qualia-framework 6.7.0 → 6.8.0

package/skills/qualia-polish/scripts/playwright-capture.mjs

@@ -26,7 +26,7 @@ import { homedir } from "node:os";
 
 // ── Arg parsing ──────────────────────────────────────────────────────────
 function parseArgs() {
-  const args = { url: null, out: null, viewports: [375, 768, 1440], wait: 1500, reducedMotion: false };
+  const args = { url: null, out: null, viewports: [375, 768, 1440], wait: 1500, reducedMotion: false, states: false, stateSelector: null };
   for (let i = 2; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--url" && argv[i + 1]) args.url = argv[++i];
@@ -35,15 +35,22 @@ function parseArgs() {
       args.viewports = argv[++i].split(",").map((s) => parseInt(s, 10)).filter((n) => Number.isFinite(n) && n > 0);
     } else if (a === "--wait" && argv[i + 1]) args.wait = parseInt(argv[++i], 10);
     else if (a === "--reduced-motion") args.reducedMotion = true;
+    else if (a === "--states") args.states = true;
+    else if (a === "--state-selector" && argv[i + 1]) args.stateSelector = argv[++i];
     else if (a === "--help" || a === "-h") {
       console.log(`playwright-capture.mjs — Screenshot capture for /qualia-polish --loop
 
 Usage:
-  node playwright-capture.mjs --url <url> --out <dir> [--viewports 375,768,1440] [--wait 1500] [--reduced-motion]
+  node playwright-capture.mjs --url <url> --out <dir> [--viewports 375,768,1440] [--wait 1500] [--reduced-motion] [--states]
 
 Flags:
   --reduced-motion   Force prefers-reduced-motion: reduce in the captured page.
                      Use when the brief explicitly opts out of motion (a11y mode).
+  --states           Also capture hover/focus interaction-state PNGs (Playwright
+                     backend only — the Chrome-binary backend cannot drive
+                     hover/focus from the CLI and silently skips them).
+  --state-selector   CSS selector to target for --states (default: first
+                     a, button, [role=button], or input on the page).
 
 Backend selection (auto):
   1. Playwright   — import('playwright') if installed
@@ -64,11 +71,14 @@ function viewportName(width) {
   if (width <= 900) return "tablet";
   return "desktop";
 }
-function viewportHeight(width) {
-  if (width <= 480) return 812;
-  if (width <= 900) return 1024;
-  return 900;
-}
+// Initial render height for the Playwright context viewport. Capture is
+// full-page (fullPage:true), so this is NOT a clamp on the captured PNG — it
+// only sets the layout viewport before Playwright stitches the full scroll.
+const INITIAL_RENDER_HEIGHT = 1080;
+// Headless Chrome (binary backend) has no --full-page flag, so a tall window
+// height approximates full-page capture. Replaces the old per-viewport clamp
+// (812/1024/900) that cropped everything below the fold.
+const FULLPAGE_WINDOW_HEIGHT = 8000;
 
 // ── Backend: Playwright (preferred when available) ──────────────────────
 async function captureViaPlaywright(args) {
@@ -84,7 +94,7 @@ async function captureViaPlaywright(args) {
     browser = await chromium.launch({ headless: true });
     for (const width of args.viewports) {
       const name = viewportName(width);
-      const height = viewportHeight(width);
+      const height = INITIAL_RENDER_HEIGHT;
       const file = join(args.out, `${name}-${width}.png`);
       try {
         const ctxOpts = { viewport: { width, height }, deviceScaleFactor: 1 };
@@ -93,9 +103,14 @@ async function captureViaPlaywright(args) {
         const page = await ctx.newPage();
         await page.goto(args.url, { waitUntil: "networkidle", timeout: 30000 });
         if (args.wait > 0) await page.waitForTimeout(args.wait);
-        await page.screenshot({ path: file, fullPage: false });
+        await page.screenshot({ path: file, fullPage: true });
+        const stateFiles = [];
+        if (args.states) {
+          const extra = await captureStates(page, args, name, width);
+          stateFiles.push(...extra);
+        }
         await ctx.close();
-        results.push({ viewport: name, width, height, file, ok: true, backend: "playwright", reducedMotion: !!args.reducedMotion });
+        results.push({ viewport: name, width, height, file, ok: true, backend: "playwright", reducedMotion: !!args.reducedMotion, ...(stateFiles.length ? { state_captures: stateFiles } : {}) });
       } catch (err) {
         results.push({ viewport: name, width, height, file, ok: false, backend: "playwright", error: err.message });
       }
@@ -106,6 +121,59 @@ async function captureViaPlaywright(args) {
   return results;
 }
 
