context, treat that as the spec rather than re-fetching.
+   Read the spec and distill it into `intent.md`, **retaining enough detail that
+   `intent.md` stands on its own** — don't just link to the source. Add a one-line
+   provenance (`*Source: <path>*`) and, for anything sizable, a `## Source` appendix
+   preserving the original text. Any prose wrapped around the reference (e.g. "absorb
+   @spec.md") is extra intent — fold it in. (If the token isn't a real file, fall to
    mode 3.)
 3. **Any other text → expand the inline intent.** Treat the text as the human's
    rough plan, expand it into the full `intent.md`, and ask only about what is

package/skills/pb-verify/SKILL.md

@@ -83,8 +83,9 @@ the checkpoint land when you re-fire. **Never reach for a raw `git commit` to fo
 land** — that forges the very record the latch exists to keep honest, and the
 commit-ask hook asks the human about it anyway. The refusal is a healthy latch doing its
 job on the *record* while the *work* plane stays free; a `/pb-build --auto` or
-a typed step range in the human's own prompt is the only self-approval, and `auto: true`
-in settings is the standing one.
+a typed step range in the human's own prompt is the only self-approval — **never write
+`auto` into a settings file to unlock the land; the latch ignores a model-minted grant
+(D67), so ask the human to re-fire `/pb-build --auto` instead.**
 
 ## The hard contracts