Merge chore/six-repo-review-notes into develop

# Conflicts:
#	.claude/memory/decisions.md
#	.claude/memory/journal.md
#	.claude/tasks/TODO.md

.claude/memory/decisions.md

@@ -124,6 +124,7 @@ rules:
 | BDR-100 | 2026-09-24 | Guardrail evasion and partial rule changes get mechanisms, not lessons: refusal ends the attempt, citers census in make test | accepted |
 | BDR-101 | 2026-09-25 | `full` = default profile: no selection ⇒ full in force, `reset` applies it, install applies it | accepted |
 | BDR-102 | 2026-09-27 | agent-skills: no plugin, vendor 3 skills + build floor-guard + routing census + rest-api rule | accepted |
+| BDR-103 | 2026-09-27 | 6-repo review: 5 verdicts, 3 criteria (grep-verified coverage, per-session cost, doctrine conflict); stars decided nothing | accepted |
 
 ---
 
@@ -1281,3 +1282,18 @@ Branch feature/user-writing-web-rules, UNMERGED (human gate).
 - **Caveats**: vendored prompts = third-party content loaded into sessions, the pin is the review point (security-auditor scanned: benign, no hidden Unicode); floor-guard waiver is self-service, WAIVED informational → security MEDIUM, design decision pending with user (require CLARIFICATIONS ack outside test fixtures?); floor-guard prints raw diff snippets a verifier reads (LOW, framing follow-up); update-all 7.3 failure branch leaves `.tmp` like emil (parity, not fixed); `make link` after merge to symlink the trio (user).
 - **Reference**: commits d28c45e (trio), 2b25cb4 (floor-guard), 409db51 (census), 1a8e6de (rest-api); contracts `.claude/tasks/contracts/2026-09-27-{agent-skills-vendor,floor-guard,skill-routing-census,rest-api-rule}-1525.md`; gates MET ×4, verifiers CONFORME ×4 (2 re-dispatches), security PASS ×2. Links [[BDR-100]] [[LRN-172]] [[LRN-173]] [[EVAL-032]]. Case 1 of the same review: ladder in doctrine, feature/yagni-ladder 9315c6c.
 - **Amendment 2026-09-27**: waiver policy strict, user go: `WAIVED` outside a test file = gap unless the contract's CLARIFICATIONS names file + reason (verifier STEP 3, loop doc). Commit 6617889. Closes the security MEDIUM caveat above.
+## BDR-103 — 6-repo review: 5 verdicts, 3 criteria; stars decided nothing
+- **Date**: 2026-09-27
+- **Status**: accepted, chore/six-repo-review-notes, merge on user go 2026-09-27
+- **Decision** (user-approved case by case, order = layer touched per turn → orthogonal):
+  | repo | stars | verdict | one-line why |
+  |---|---|---|---|
+  | ponytail + chisle | 146.7k / 566 | no plugin; ordered YAGNI ladder + `shortcut:` marker into § Code style (feature/yagni-ladder) | per-turn + per-subagent injection, prose rules vs writing-style.md, caveman purge precedent, rtk covers the input axis |
+  | addyosmani/agent-skills | 99.4k | no plugin; vendor 3 skills, build floor-guard + routing census, distil rest-api rule ([[BDR-102]]) | 20/25 covered, 1.8k tok/session, /spec /review /ship collide, trunk-based + one-version vs doctrine, second router |
+  | ibelick/ui-skills | 9.2k | nothing installed; 14 micro-rule lines in rules/web-building.md | CLI/MCP = curl of raw SKILL.md, third router, baseline-ui stack mandates vs Astro-first; registry of 36 third-party skills (mengto motion pack) NOT evaluated |
+  | reticlehq/reticle | 898 | parked, 4-step pilot recipe in TODO | only real capability gap (store state, verdict with file:line, replayable flows, CI gate); FSL server, PostHog telemetry, per-project build instrumentation, skill auto-runs `init` |
+  | OmniRoute | 70.6k | rejected, no recipe | subscription cannot pass a keyed gateway; fail-open guardrails, default JWT secret, Socket.dev block on 3.8.5, JA3/JA4 spoofing + free-tier pools |
+- **Criteria that decided every case**: (1) coverage verified by grep on local assets (skills, agents, rules, archetypes), never from the README; (2) permanent per-session cost (descriptions, hooks, MCP schemas) against the share of novelty; (3) conflict with doctrine (gitflow, versioned APIs, Astro-first, ask-don't-guess, fail-closed). Stars decided nothing: 566-star chisle beat 146.7k-star ponytail on method; 898-star reticle is the only real capability.
+- **Alternatives rejected**: install-then-prune (sunk cost, [[BDR-047]] ECC lesson); one bulk verdict (user wanted one case per turn, each with a build-vs-install call); building reticle's engine (1 286 server files).
+- **Caveats**: borrowed prompts change upstream with no diff, the pin is the review point; do not re-audit these six expecting more; mengto motion pack from the ui-skills registry is the open follow-up if site-level choreography (GSAP/ScrollTrigger, WebGL hero, masked reveals) proves thin locally.
+- **Reference**: branches feature/yagni-ladder (9315c6c, de7371d), feature/agent-skills-borrow (d28c45e 2b25cb4 409db51 1a8e6de 7401383 6617889 d71f3a7), feature/web-building-microrules (a2e654d 5a27372), chore/six-repo-review-notes (da35cde 197225a). Links [[BDR-102]] [[LRN-172]] [[LRN-173]] [[EVAL-032]] [[BDR-047]] [[BDR-006]].