+// ── Optional interaction-state capture (--states, Playwright only) ───────
+// Captures hover/focus/loading variant PNGs of the first interactive element
+// (or --state-selector) so the evaluator can score Motion/States honestly
+// instead of guessing from a single static above-fold frame. Best-effort: any
+// individual state that can't be captured is recorded as ok:false, never throws.
+async function captureStates(page, args, name, width) {
+  const out = [];
+  const selector = args.stateSelector
+    || "a:visible, button:visible, [role=button]:visible, input:visible";
+  let target;
+  try {
+    target = page.locator(selector).first();
+    await target.waitFor({ state: "visible", timeout: 2000 });
+  } catch {
+    out.push({ state: "hover", viewport: name, width, ok: false, error: "no interactive target found" });
+    return out;
+  }
+
+  // hover
+  const hoverFile = join(args.out, `${name}-${width}-hover.png`);
+  try {
+    await target.hover({ timeout: 2000 });
+    await page.waitForTimeout(Math.min(args.wait, 400));
+    await target.screenshot({ path: hoverFile });
+    out.push({ state: "hover", viewport: name, width, file: hoverFile, ok: true });
+  } catch (e) {
+    out.push({ state: "hover", viewport: name, width, file: hoverFile, ok: false, error: e.message });
+  }
+
+  // focus
+  const focusFile = join(args.out, `${name}-${width}-focus.png`);
+  try {
+    await target.focus({ timeout: 2000 });
+    await page.waitForTimeout(Math.min(args.wait, 400));
+    await target.screenshot({ path: focusFile });
+    out.push({ state: "focus", viewport: name, width, file: focusFile, ok: true });
+  } catch (e) {
+    out.push({ state: "focus", viewport: name, width, file: focusFile, ok: false, error: e.message });
+  }
+
+  // loading — re-navigate and grab the earliest paint (commit) before networkidle
+  const loadingFile = join(args.out, `${name}-${width}-loading.png`);
+  try {
+    await page.goto(args.url, { waitUntil: "commit", timeout: 30000 });
+    await page.screenshot({ path: loadingFile });
+    out.push({ state: "loading", viewport: name, width, file: loadingFile, ok: true });
+  } catch (e) {
+    out.push({ state: "loading", viewport: name, width, file: loadingFile, ok: false, error: e.message });
+  }
+
+  return out;
+}
+
 // ── Backend: Chrome/Chromium headless via spawn ─────────────────────────
 function findChromeBinary() {
   // 1. Playwright cached chromium (newest first)
@@ -136,7 +204,10 @@ function captureViaChromeBinary(args, binary) {
   const results = [];
   for (const width of args.viewports) {
     const name = viewportName(width);
-    const height = viewportHeight(width);
+    // Tall window so headless Chrome's --screenshot is not cropped to a fixed
+    // above-fold height. Classic headless has no --full-page flag, so a large
+    // height is the closest equivalent to full-page capture on this backend.
+    const height = FULLPAGE_WINDOW_HEIGHT;
     const file = join(args.out, `${name}-${width}.png`);
     const flags = [
       "--headless=new",
@@ -144,6 +215,8 @@ function captureViaChromeBinary(args, binary) {
       "--disable-gpu",
       "--disable-dev-shm-usage",
       "--hide-scrollbars",
+      // Constrain layout WIDTH; use a tall height (not the old per-viewport
+      // clamp) so the capture spans well below the fold.
       `--window-size=${width},${height}`,
       `--screenshot=${file}`,
       `--virtual-time-budget=${Math.max(args.wait + 1000, 3000)}`,
@@ -189,6 +262,9 @@ async function main() {
   }
 
