skillwiki 0.10.73 → 0.10.76

package/dist/cli.js

@@ -50,7 +50,7 @@ import {
   snapshotterHealthChecks,
   upsertIndexEntry,
   vectorIndexStatus
-} from "./chunk-YKVJ2A3O.js";
+} from "./chunk-CLF6DZ6C.js";
 import {
   normalizeDistTag,
   readCache,
@@ -151,7 +151,7 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-R5SDVKHS.js";
+} from "./chunk-5XT6MBWA.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
@@ -4246,24 +4246,45 @@ function parseCoreSemver(version) {
   if (!m) return null;
   return { major: parseInt(m[1], 10), minor: parseInt(m[2], 10), patch: parseInt(m[3], 10) };
 }
+function isAtLeast(parsed, major, minor, patch) {
+  return parsed.major > major || parsed.major === major && parsed.minor > minor || parsed.major === major && parsed.minor === minor && parsed.patch >= patch;
+}
+function isBelow(parsed, major, minor, patch) {
+  return !isAtLeast(parsed, major, minor, patch);
+}
 function needs0101Migration(previousVersion, newVersion) {
   const p = parseCoreSemver(previousVersion);
   const n = parseCoreSemver(newVersion);
   if (!p || !n) return false;
-  const prevLt = p.major < 0 || p.major === 0 && p.minor < 10 || p.major === 0 && p.minor === 10 && p.patch < 1;
-  const newGe = n.major > 0 || n.major === 0 && n.minor > 10 || n.major === 0 && n.minor === 10 && n.patch >= 1;
-  return prevLt && newGe;
+  return isBelow(p, 0, 10, 1) && isAtLeast(n, 0, 10, 1);
+}
+function needsHttpMcpMigration(previousVersion, newVersion) {
+  const p = parseCoreSemver(previousVersion);
+  const n = parseCoreSemver(newVersion);
+  if (!p || !n) return false;
+  return isBelow(p, 0, 10, 70) && isAtLeast(n, 0, 10, 70);
 }
 function migrationNotesForUpgrade(previousVersion, newVersion) {
-  if (!needs0101Migration(previousVersion, newVersion)) return [];
-  return [
-    "Migration 0.10.1:",
-    "- pull helper resolves from dist/ + host vault-sync install",
-    "- run: skillwiki doctor",
-    "- if managed writes blocked: skillwiki sync journal list",
-    "- then: skillwiki sync journal clear-stale --dry-run",
-    "- legacy override: SKILLWIKI_VAULT_SYNC_PULL_HELPER=<path-to-wiki-pull-with-auto-resolve.sh>"
-  ];
+  const notes = [];
+  if (needs0101Migration(previousVersion, newVersion)) {
+    notes.push(
+      "Migration 0.10.1:",
+      "- pull helper resolves from dist/ + host vault-sync install",
+      "- run: skillwiki doctor",
+      "- if managed writes blocked: skillwiki sync journal list",
+      "- then: skillwiki sync journal clear-stale --dry-run",
+      "- legacy override: SKILLWIKI_VAULT_SYNC_PULL_HELPER=<path-to-wiki-pull-with-auto-resolve.sh>"
+    );
+  }
+  if (needsHttpMcpMigration(previousVersion, newVersion)) {
+    notes.push(
+      "Migration HTTP MCP:",
+      "- upgrade the plugin channel, then start a new session (plugin instructions do not hot-swap)",
+      "- run: skillwiki doctor --check-mcp",
+      "- frozen-leaf hosts write via HTTP MCP only; do not local-write raw/transcripts/ or vault git"
+    );
+  }
+  return notes;
 }
 function resolveGlobalSkillsRoot() {
   try {
@@ -10272,8 +10293,119 @@ async function postCommit(vault, exitCode) {
   clearLastOp(vault);
 }
 
