chore(memory): BDR-105 skill-catalog prune + 21st gate, LRN-175..178, BLK-023, EVAL-034

.claude/memory/decisions.md

@@ -126,6 +126,7 @@ rules:
 | BDR-102 | 2026-09-27 | agent-skills: no plugin, vendor 3 skills + build floor-guard + routing census + rest-api rule | accepted |
 | BDR-103 | 2026-09-27 | 6-repo review: 5 verdicts, 3 criteria (grep-verified coverage, per-session cost, doctrine conflict); stars decided nothing | accepted |
 | BDR-104 | 2026-09-28 | MengTo motion pack: vendor 5 scroll skills pinned via shared lib/vendor-skills.sh + build personal skill site-motion; 17 skipped | accepted |
+| BDR-105 | 2026-09-28 | skill-catalog prune: 9 gstack out via GSTACK_REMOVED, full ⊇ every profile, max = everything, brightdata + frontend-design plugin off, security-guidance Stop review off, design gate asks `21st login` and waits | accepted |
 
 ---
 
@@ -1309,3 +1310,12 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Reference**: commits 2a1ad17 (helper + vendoring), ba14b5e (site-motion); contracts `.claude/tasks/contracts/2026-09-27-{mengto-vendor,site-motion-skill}-0002.md`; gates MET, verifiers CONFORME after 3 re-dispatches (frontmatter shape, refresh convention, security env override + traversal), security PASS ×2, `make test` 36 suites green minus 2 pre-existing T16a. Links [[BDR-103]] [[BDR-102]] [[LRN-141]] [[LRN-174]] [[EVAL-033]].
 - **Amendment 2026-09-28**: the two LOW caveats closed on user ask (415b44e): `re.fullmatch` guard, `commit`/`source`/`path` validated before URL construction, 4 more hermetic cases (12). Security PASS, verifier CONFORME 9/9.
 - **Amendment 2026-09-28 (doctor)**: `make doctor` now checks every vendored external (6394fa7, feature/doctor-vendored-skills): lock files present, symlink per active profile, parked ≠ failed, hints. Lib sourceable for the hermetic suite (11 cases); doctor mirrors `active_profile()` instead of sourcing profile.sh (its main runs on source). Security: lock shape-validated, allowlists on profile/item names. Closes the gap that emil/frontend-design/motion had since their install.
+
+## BDR-105 — skill-catalog prune: 9 gstack removed, `full` ⊇ every profile, `max` = everything, two plugins off, Stop review off, 21st sign-in gate
+- **Date**: 2026-09-28
+- **Status**: accepted, feature/skill-catalog-prune, merged to develop 2026-09-28 (user go "merge le tout")
+- **Decision**: (1) `lib/gstack-removed.sh` = single denylist (ship, land-and-deploy, setup-deploy, autoplan, context-save, learn, careful, guard, design-shotgun): in no profile, `max` included; `profile.sh gstack on` and `toggle-external enable gstack` skip them. (2) User rule: `full` (default) carries everything every other profile carries, one allowlisted exception pr-review-toolkit; `max` (`# SUPERSET-OF: full`) = full + parked (make-pdf, diagram, 21st-ai/ui-explore/ui-review) + pr-review-toolkit. 21st trio out of full/web/web-full/design. `lib/tests/profile-census.test.sh` locks the three invariants live + baseline/mutant fixtures. (3) Live plugin state: brightdata-plugin@synced `false`, frontend-design@claude-plugins-official uninstalled (byte-dup of the managed skills-external copy). (4) settings.json `env.ENABLE_STOP_REVIEW=0`: security-guidance keeps regex + commit/push agentic review, loses the Opus call per code-changing turn. (5) `lib/gstack-links.sh` builds the whole helper tree under `~/.claude/skills/gstack/` (83 hardcoded paths), one lib for link.sh, install-plugins.sh, update-all.sh; `lib/doctor-skills.sh` counts through symlinks with the census parser. (6) Routing: Ship/PR → ship-feature, never gstack ship. (7) Design gate exit 12 `SIGN-IN REQUIRED`: installed-but-signed-out 21st → ask `! 21st login`, end turn, re-run; explicit "proceed without 21st" = only skip; unknown whoami → 11 with diagnostic.
+- **Why**: 5-analyzer audit over 150 skills / 53.5k chars of descriptions; harness shows ~19k, least-invoked lose theirs → 78 name-only this session ([[LRN-175]]). ship base = origin/HEAD = main on Gitea; land-and-deploy `gh pr merge --squash` + deploy; autoplan/make-pdf/diagram/careful/guard/freeze hardcode paths only bin + browse/dist linked ([[LRN-177]]); context-save without restore; brightdata keyless + `bright-data-mcp` orders WebFetch replaced; security-guidance 0 findings / 6 days, 1 FP ([[EVAL-024]]); doctor undercount ×6. 21st CLI `Not logged in` → user: ask and wait, not skip.
+- **Alternatives rejected**: rm symlinks by hand (set/reset re-materialize, `gstack on` restores everything → denylist instead); per-skill toggles inside ui-ux-pro-max (all-or-nothing, unverified); drop superpowers in the same run (7 skills wired in ship-feature/init-project → tier 2, own branch); keep the 21st trio in design profiles (redundant with impeccable + ui-ux-pro-max, CLI signed out); raise `SLASH_COMMAND_TOOL_CHAR_BUDGET` (costs context, the opposite goal); keep the official frontend-design plugin and drop the copy (copy is profile-managed and gate-checked); shared 21st auth helper across 3 scripts (breaks 4 fixture suites, changes installer semantics — [[LRN-178]]); in-session `export TWENTYFIRST_TOKEN` remedy (env does not persist across tool calls).
+- **Caveats**: kept gstack skills still route to removed names in their upstream prose (Skill call fails, doctrine applies); helper tree links every top-level submodule entry (no SKILL.md exposed, asserted); security-guidance commit review quota unmeasured; doctor constants rebased on 2026-09-28 measures; `apply` is additive → other machines run `set full`, not `apply`.
+- **Reference**: f83f8f7 02b62f7 4c86d6d 729d715 (prune), bd3e525 132bcdf (21st gate); contracts `2026-09-28-skill-catalog-prune-0554` (18 criteria, oracles in `.oracles/`) and `2026-09-28-21st-signin-gate-1215` (7); plans r4 / r3 after 3 challengers + 1 confirmation each; GATE 0 MET, verifiers CONFORME (iter 2 / iter 1), security PASS ×2; 42 suites green minus 2 pre-existing T16a. Links [[BDR-030]] [[BDR-101]] [[BDR-093]] [[BDR-095]] [[BDR-080]] [[BDR-025]] [[BDR-070]] [[LRN-175]] [[LRN-176]] [[LRN-177]] [[LRN-178]] [[BLK-023]] [[EVAL-034]].