   const failed = captures.filter((c) => !c.ok).length;
+  // --states is only honored on the Playwright backend (the Chrome-binary
+  // backend cannot drive hover/focus from the CLI). Surface that it was skipped.
+  const statesSkipped = args.states && backendUsed === "chrome-binary";
   console.log(JSON.stringify({
     url: args.url,
     output_dir: args.out,
@@ -196,6 +272,8 @@ async function main() {
     captures,
     total: captures.length,
     failed,
+    ...(args.states ? { states_requested: true } : {}),
+    ...(statesSkipped ? { states_skipped: "chrome-binary backend cannot capture hover/focus/loading states" } : {}),
   }, null, 2));
   exit(failed > 0 ? 1 : 0);
 }

package/skills/qualia-polish/scripts/vibe-tokens.mjs

@@ -19,8 +19,9 @@
  */
 
 import { readFileSync, writeFileSync, existsSync, readdirSync, statSync } from "node:fs";
-import { join, basename, extname } from "node:path";
+import path, { join, basename, extname } from "node:path";
 import { argv, exit, cwd } from "node:process";
+import { spawnSync } from "node:child_process";
 
 function flag(name, fallback) {
   const i = argv.indexOf(name);
@@ -41,6 +42,7 @@ if (!CMD || CMD === "--help" || CMD === "-h") {
 Usage:
   tokens.mjs sync --design <path> [--write]
   tokens.mjs propose-variants --product <path> --design <path> --count <N>
+  tokens.mjs verify [--files a.css,b.tsx]   # post-vibe gate: tsc --noEmit + slop-detect
 
 See skills/qualia-polish/SKILL.md.
 `);
@@ -331,11 +333,65 @@ function cmdProposeVariants() {
   exit(0);
 }
 
+// ─── Post-vibe verify (script-side piece of W7.3) ─────────────────────
+// Deterministic gate the orchestrator (SKILL.md Stage 6) calls AFTER a --vibe
+// token swap, so a vibe pivot never ships unverified. This runs the two
+// machine-checkable gates — `tsc --noEmit` and `slop-detect` on changed files.
+// The screenshot + visual-evaluator pass remains orchestration (the parent
+// session / another agent), not a script primitive.
+function resolveSlopScript() {
+  const candidates = [
+    process.env.SLOP_DETECT_SCRIPT,
+    `${process.env.HOME}/.claude/bin/slop-detect.mjs`,
+    path.join(path.dirname(new URL(import.meta.url).pathname), "..", "..", "..", "bin", "slop-detect.mjs"),
+  ].filter(Boolean);
+  return candidates.find((p) => existsSync(p)) || null;
+}
+
+function cmdVerify() {
+  const filesFlag = flag("--files", null);
+  const files = typeof filesFlag === "string"
+    ? filesFlag.split(",").map((s) => s.trim()).filter(Boolean)
+    : [];
+  const gates = [];
+
+  // Gate 1 — tsc --noEmit (skipped if no tsconfig in cwd).
+  if (existsSync(join(cwd(), "tsconfig.json"))) {
+    const r = spawnSync("npx", ["tsc", "--noEmit"], { encoding: "utf8" });
+    gates.push({ gate: "tsc", ok: r.status === 0, output: (r.stderr || r.stdout || "").split("\n").slice(0, 20).join("\n") });
+  } else {
+    gates.push({ gate: "tsc", ok: true, skipped: "no tsconfig.json in cwd" });
+  }
+
+  // Gate 2 — slop-detect on the changed files (resolved like commit-fix does).
+  const slopScript = resolveSlopScript();
+  if (!slopScript) {
+    gates.push({ gate: "slop-detect", ok: true, skipped: "slop-detect.mjs not found" });
+  } else if (files.length === 0) {
+    gates.push({ gate: "slop-detect", ok: true, skipped: "no --files provided" });
+  } else {
+    const slopBin = process.env.SLOP_DETECT_BIN || "node";
+    const r = spawnSync(slopBin, [slopScript, ...files], { encoding: "utf8" });
+    gates.push({ gate: "slop-detect", ok: r.status !== 1, output: (r.stdout || "").split("\n").slice(0, 20).join("\n") });
+  }
+
+  const allPass = gates.every((g) => g.ok);
+  console.log(JSON.stringify({
+    command: "verify",
+    files,
+    gates,
+    pass: allPass,
+    note: "screenshot + visual-evaluator pass is orchestrated by SKILL.md Stage 6, not by this script",
+  }, null, 2));
+  exit(allPass ? 0 : 1);
+}
+
 // ─── Dispatch ────────────────────────────────────────────────────────
 