+// src/commands/mcp-auth.ts
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "fs";
+
+// src/utils/mcp-token-map.ts
+import { createHash as createHash7, randomBytes } from "crypto";
+import yaml from "js-yaml";
+var HOST_ID_RE = /^[a-z][a-z0-9-]{1,62}$/;
+function parseMcpTokenMap(yamlText) {
+  const parsed = yaml.load(yamlText);
+  const map = /* @__PURE__ */ new Map();
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return map;
+  }
+  const records = parsed;
+  const nested = records.tokens;
+  const source = nested && typeof nested === "object" && !Array.isArray(nested) ? nested : records;
+  for (const [hash, hostId] of Object.entries(source)) {
+    if (hash === "tokens") continue;
+    if (typeof hostId !== "string" || hostId.length === 0) continue;
+    const normalized = hash.trim().toLowerCase();
+    if (!/^[0-9a-f]{64}$/.test(normalized)) continue;
+    map.set(normalized, hostId);
+  }
+  return map;
+}
+function generateHostBearer(rng) {
+  const bytes = (rng ?? (() => randomBytes(32)))();
+  const raw = bytes.toString("base64url");
+  const hashHex = createHash7("sha256").update(raw, "utf8").digest("hex");
+  return { raw, hashHex };
+}
+function appendHostHash(yamlText, hashHex, hostId) {
+  if (!HOST_ID_RE.test(hostId)) {
+    return { error: "INVALID_HOST_ID" };
+  }
+  const map = parseMcpTokenMap(yamlText);
+  const normalizedHash = hashHex.trim().toLowerCase();
+  if ([...map.values()].includes(hostId)) {
+    return { error: "DUPLICATE_HOST_ID" };
+  }
+  if (map.has(normalizedHash)) {
+    return { error: "DUPLICATE_HASH" };
+  }
+  return { yaml: yamlText.replace(/\s*$/, "") + `
+${normalizedHash}: ${hostId}
+` };
+}
+
+// src/commands/mcp-auth.ts
+function isEnoent(error) {
+  return error.code === "ENOENT";
+}
+function preflight(error) {
+  return { exitCode: ExitCode.PREFLIGHT_FAILED, result: err(error) };
+}
+async function runMcpAuthIssueHost(input) {
+  const isTty = input.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const readFile22 = input.readFile ?? readFileSync17;
+  const writeFile10 = input.writeFile ?? writeFileSync8;
+  const stderrWrite = input.stderrWrite ?? ((s) => {
+    process.stderr.write(s);
+  });
+  const write = Boolean(input.write);
+  const mapPath = input.mapPath;
+  const hostId = input.hostId;
+  if (!mapPath) return preflight("MAP_PATH_REQUIRED");
+  if (!HOST_ID_RE.test(hostId)) return preflight("INVALID_HOST_ID");
+  if (write && !isTty) return preflight("NO_TTY");
+  let yamlText = "";
+  try {
+    yamlText = readFile22(mapPath, "utf8");
+  } catch (error) {
+    if (!isEnoent(error)) throw error;
+  }
+  const map = parseMcpTokenMap(yamlText);
+  if ([...map.values()].includes(hostId)) return preflight("DUPLICATE_HOST_ID");
+  if (!write) {
+    return {
+      exitCode: ExitCode.OK,
+      result: ok({
+        host_id: hostId,
+        hash_prefix: "",
+        map_path: mapPath,
+        wrote: false
+      })
+    };
+  }
+  const { raw, hashHex } = generateHostBearer(input.rng);
+  const appended = appendHostHash(yamlText, hashHex, hostId);
+  if ("error" in appended) return preflight(appended.error);
+  try {
+    writeFile10(mapPath, appended.yaml, { encoding: "utf8", mode: 416 });
+  } catch (error) {
+    if (isEnoent(error)) {
+      return { exitCode: ExitCode.FILE_NOT_FOUND, result: err("FILE_NOT_FOUND") };
+    }
+    throw error;
+  }
+  stderrWrite(`issued host_id=${hostId} copy once: ${raw}
+`);
+  return {
+    exitCode: ExitCode.OK,
+    result: ok({
+      host_id: hostId,
+      hash_prefix: hashHex.slice(0, 8),
+      map_path: mapPath,
+      wrote: true
+    })
+  };
+}
+
 // src/commands/write-preflight.ts
-import { existsSync as existsSync15, readFileSync as readFileSync17, statSync as statSync5 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync18, statSync as statSync5 } from "fs";
 async function runWritePreflightCommand(input) {
   if (!existsSync15(input.vault) || !statSync5(input.vault).isDirectory()) {
     return {
@@ -10289,7 +10421,7 @@ async function runWritePreflightCommand(input) {
         result: err("FILE_NOT_FOUND", { path: input.priorArtifactFile })
       };
     }
-    priorText = readFileSync17(input.priorArtifactFile, "utf8");
+    priorText = readFileSync18(input.priorArtifactFile, "utf8");
   }
   const checkList = input.checks ? input.checks.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const result = runWritePreflight({
@@ -10410,7 +10542,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-PUEJOXJO.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-LSG2Y24X.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -11043,13 +11175,14 @@ configCmd.command("get <key>").description("print the value of a config key").ac
 configCmd.command("set <key> <value>").description("set a config key value").action(async (key, value) => emit(await runConfigSet({ key, value, home: process.env.HOME ?? "" })));
 configCmd.command("list").option("--profiles", "show wiki profiles summary", false).description("list all config key=value pairs").action(async (opts) => emit(await runConfigList({ home: process.env.HOME ?? "", profiles: !!opts.profiles })));
 configCmd.command("path").description("print the config file path").action(async () => emit(await runConfigPath({ home: process.env.HOME ?? "" })));
-program.command("doctor").description("diagnose skillwiki setup issues").option("--check-snapshotter", "SSH-probe fleet snapshotter (short timeout)", false).action(async (opts) => emit(await runDoctor({
+program.command("doctor").description("diagnose skillwiki setup issues").option("--check-snapshotter", "SSH-probe fleet snapshotter (short timeout)", false).option("--check-mcp", "live-handshake HTTP MCP initialize + tools/list (network)", false).action(async (opts) => emit(await runDoctor({
   home: process.env.HOME ?? "",
   envValue: process.env.WIKI_PATH,
   argv: process.argv,
   currentVersion: pkg.version,
   cwd: process.cwd(),
-  checkSnapshotter: !!opts.checkSnapshotter
+  checkSnapshotter: !!opts.checkSnapshotter,
+  checkMcp: !!opts.checkMcp
 })));
 program.command("status [vault]").description("output vault diagnostics").option("--wiki <name>", "wiki profile name").action(async (vault, opts) => {
   const v = await resolveVaultArg(vault, opts.wiki);
@@ -11634,6 +11767,15 @@ vectorsCmd.command("prune-page [vault]").description("prune deleted pages from t
 program.command("mcp").description("start stdio Model Context Protocol server (read-only vault tools)").action(async () => {
   await runSkillwikiMcpStdio();
 });
+var mcpAuthCmd = program.command("mcp-auth").description("attended HTTP MCP host-id bearer issuance (metal)");
+mcpAuthCmd.command("issue-host").description("append a host-id hash to the metal map; print raw once on a TTY").requiredOption("--host-id <id>", "host identity to bind").option("--map <path>", "hash map file (defaults to SKILLWIKI_MCP_TOKEN_MAP)").option("--write", "append the hash (default is dry-run)", false).action(async (opts) => {
+  const mapPath = opts.map || process.env.SKILLWIKI_MCP_TOKEN_MAP || "";
+  emit(await runMcpAuthIssueHost({
+    hostId: String(opts.hostId),
+    mapPath,
+    write: !!opts.write
+  }));
+});
 for (const w of getDeprecatedWarnings(process.env.HOME ?? "")) {
   process.stderr.write(w + "\n");
 }