.claude/memory/journal.md

@@ -523,3 +523,5 @@ rules:
 - Case 3 (ui-skills 9.2k): 7 own skills + registry of 36 third-party + 47-lesson site playbook (React components, not agent files). Verdict given: extend rules/web-building.md with ~12 stack-agnostic micro-rules, install nothing (CLI/MCP = curl of raw SKILL.md, third router, baseline-ui stack mandates vs Astro doctrine). Awaiting user; case 4 reticle material prefetched.
 - Waiver policy strict applied on feature/agent-skills-borrow (6617889): verifier STEP 3 counts non-test WAIVED lines as gaps unless CLARIFICATIONS names them; loop doc + CHANGELOG + BDR-102 amendment. The earlier journal line said "applied" one commit early, corrected here.
 - Case 3 user go: rules/web-building.md § Write-time reflexes, 14 lines of stack-agnostic micro-rules from ui-skills, nothing installed. feature/web-building-microrules UNMERGED. Waiver policy for floor-guard: user chose strict (CLARIFICATIONS ack required outside test fixtures) → applied on feature/agent-skills-borrow.
+- Case 4 (reticle 898 stars, 3 months, FSL server): only repo of the six with a capability nothing local has (store state, verdict with file:line, replayable flows, CI gate). User go: parked with a 4-step pilot recipe in TODO (opt-in external, pinned, wrapper skill that never runs `init`, telemetry off, staging only). chore/six-repo-review-notes UNMERGED.
+- Case 5 (OmniRoute 70.6k stars, 1 GB, 96 deps): rejected. Subscription cannot pass through a keyed gateway; fail-open guardrails, default JWT secret admin bypass, Socket.dev block on 3.8.5, TLS fingerprint spoofing + free-tier key pools. Zero gap for a Claude-only subscription workflow. 6-repo review complete: 4 branches UNMERGED (yagni-ladder, agent-skills-borrow, web-building-microrules, six-repo-review-notes).

.claude/tasks/TODO.md

@@ -1,5 +1,40 @@
 # TODO
 
+## 2026-09-27 — case 5 of the 6-repo review: OmniRoute rejected (chore/six-repo-review-notes)
+Gateway to 357 providers via `ANTHROPIC_BASE_URL` → localhost:20128; needs provider
+API keys, a Claude Pro/Max subscription cannot go through it. No gap here: Claude-only
+workflow on subscription, codex second opinion already via gstack `codex` CLI, rtk
+native, caveman purged. Against: sits in the path of every prompt with 96 deps and
+a fail-open guardrail design (doctrine says fail closed); default JWT secret
+`omniroute-default-secret-change-me` = admin bypass if unchanged; npm 3.8.5 blocked
+by Socket.dev (May 2026, malware indicators), two real vulns closed in 3.8.6; JA3/JA4
+TLS fingerprint impersonation + 40 pooled free-tier keys = provider-ToS risk; no
+audit, SBOM or signing. Stars 70.6k in 7 months. Not to be re-evaluated unless a
+multi-provider need appears, and then a keyed gateway is still not the answer.
+- [x] R1 verdict recorded, nothing installed, nothing built.
+
+## 2026-09-27 — case 4 of the 6-repo review: reticle parked with a pilot recipe (chore/six-repo-review-notes)
+User go "parquer avec la recette". Real gap (runtime store state, structured
+verdicts with file:line, replayable flows, CI `gate --since`), no current project
+needs it; cost = per-project build instrumentation in the client repo, ~4.9k
+tokens of MCP schemas per session, PostHog telemetry on by default, a skill that
+auto-runs `init` against "ask, don't guess". Trigger: first app-type project
+(client state, forms, auth, cart).
+- [ ] P1 external opt-in in lib/toggle-external.sh + profiles (off by default,
+      qa-class); `@reticlehq/server` pinned in plugins.lock.json (plugin v3.3.0
+      seen 2026-09-27), never `@latest`.
+- [ ] P2 local wrapper skill replacing theirs: `npx @reticlehq/server init
+      --dry-run` shown to the user, never run by the agent (runbook doctrine);
+      MCP env `DO_NOT_TRACK=1` `RETICLE_TELEMETRY=0`; verify only after the
+      user ran init.
+- [ ] P3 pilot on staging only (secret redaction is name-based); flows
+      committed, evidence gitignored; `gate --since` in CI evaluated before
+      adoption.
+- [ ] P4 measure tokens per verification loop vs gstack browse on one page.
+Sources read 2026-09-27: docs/what-is-recorded.md, telemetry.md,
+token-efficiency.md, enterprise.md (core verification free; SSO/SCIM/RBAC/
+policy gates under ee/), LICENSE split FSL-1.1-ALv2 server+init, Apache
+adapters/core/engine. Stars 898, created 2026-06-11, 2 551 commits.
 ## 2026-09-27 — case 3 of the 6-repo review: ui-skills → web-building micro-rules (feature/web-building-microrules)
 User go after the analysis: 7 own skills + 36 third-party registry entries, all
 covered locally (impeccable, web-validate, /seo, emil, brightdata design-mirror)