 switch (CMD) {
   case "sync": cmdSync(); break;
   case "propose-variants": cmdProposeVariants(); break;
+  case "verify": cmdVerify(); break;
   default:
     console.error(`Unknown command: ${CMD}`);
     exit(2);

package/skills/qualia-research/SKILL.md

@@ -124,5 +124,5 @@ node ${QUALIA_BIN}/qualia-ui.js end "PHASE {N} RESEARCH DONE" "/qualia-plan {N}"
 1. **One session per run.** Don't research phases 1-5 in one call.
 2. **Must produce a file.** Research in conversation only is worthless.
 3. **Honor locked decisions.** Don't research alternatives to locked choices.
-4. **Local-first.** Drain NotebookLM and `~/qualia-memory` before any external call. The team has already researched most domains we touch — querying existing notebooks is near-zero token cost AND higher-quality than fresh WebSearch.
+4. **Local-first.** Drain NotebookLM and the local memory (`projects/-home-qualia/memory/MEMORY.md`) before any external call. The team has already researched most domains we touch — querying existing notebooks is near-zero token cost AND higher-quality than fresh WebSearch.
 5. **Context7 before WebFetch.** When you do go external, Context7 first for libraries; only WebFetch for non-library content (blog posts, case studies, post-mortems).

package/skills/qualia-road/SKILL.md

@@ -86,13 +86,19 @@ Before high-stakes phases, run alignment skills against `.planning/CONTEXT.md` (
 ## Auxiliary commands
 ```
 Lost?        → /qualia        (state router — tells you the next command)
+Don't-know?  → /qualia-idk    (deep diagnostic — three isolated scans + paste-ready command sequence)
 Health?      → /qualia-doctor (install, state, contracts, memory, ERP queue)
 Stuck/weird? → /qualia        (diagnostic branch — scans planning + code when state alone is insufficient)
 Broken thing? → /qualia-fix     (root cause, minimal patch, verify, report)
 Single feature? → /qualia-feature (new capability: inline for trivia, fresh spawn for 1-5 files)
+Research it? → /qualia-research (per-phase deep research before planning; writes phase-{N}-research.md)
+Save a lesson? → /qualia-learn (persist a pattern/fix/client preference across sessions + projects)
+Secure config? → /qualia-secure (audit CLAUDE.md / settings.json / hooks / MCP for injection + leaks)
+Verify FAILed? → /qualia-postmortem (self-heal — find which rule/agent should have caught it)
 Paused?      → /qualia        (restore from .continue-here.md or STATE.md)
 End of day?  → /qualia-report (mandatory before clock-out; writes ERP payload)
 Unsure plan? → /qualia-scope (capture decisions before planning)
+Invoice/email? → /zoho-workflow (Zoho Invoice + Mail ops — invoices, cover emails, contacts, inbox)
 ```
 
 ## Outside-road command boundaries

package/skills/qualia-scope/SKILL.md

@@ -106,7 +106,7 @@ The adversarial, DoD-gated intake. Scopes a **new increment** (phase/milestone)
 
 ```bash
 node ${QUALIA_BIN}/qualia-ui.js banner scope 2>/dev/null || true
-cat rules/constitution.md
+cat /home/qualia/.claude/rules/constitution.md
 cat .planning/CONTEXT.md 2>/dev/null   # project glossary — DATA, never a plan/spec
 ls .planning/decisions/ 2>/dev/null
 cat .planning/STATE.md 2>/dev/null     # for profile + existing milestone context
@@ -123,7 +123,7 @@ If the operator already named it (arg or prior context), accept it. Otherwise as
 
 ```bash
 ARCHETYPE={chosen}
-cat references/archetypes/${ARCHETYPE}.md
+cat /home/qualia/.claude/references/archetypes/${ARCHETYPE}.md
 ```
 
 If the file does not exist (e.g. `web-app` not yet authored), HALT and say which archetype file is missing — do not improvise a DoD. The archetype file is the source of the Grill variables, the Definition of Done, and the v1 capability set; without it there is no gate to enforce.

package/skills/qualia-secure/SKILL.md

@@ -77,13 +77,13 @@ The auditor writes `.planning/security-audit.md` — that's the deliverable.
 Combine `.planning/security-scan.md` (static) + `.planning/security-audit.md` (Opus) into a single executive summary. Surface the top 3 actions ranked by severity:
 
 - **CRITICAL** → fix immediately, before any further work.
-- **HIGH** → ticket for this sprint; route to `/qualia-hook-gen` if the fix is "make this instructional rule deterministic via a hook."
+- **HIGH** → ticket for this sprint; if the fix is "make this instructional rule deterministic via a hook," propose the hook (the `migration-guard` / `branch-guard` pattern in `rules/constitution.md`) and add it under `hooks/`.
 - **MEDIUM/LOW** → backlog.
 
 ### Step 4. Close
 