package/dist/{managed-write-preflight-PUEJOXJO.js → managed-write-preflight-LSG2Y24X.js}

@@ -6,7 +6,7 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-R5SDVKHS.js";
+} from "./chunk-5XT6MBWA.js";
 import "./chunk-BPJ5KWIT.js";
 import "./chunk-OMO45AHI.js";
 import "./chunk-HJ4ALQG6.js";

package/dist/skillwiki-mcp.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-YKVJ2A3O.js";
+} from "./chunk-CLF6DZ6C.js";
 import "./chunk-7I2TPIV5.js";
 import "./chunk-KFEOMMWK.js";
-import "./chunk-R5SDVKHS.js";
+import "./chunk-5XT6MBWA.js";
 import "./chunk-BPJ5KWIT.js";
 import "./chunk-NPTIYO2S.js";
 import "./chunk-OMO45AHI.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.73",
+  "version": "0.10.76",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.73",
+  "version": "0.10.76",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.73",
+  "version": "0.10.76",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 21 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.73",
+  "version": "0.10.76",
   "description": "Project-aware Karpathy-style knowledge base: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"

package/skills/agents/proj-work.md

@@ -21,10 +21,15 @@ You are a project work item manager specializing in creating and executing work
 
 **Execution Process:**
 
-If `$VAULT/.WIKI_GIT_FROZEN` exists after `skillwiki path`: do not create or mutate work folders; do not `page publish` or git commit. Capture a close note via HTTP MCP `wiki_capture` or STOP. Work-item close waits unpublished Tier 2 (`wiki_workitem_write`). Reads of existing folders are allowed.
+If `$VAULT/.WIKI_GIT_FROZEN` exists after `skillwiki path`:
+- Existing work folder reads are allowed.
+- Git add/commit/push and wiki-sync remain **fail closed**.
+- **If live MCP tools include `wiki_workitem_write`**: create, mutate, or close work items via MCP `wiki_workitem_write` (using CAS base_sha256). Do not write local files in `~/wiki`.
+- **If live MCP tools include `wiki_page_publish`**: publish typed pages via MCP `wiki_page_publish` CAS.
+- **If those tools are absent**: capture a close note via HTTP MCP `wiki_capture` or STOP. Do not local-write.
 
 ### Creating a New Work Item
-1. **Resolve vault.** Run `skillwiki path`. If `.WIKI_GIT_FROZEN` exists, STOP (see freeze rule above).
+1. **Resolve vault.** Run `skillwiki path`. If `.WIKI_GIT_FROZEN` exists, follow the freeze rule above (MCP `wiki_workitem_write` when advertised; otherwise STOP). Do not local-create.
 2. **Determine slug and kind.** From task prompt: kind (`feature` | `issue` | `refactor` | `decision`) and work slug.
 3. **Create folder.** `projects/{slug}/work/YYYY-MM-DD-{work-slug}/`.
 4. **Write spec.md.** Frontmatter with kind, status=planned, project wikilink. Body with context and scope.
@@ -55,13 +60,14 @@ Return:
 - Log entries appended
 
 **Stop Conditions:**
-- `$VAULT/.WIKI_GIT_FROZEN` exists and the task would create, mutate, or close a work item
+- `$VAULT/.WIKI_GIT_FROZEN` exists and the task would create, mutate, or close a work item when `wiki_workitem_write` is absent from live MCP tools
 - `validate` non-zero
 - Conflicting work folder name
 - No project context and no `playground` fallback
 
 **Forbidden:**
-- Creating or mutating work items on a vault that has `.WIKI_GIT_FROZEN`
+- Creating or mutating local work items on a vault that has `.WIKI_GIT_FROZEN` (use MCP `wiki_workitem_write` when advertised)
+- `git add` / `git commit` / `git push` on a vault that has `.WIKI_GIT_FROZEN`
 - Writing spec/plan files outside the work folder
 - Marking `status: completed` without a `completed:` date
 - Accepting tasks.md DONE labels without independent disk verification

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.73",
+  "version": "0.10.76",
   "private": true,
   "files": [
     "wiki-*",

package/skills/proj-work/SKILL.md

@@ -33,9 +33,10 @@ Standard four + project context (project README, last ~5 work logs).
 After `skillwiki path`, if `$VAULT/.WIKI_GIT_FROZEN` exists:
 
 - **Reads** of existing work folders are allowed.
-- **Do not** create or mutate `projects/*/work/**`, `knowledge.md`, or run `skillwiki page publish` on this leaf.
-- **Do not** `git commit` / `wiki-sync` push to “close” the item.
-- Work-item close is unpublished until Tier 2 (`wiki_workitem_write` / `wiki_page_publish`). If the user asked to close or complete work, capture a note via HTTP MCP `wiki_capture` (`kind: note` or `task`) and STOP. Do not local-write the work folder.
+- **Git fail-closed:** Git add/commit/push / `wiki-sync`: still **fail closed**. GitHub is sg01 `wiki-snapshot`.
+- **If the live MCP tool list includes `wiki_workitem_write`**: create, mutate, or close work items via MCP `wiki_workitem_write`. Read current bytes (`wiki_read_page` sha256 or local file hash), pass `path`, `content`, `base_sha256`. On `FILE_CHANGED`, re-read and retry once. Never local-write `~/wiki`.
+- **If the live MCP tool list includes `wiki_page_publish`**: publish typed Layer-2 pages via MCP `wiki_page_publish` with the same CAS. Do not run local `skillwiki page publish` on the frozen leaf.
+- **If those tools are absent** (daemon still captures-only): capture a close note via HTTP MCP `wiki_capture` (`kind: note` or `task`) or STOP. Do not local-write. Do not claim the tools exist.
 
 ## Executing an Existing Work Item
 
@@ -99,12 +100,13 @@ Rules:
 - **Re-marking without doing**: do not simply re-write tasks.md to say DONE without applying the corresponding fix. The next session will find the same gap.
 
 ## Stop conditions
-- `$VAULT/.WIKI_GIT_FROZEN` exists and the user asked to create, mutate, or close a work item — capture via `wiki_capture` or STOP; do not local-write.
+- `$VAULT/.WIKI_GIT_FROZEN` exists and the user asked to create, mutate, or close a work item when `wiki_workitem_write` is absent from the live MCP tool list — capture via `wiki_capture` or STOP; do not local-write.
 - `validate` non-zero.
 - Conflicting work folder name.
 
 ## Forbidden
-- Creating or mutating work items on a vault that has `.WIKI_GIT_FROZEN`.
+- Creating or mutating local work items on a vault that has `.WIKI_GIT_FROZEN` (use MCP `wiki_workitem_write` when advertised).
+- `git add` / `git commit` / `git push` on a vault that has `.WIKI_GIT_FROZEN`.
 - Writing spec/plan files outside the work folder.
 - Marking `status: completed` without a `completed:` date.
 - Accepting tasks.md status labels without independent disk verification.

package/skills/skills/proj-work/SKILL.md

@@ -33,9 +33,10 @@ Standard four + project context (project README, last ~5 work logs).
 After `skillwiki path`, if `$VAULT/.WIKI_GIT_FROZEN` exists:
 
 - **Reads** of existing work folders are allowed.
-- **Do not** create or mutate `projects/*/work/**`, `knowledge.md`, or run `skillwiki page publish` on this leaf.
-- **Do not** `git commit` / `wiki-sync` push to “close” the item.
-- Work-item close is unpublished until Tier 2 (`wiki_workitem_write` / `wiki_page_publish`). If the user asked to close or complete work, capture a note via HTTP MCP `wiki_capture` (`kind: note` or `task`) and STOP. Do not local-write the work folder.
+- **Git fail-closed:** Git add/commit/push / `wiki-sync`: still **fail closed**. GitHub is sg01 `wiki-snapshot`.
+- **If the live MCP tool list includes `wiki_workitem_write`**: create, mutate, or close work items via MCP `wiki_workitem_write`. Read current bytes (`wiki_read_page` sha256 or local file hash), pass `path`, `content`, `base_sha256`. On `FILE_CHANGED`, re-read and retry once. Never local-write `~/wiki`.
+- **If the live MCP tool list includes `wiki_page_publish`**: publish typed Layer-2 pages via MCP `wiki_page_publish` with the same CAS. Do not run local `skillwiki page publish` on the frozen leaf.
+- **If those tools are absent** (daemon still captures-only): capture a close note via HTTP MCP `wiki_capture` (`kind: note` or `task`) or STOP. Do not local-write. Do not claim the tools exist.
 
 ## Executing an Existing Work Item
 
@@ -99,12 +100,13 @@ Rules:
 - **Re-marking without doing**: do not simply re-write tasks.md to say DONE without applying the corresponding fix. The next session will find the same gap.
 
 ## Stop conditions
-- `$VAULT/.WIKI_GIT_FROZEN` exists and the user asked to create, mutate, or close a work item — capture via `wiki_capture` or STOP; do not local-write.
+- `$VAULT/.WIKI_GIT_FROZEN` exists and the user asked to create, mutate, or close a work item when `wiki_workitem_write` is absent from the live MCP tool list — capture via `wiki_capture` or STOP; do not local-write.
 - `validate` non-zero.
 - Conflicting work folder name.
 