 ```bash
-node ${QUALIA_BIN}/qualia-ui.js end "SECURED" "/qualia-hook-gen"
+node ${QUALIA_BIN}/qualia-ui.js end "SECURED" "/qualia-fix"
 ```
 
 (Or omit the next-command if all findings are LOW.)
@@ -93,13 +93,13 @@ node ${QUALIA_BIN}/qualia-ui.js end "SECURED" "/qualia-hook-gen"
 1. **Static pass is non-negotiable.** It's fast and deterministic — always runs.
 2. **Opus pass is opt-in.** It costs tokens and time. Default to skipping unless the user explicitly asks for "deep audit" or the static pass triggers HIGH+ findings.
 3. **No fake severity.** Per `rules/grounding.md`, every finding cites `file:line` and matches a category in the Severity Rubric. No hedging.
-4. **Recommend deterministic fixes when possible.** A rule in CLAUDE.md is suggestive; a hook is enforced. The skill's bias is toward `/qualia-hook-gen` over "tell the agent to do X."
+4. **Recommend deterministic fixes when possible.** A rule in CLAUDE.md is suggestive; a hook is enforced. The skill's bias is toward proposing a deterministic hook (under `hooks/`) over "tell the agent to do X."
 5. **Never auto-rotate secrets.** Flag and instruct. The user rotates manually with confirmation — secrets in CI variables are the user's domain.
 
 ## When NOT to use
 
 - Application-level security review (use `/security-review` for OWASP-style code audit).
-- Production deployment health (use `/qualia-doctor` / `/qualia-status`).
-- Specific bug investigation (use `/qualia-debug` → `/qualia-fix`).
+- Production deployment health (use `/qualia-doctor`).
+- Specific bug investigation (use `/qualia-fix`).
 
 `/qualia-secure` is specifically for **the agent's configuration**. The hooks, the rules, the tool scopes, the MCP servers — the surfaces Claude reads to decide what to do.

package/templates/help.html

@@ -350,7 +350,7 @@
       <h3>Phase Depth &mdash; Optional</h3>
       <p class="cmd-group-note">Used before / around /qualia-plan when a phase needs deeper context.</p>
       <div class="commands">
-        <div class="cmd"><span class="cmd-name">/qualia-discuss</span><span class="cmd-desc">Capture phase decisions, trade-offs, and constraints BEFORE planning. Use for complex phases with regulatory, compliance, or architectural stakes. Creates .planning/phase-{N}-context.md that planner honors as locked input.</span></div>
+        <div class="cmd"><span class="cmd-name">/qualia-scope</span><span class="cmd-desc">Unified intake. No args: non-technical kickoff discovery before /qualia-new. With N: archetype-aware adversarial grill before /qualia-plan, gated on Definition-of-Done. Use for complex phases with regulatory, compliance, or architectural stakes. Creates .planning/phase-{N}-context.md that the planner honors as locked input.</span></div>
         <div class="cmd"><span class="cmd-name">/qualia-research</span><span class="cmd-desc">Deep-research a niche domain or library BEFORE planning a specific phase. Spawns the researcher agent with Context7/WebFetch access. Writes to .planning/phase-{N}-research.md.</span></div>
         <div class="cmd"><span class="cmd-name">/qualia-map</span><span class="cmd-desc">Map an existing codebase to infer architecture, stack, conventions, and what's already built. For brownfield projects &mdash; run BEFORE /qualia-new so Validated requirements get inferred from existing code.</span></div>
         <div class="cmd"><span class="cmd-name">/qualia-milestone</span><span class="cmd-desc">Close out a completed milestone and prep the next one. Archives the current milestone's artifacts, updates REQUIREMENTS.md to mark v1 requirements Complete, and creates the next milestone roadmap.</span></div>