 ## Forbidden
-- Creating or mutating work items on a vault that has `.WIKI_GIT_FROZEN`.
+- Creating or mutating local work items on a vault that has `.WIKI_GIT_FROZEN` (use MCP `wiki_workitem_write` when advertised).
+- `git add` / `git commit` / `git push` on a vault that has `.WIKI_GIT_FROZEN`.
 - Writing spec/plan files outside the work folder.
 - Marking `status: completed` without a `completed:` date.
 - Accepting tasks.md status labels without independent disk verification.

package/skills/skills/skillwiki-mcp/SKILL.md

@@ -16,19 +16,28 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
 - **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. It pins `https://wiki.karldigi.dev/mcp`. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
+- A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). The client pastes the printed value into process env or host Configure. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
+- First-run order: install plugin/CLI → operator issues on metal → paste into process env or Configure → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
 - `in_sync` means the probe has a usable URL/token decision.
 - A 401 is an MCP handshake failure, not a readiness-probe status. Report that the token is missing or rejected and stop.
 - Grok SessionStart cannot inject the parent MCP environment. A restart cannot supply a missing token.
 - Never auto-source `mcp.env` or auto-write `~/.cursor/mcp.json`, Grok `config.toml`, or `mcp.env`.
 - Never print the bearer token.
 
-## Writes (captures-only)
+## Upgrade / migration
+
+Remotes still on a pre-HTTP-MCP plugin or CLI must upgrade the plugin channel (and the CLI where that host has one), then start a **new session** — plugin instructions do not hot-swap. The operator check is the same `skillwiki doctor` as metal: default rows cover URL/auth presence and frozen-leaf write-path; `skillwiki doctor --check-mcp` does the live initialize handshake. Do not invent a second admin skill or HTTP MCP admin tool. `wiki_status` remains daemon health only.
+
+## Writes
 
 On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/` or `log.md` as local files.
 
 1. Call MCP `wiki_capture` with `kind` (`task` | `idea` | `bug` | `note`), `project`, `title`, and `content`. Optional `agent_note`.
 2. Call MCP `wiki_log_append` when a structural `log.md` line is needed. Pass append-only `content`. Do not rewrite log history.
-3. Write surface is captures-only. Do not call unpublished Tier 2 tools (`wiki_workitem_write`, `wiki_page_publish`). Those tools are not on the live daemon. Work-item close is not available from this MCP. Do not `git commit` / `wiki-push` against `~/wiki` for these captures. If `$VAULT/.WIKI_GIT_FROZEN` exists, that freeze is the reason nearby agents cannot close wiki work until Tier 2 ships.
+3. **Feature-detect work-item and page-publish tools**:
+   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once.
+   - When the server advertises `wiki_page_publish`: use it to publish typed Layer-2 pages (`entities/`, `concepts/`, `comparisons/`, `queries/`, `meta/`) using the same CAS protocol.
+   - When those tools are **absent** from the live tool list (e.g. server is captures-only): do not call them or claim they exist. If `$VAULT/.WIKI_GIT_FROZEN` exists, fall back to capturing a close note via `wiki_capture` or STOP. Work-item close remains unavailable on the frozen leaf without `wiki_workitem_write`. Do not `git commit` / `wiki-push` against `~/wiki`.
 
 ## Reads
 

package/skills/skills/using-skillwiki/SKILL.md

@@ -170,8 +170,9 @@ If the vault has `.WIKI_GIT_FROZEN`:
 | Intent | Allowed? | How |
 |---|---|---|
 | Capture note/idea/bug/task | Yes | HTTP MCP `wiki_capture` / `wiki_log_append` |
-| Close or mutate a work item (`projects/*/work/**`, `knowledge.md`) | **No** until Tier 2 | Do not `page publish` or git commit. Capture a close note via MCP or STOP. |
-| `wiki-sync` push/commit | **No** | GitHub is sg01 `wiki-snapshot`. |
+| Close or mutate a work item (`projects/*/work/**`, `knowledge.md`) | Conditional | If live MCP tools include `wiki_workitem_write`, mutate/close via MCP CAS; if absent, capture a close note via MCP `wiki_capture` or STOP. Never local-write. |
+| Publish typed Layer-2 page (`concepts/`, `queries/`, etc.) | Conditional | If live MCP tools include `wiki_page_publish`, publish via MCP CAS; if absent, STOP. Do not run local `skillwiki page publish`. |
+| `wiki-sync` push/commit | **No** | Git fail-closed. GitHub is sg01 `wiki-snapshot`. |
 | Read local `~/wiki` | Yes | Mirror reads only |
 | `/wiki-add-task <text>` | You're in an interactive session on an authoring host | Creates `raw/transcripts/YYYY-MM-DD-{type}-{slug}.md` with ad-hoc capture frontmatter |
 | Filesystem drop | You're NOT in a Claude session (Obsidian, editor, sync) on an authoring host | Create a new `.md` file in `raw/transcripts/` — dev-loop discovers it on next cycle; do not edit it after capture |
@@ -241,11 +242,11 @@ for code changes.
 
 ## CLI Backbone
 All skills are backed by the `skillwiki` CLI — a deterministic tool with no LLM calls. It handles path resolution, config management, validation, health reporting, and linting. Skills invoke it via Bash for the mechanical parts and use the active agent for the creative parts.
-Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`.
+Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`, `mcp-auth`.
 Optional read-only MCP (`skillwiki mcp`) exposes pending/compile/review list tools. Do not use MCP for compile claim, publish, or review writes.
 `skillwiki claim` binds a transcript to a work item only through an exact `raw/transcripts/...` path in `source:` / `sources:` / `closes:`. A `--project` that contradicts the capture's explicit project is rejected. `skillwiki stale --project` uses exact normalized slugs, not substring matching. `skillwiki claims audit` is the read-only integrity report for duplicate, malformed, dangling, cross-project, and unbacked claims; it never rewrites captures or work items.
 
-Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only. Run `skillwiki config list` to see current configuration.
+Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
 
 ## Runtime Host Context and Fleet Freshness
 Resolve the active project vault with `skillwiki path` first. Then pass that exact path to `skillwiki --human fleet context <vault>` for host identity and safety guidance. `fleet context` is authoritative for host identity. It overrides stale injected SessionStart context, remembered workspace context, and prior conversation summaries. `fleet context` is local and network-free; it reports `identity_status`, resolver trace, warnings, and the fact that remote freshness was not checked.

package/skills/skills/wiki-lint/SKILL.md

@@ -11,13 +11,13 @@ Standard four reads.
 ## Steps
 0. Resolve vault: `skillwiki path` (record source for context).
 - **CRITICAL**: Verify the correct vault when the user has multiple wiki instances (e.g., ~/wiki vs ~/wiki-fin). User may explicitly specify which vault to target — confirm before destructive operations.
-1. For a whole-system health report, run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail`. Read the JSON envelope from stdout or the report file. Treat `skillwiki doctor` as setup/runtime diagnostics only, not a vault-content health report.
+1. For a whole-system health report, run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail`. Read the JSON envelope from stdout or the report file. Treat `skillwiki doctor` as setup/runtime diagnostics only, not a vault-content health report. HTTP MCP URL, pin lag, handshake, and frozen-leaf write-path belong to `skillwiki doctor` (pass `--check-mcp` for the live handshake). Do not use this skill for client/plugin fleet upgrades.
 2. For lint-only maintenance, run `skillwiki lint <vault> --summary`. This returns bounded bucket counts, capped examples, and `details_command` hints without full item arrays.
 3. Drill into important buckets with `skillwiki lint <vault> --only <bucket>` when examples are insufficient for remediation.
 4. Reason over findings; present grouped by severity with concrete suggested actions per kind. If the CLI was recently updated with new lint checks, re-running lint on the full vault may flag pre-existing pages that predate the new rule — treat these as legitimate findings, not false positives.
 5. Treat `sensitive_content` as a security error. Drill down with `skillwiki lint <vault> --only sensitive_content --human`; never print the secret value. Raw findings are report/quarantine-only: `--fix` must not redact, rewrite, or recompute existing raw evidence. Maintained-page repairs may proceed only through their approved write workflow.
 6. If `log_rotate_needed` is present and the user consents, run `skillwiki log-rotate <vault> --apply`. Otherwise leave alone.
-7. **Post-migration verification**: If the user recently migrated content (e.g., moved entity/concept pages to another vault), re-run `skillwiki lint <vault> --summary` and verify that broken_wikilinks count decreased. Remaining broken links for migrated content indicate pages still referencing the moved files — these should be cleaned up (remove citations or migrate the referencing pages too).
+7. **Post-migration verification**: If the user recently migrated **vault content** (e.g., moved entity/concept pages to another vault), re-run `skillwiki lint <vault> --summary` and verify that broken_wikilinks count decreased. Remaining broken links for migrated content indicate pages still referencing the moved files — these should be cleaned up (remove citations or migrate the referencing pages too). This step is content moves only — not HTTP MCP client/plugin upgrades (those use `skillwiki doctor --check-mcp`).
 8. Append a `log.md` entry summarizing lint counts only when the user asked to record the maintenance result. Do not log routine `health` reports by default.
 ## Stop conditions
 None — lint reports all findings even on per-page errors.

package/skills/skills/wiki-sync/SKILL.md

@@ -20,7 +20,7 @@ If `$VAULT/.WIKI_GIT_FROZEN` exists, **fail closed** before any stash, commit, p
 
 - Do **not** `git add`, `git commit`, `git pull`, `git push`, or `skillwiki sync push`.
 - Captures go through HTTP MCP `wiki_capture` / `wiki_log_append`.
-- Closing or mutating work items is unpublished until Tier 2 (`wiki_workitem_write` / `wiki_page_publish`). Capture a close note via MCP or STOP.
+- Work items mutate/close via MCP `wiki_workitem_write` when advertised by the live MCP server; if absent, capture a close note via MCP `wiki_capture` or STOP. Never local-write or git-commit on the frozen leaf.
 - GitHub promotion is sg01 `wiki-snapshot`, not this leaf.
 - Report the freeze marker and stop. Do not treat dirty `~/wiki` as a sync job.
 
@@ -220,7 +220,7 @@ High-signal safety rule:
 Some older deployments separated a cloud-backed live vault from a Git snapshot worktree. That architecture still exists on protected snapshotters, but the snapshot worktree is **pipeline-internal**. Historical recipes that rsync into the worktree, reset it hard to origin/main, or run snapshot shell scripts by hand are obsolete and must not be copied.
 
 ## Stop conditions
-- `$VAULT/.WIKI_GIT_FROZEN` exists — frozen leaf; refuse git close/sync. Captures via HTTP MCP; work-item close waits Tier 2.
+- `$VAULT/.WIKI_GIT_FROZEN` exists — frozen leaf; refuse git close/sync. Captures via HTTP MCP; work-item close uses MCP `wiki_workitem_write` if advertised, else fallback capture or STOP.
 - `skillwiki sync status` reports `not_a_repo` — the vault is not a git repository. On protected snapshotters this is expected for the FUSE live path; do not switch to `/root/wiki-git` to force a push.
 - Lint errors are found before a push — do not push until resolved.
 - `git push` or `git pull` fails with a network error — report and stop.

package/skills/skillwiki-mcp/SKILL.md

@@ -16,19 +16,28 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
 - **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. It pins `https://wiki.karldigi.dev/mcp`. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
+- A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). The client pastes the printed value into process env or host Configure. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
+- First-run order: install plugin/CLI → operator issues on metal → paste into process env or Configure → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
 - `in_sync` means the probe has a usable URL/token decision.
 - A 401 is an MCP handshake failure, not a readiness-probe status. Report that the token is missing or rejected and stop.
 - Grok SessionStart cannot inject the parent MCP environment. A restart cannot supply a missing token.
 - Never auto-source `mcp.env` or auto-write `~/.cursor/mcp.json`, Grok `config.toml`, or `mcp.env`.
 - Never print the bearer token.
 
-## Writes (captures-only)
+## Upgrade / migration
+
+Remotes still on a pre-HTTP-MCP plugin or CLI must upgrade the plugin channel (and the CLI where that host has one), then start a **new session** — plugin instructions do not hot-swap. The operator check is the same `skillwiki doctor` as metal: default rows cover URL/auth presence and frozen-leaf write-path; `skillwiki doctor --check-mcp` does the live initialize handshake. Do not invent a second admin skill or HTTP MCP admin tool. `wiki_status` remains daemon health only.
+
+## Writes
 
 On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/` or `log.md` as local files.
 
 1. Call MCP `wiki_capture` with `kind` (`task` | `idea` | `bug` | `note`), `project`, `title`, and `content`. Optional `agent_note`.
 2. Call MCP `wiki_log_append` when a structural `log.md` line is needed. Pass append-only `content`. Do not rewrite log history.
-3. Write surface is captures-only. Do not call unpublished Tier 2 tools (`wiki_workitem_write`, `wiki_page_publish`). Those tools are not on the live daemon. Work-item close is not available from this MCP. Do not `git commit` / `wiki-push` against `~/wiki` for these captures. If `$VAULT/.WIKI_GIT_FROZEN` exists, that freeze is the reason nearby agents cannot close wiki work until Tier 2 ships.
+3. **Feature-detect work-item and page-publish tools**:
+   - When the server advertises `wiki_workitem_write`: use it to create, mutate, or close work items under `projects/<slug>/work/**` or update `projects/<slug>/knowledge.md`. Pass `path`, `content`, and `base_sha256` of existing bytes (from `wiki_read_page` or local mirror). On `FILE_CHANGED`, re-read and retry once.
+   - When the server advertises `wiki_page_publish`: use it to publish typed Layer-2 pages (`entities/`, `concepts/`, `comparisons/`, `queries/`, `meta/`) using the same CAS protocol.
+   - When those tools are **absent** from the live tool list (e.g. server is captures-only): do not call them or claim they exist. If `$VAULT/.WIKI_GIT_FROZEN` exists, fall back to capturing a close note via `wiki_capture` or STOP. Work-item close remains unavailable on the frozen leaf without `wiki_workitem_write`. Do not `git commit` / `wiki-push` against `~/wiki`.
 
 ## Reads
 

package/skills/using-skillwiki/SKILL.md

@@ -170,8 +170,9 @@ If the vault has `.WIKI_GIT_FROZEN`:
 | Intent | Allowed? | How |
 |---|---|---|
 | Capture note/idea/bug/task | Yes | HTTP MCP `wiki_capture` / `wiki_log_append` |
-| Close or mutate a work item (`projects/*/work/**`, `knowledge.md`) | **No** until Tier 2 | Do not `page publish` or git commit. Capture a close note via MCP or STOP. |
-| `wiki-sync` push/commit | **No** | GitHub is sg01 `wiki-snapshot`. |
+| Close or mutate a work item (`projects/*/work/**`, `knowledge.md`) | Conditional | If live MCP tools include `wiki_workitem_write`, mutate/close via MCP CAS; if absent, capture a close note via MCP `wiki_capture` or STOP. Never local-write. |
+| Publish typed Layer-2 page (`concepts/`, `queries/`, etc.) | Conditional | If live MCP tools include `wiki_page_publish`, publish via MCP CAS; if absent, STOP. Do not run local `skillwiki page publish`. |
+| `wiki-sync` push/commit | **No** | Git fail-closed. GitHub is sg01 `wiki-snapshot`. |
 | Read local `~/wiki` | Yes | Mirror reads only |
 | `/wiki-add-task <text>` | You're in an interactive session on an authoring host | Creates `raw/transcripts/YYYY-MM-DD-{type}-{slug}.md` with ad-hoc capture frontmatter |
 | Filesystem drop | You're NOT in a Claude session (Obsidian, editor, sync) on an authoring host | Create a new `.md` file in `raw/transcripts/` — dev-loop discovers it on next cycle; do not edit it after capture |
@@ -241,11 +242,11 @@ for code changes.
 