package/templates/knowledge/index.md

@@ -12,10 +12,10 @@ file first**, then jump to the specific file(s) that match.
 |--------------------------|-------|
 | "How do we usually X?" / patterns we've used before | `learned-patterns.md` |
 | Recurring bug + fix recipes | `common-fixes.md` |
-| Supabase auth, RLS, migrations, edge functions | `supabase-patterns.md` |
-| Retell, ElevenLabs, voice agent flows | `voice-agent-patterns.md` |
-| Where a project is deployed, env vars, domains | `deployment-map.md` |
-| Who is on the team, their role, their access | `employees.md` |
+| Supabase auth, RLS, migrations, edge functions | `supabase-patterns.md` *(created on first /qualia-learn)* |
+| Retell, ElevenLabs, voice agent flows | `voice-agent-patterns.md` *(created on first /qualia-learn)* |
+| Where a project is deployed, env vars, domains | `deployment-map.md` *(created on first /qualia-learn)* |
+| Who is on the team, their role, their access | `employees.md` *(created on first /qualia-learn)* |
 | What I worked on yesterday / last week | `daily-log/YYYY-MM-DD.md` |
 | Memory layer architecture itself | `agents.md` |
 

package/tests/bin.test.sh

@@ -733,11 +733,11 @@ else
   fail_case "qualia-flush retirement/install state"
 fi
 
-# 62. CLAUDE_AGENT_FORK_ENABLED=1 in settings.json
-if grep -q '"CLAUDE_AGENT_FORK_ENABLED": "1"' "$TMP/.claude/settings.json"; then
-  pass "settings.env CLAUDE_AGENT_FORK_ENABLED=1 (forked subagents on by default)"
+# 62. CLAUDE_CODE_FORK_SUBAGENT=1 in settings.json (official env var, Claude Code v2.1.117+)
+if grep -q '"CLAUDE_CODE_FORK_SUBAGENT": "1"' "$TMP/.claude/settings.json"; then
+  pass "settings.env CLAUDE_CODE_FORK_SUBAGENT=1 (forked subagents on by default)"
 else
-  fail_case "CLAUDE_AGENT_FORK_ENABLED not set"
+  fail_case "CLAUDE_CODE_FORK_SUBAGENT not set"
 fi
 
 # 63. research-synthesizer agent has model: haiku frontmatter

package/tests/lib.test.sh

@@ -507,7 +507,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/home/.claude/bin" "$TMP/home/.claude/hooks" "$TMP/home/.claude/knowledge/daily-log" "$TMP/home/.claude/qualia-design" "$TMP/home/.claude/agents" "$TMP/home/.claude/qualia-templates" "$TMP/project"
 echo '{"installed_by":"Test","role":"OWNER","version":"6.3.0","erp":{"enabled":false}}' > "$TMP/home/.claude/.qualia-config.json"
 touch "$TMP/home/.claude/CLAUDE.md" "$TMP/home/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
   touch "$TMP/home/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js; do
@@ -622,7 +622,7 @@ TMP=$(mktmp)
 mkdir -p "$TMP/.claude/bin" "$TMP/.claude/hooks" "$TMP/.claude/knowledge/daily-log" "$TMP/.claude/qualia-design" "$TMP/.claude/agents" "$TMP/.claude/qualia-templates" "$TMP/project/.planning"
 echo '{"installed_by":"Test","role":"OWNER","erp":{"enabled":false}}' > "$TMP/.claude/.qualia-config.json"
 touch "$TMP/.claude/CLAUDE.md" "$TMP/.claude/settings.json"
-for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js; do
+for f in runtime-manifest.js command-surface.js host-adapters.js state.js qualia-ui.js statusline.js knowledge.js knowledge-flush.js state-ledger.js plan-contract.js contract-runner.js harness-eval.js trust-score.js agent-runs.js slop-detect.mjs erp-retry.js work-packet.js report-payload.js project-snapshot.js codex-goal.js planning-hygiene.js prune-deprecated.js learning-candidates.js status-snapshot.js security-scan.js auto-report.js; do
   touch "$TMP/.claude/bin/$f"
 done
 for h in session-start.js auto-update.js branch-guard.js pre-push.js pre-deploy-gate.js migration-guard.js git-guardrails.js stop-session-log.js fawzi-approval-guard.js vercel-account-guard.js env-empty-guard.js supabase-destructive-guard.js; do