 ## CLI Backbone
 All skills are backed by the `skillwiki` CLI — a deterministic tool with no LLM calls. It handles path resolution, config management, validation, health reporting, and linting. Skills invoke it via Bash for the mechanical parts and use the active agent for the creative parts.
-Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`.
+Key CLI subcommands: `init`, `health`, `lint`, `config`, `doctor`, `path`, `lang`, `install`, `fleet context`, `fleet validate`, `graph build`, `query`, `vectors rebuild`, `vectors status`, `sources pending`, `sources compile`, `sources review`, `sources reviews`, `sources disposition`, `sources dispose`, `archive`, `remove`, `drift`, `dedup`, `compound`, `tag-sync`, `tag reconcile`, `page publish`, `sync status`, `seed`, `stale`, `claim`, `claims audit`, `observe`, `canvas generate`, `mcp`, `mcp-auth`.
 Optional read-only MCP (`skillwiki mcp`) exposes pending/compile/review list tools. Do not use MCP for compile claim, publish, or review writes.
 `skillwiki claim` binds a transcript to a work item only through an exact `raw/transcripts/...` path in `source:` / `sources:` / `closes:`. A `--project` that contradicts the capture's explicit project is rejected. `skillwiki stale --project` uses exact normalized slugs, not substring matching. `skillwiki claims audit` is the read-only integrity report for duplicate, malformed, dangling, cross-project, and unbacked claims; it never rewrites captures or work items.
 
-Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only. Run `skillwiki config list` to see current configuration.
+Run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail` for a bounded whole-system report that includes the nonblocking source-lifecycle backlog. Pending captures are informational and do not make health fail. Run `skillwiki lint <vault> --summary` for lint-only bucket counts with capped examples and details commands. Run `skillwiki doctor` to diagnose setup/runtime issues only, including HTTP MCP URL/auth presence and the frozen-leaf write path. Pass `--check-mcp` for a live initialize handshake and pin/tool-list lag; the default doctor path does not contact HTTP MCP. New hosts need an issued host-id bearer from metal `skillwiki mcp-auth issue-host` before handshake can pass. There is no second MCP admin skill. Run `skillwiki config list` to see current configuration.
 
 ## Runtime Host Context and Fleet Freshness
 Resolve the active project vault with `skillwiki path` first. Then pass that exact path to `skillwiki --human fleet context <vault>` for host identity and safety guidance. `fleet context` is authoritative for host identity. It overrides stale injected SessionStart context, remembered workspace context, and prior conversation summaries. `fleet context` is local and network-free; it reports `identity_status`, resolver trace, warnings, and the fact that remote freshness was not checked.

package/skills/wiki-lint/SKILL.md

@@ -11,13 +11,13 @@ Standard four reads.
 ## Steps
 0. Resolve vault: `skillwiki path` (record source for context).
 - **CRITICAL**: Verify the correct vault when the user has multiple wiki instances (e.g., ~/wiki vs ~/wiki-fin). User may explicitly specify which vault to target — confirm before destructive operations.
-1. For a whole-system health report, run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail`. Read the JSON envelope from stdout or the report file. Treat `skillwiki doctor` as setup/runtime diagnostics only, not a vault-content health report.
+1. For a whole-system health report, run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail`. Read the JSON envelope from stdout or the report file. Treat `skillwiki doctor` as setup/runtime diagnostics only, not a vault-content health report. HTTP MCP URL, pin lag, handshake, and frozen-leaf write-path belong to `skillwiki doctor` (pass `--check-mcp` for the live handshake). Do not use this skill for client/plugin fleet upgrades.
 2. For lint-only maintenance, run `skillwiki lint <vault> --summary`. This returns bounded bucket counts, capped examples, and `details_command` hints without full item arrays.
 3. Drill into important buckets with `skillwiki lint <vault> --only <bucket>` when examples are insufficient for remediation.
 4. Reason over findings; present grouped by severity with concrete suggested actions per kind. If the CLI was recently updated with new lint checks, re-running lint on the full vault may flag pre-existing pages that predate the new rule — treat these as legitimate findings, not false positives.
 5. Treat `sensitive_content` as a security error. Drill down with `skillwiki lint <vault> --only sensitive_content --human`; never print the secret value. Raw findings are report/quarantine-only: `--fix` must not redact, rewrite, or recompute existing raw evidence. Maintained-page repairs may proceed only through their approved write workflow.
 6. If `log_rotate_needed` is present and the user consents, run `skillwiki log-rotate <vault> --apply`. Otherwise leave alone.
-7. **Post-migration verification**: If the user recently migrated content (e.g., moved entity/concept pages to another vault), re-run `skillwiki lint <vault> --summary` and verify that broken_wikilinks count decreased. Remaining broken links for migrated content indicate pages still referencing the moved files — these should be cleaned up (remove citations or migrate the referencing pages too).
+7. **Post-migration verification**: If the user recently migrated **vault content** (e.g., moved entity/concept pages to another vault), re-run `skillwiki lint <vault> --summary` and verify that broken_wikilinks count decreased. Remaining broken links for migrated content indicate pages still referencing the moved files — these should be cleaned up (remove citations or migrate the referencing pages too). This step is content moves only — not HTTP MCP client/plugin upgrades (those use `skillwiki doctor --check-mcp`).
 8. Append a `log.md` entry summarizing lint counts only when the user asked to record the maintenance result. Do not log routine `health` reports by default.
 ## Stop conditions
 None — lint reports all findings even on per-page errors.