STEP 5 previously ran `git push origin "$CURRENT_BRANCH"` autonomously
after the fix loops (gitflow-conformity §2b, verified HIGH). Now:
- gitflow precondition: no develop / no lib -> skip commit+push, note in
summary (report-only fallback).
- push gated behind an explicit-GO AskUserQuestion (A push / B defer)
BEFORE the push; red-flag STOP on push without GO / finish / merge.
Core untouched: SEO/GEO/HARDEN/VALIDATE loops, scoring, doc + PDF branding.
Dry-run (throwaway repos) — both sides of each fallback:
CASE 1 report-only (no develop): DEVELOP_OK=no -> NO commit/push. PASS
CASE 2 gate answer A: -> RUN git push origin feature/handover. PASS
CASE 3 gate answer B: -> SKIP, push deferred; HEAD unchanged. PASS
RC fix (soak day 1): `make update` step 7.5 failed on a 300s clone timeout
of alchaincyf/find-skills. The skill (search the skills.sh registry from
Claude) was never used; the discovery case stays reachable manually via
`npx -y skills find <query>`. Removed from install-plugins.sh (install list
+ summary + comment), update-all.sh (refresh list), link.sh
(NPX_EXTERNAL_SKILLS), lib/toggle-external.sh (MANAGED_TOOLS + case arms),
plugin-advisor.md, .gitignore; local skills/find-skills symlink deleted.
Memory-registry and test-fixture mentions kept — append-only history.
toggle-external `list` verified post-removal; suites 8/8.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
geo-analyzer asserted 'PERMISSIVE default per user CLAUDE.md' in 2 sites (L224,
L867-869) but CLAUDE.md carries no PERMISSIVE/RESTRICTIVE crawler policy. Reframed
as the agent's own policy grounded in GEO's purpose (an AI-visibility audit defaults
to allowing AI crawlers); default unchanged. Completes job3 C6/C7/C8 scrub (which
missed geo) — job9's later rewrite also left it. User-approved wording. Review A5.
Both line-3 descriptions contained an unquoted ': ' (and '|') that fails
python3 yaml.safe_load ('mapping values are not allowed here'). seo-analyzer's
line was last rewritten by job9/a5a7b54 AFTER job2's F7 strict-YAML rule
(git blame); security-auditor's dates to job6. Single-quote wrap, no internal
apostrophes. Gate: yaml.safe_load over ALL agents/*.md now clean. Review A4.
Completes job9/5a3de92 (which only cleaned commit-changer). These 3 execution
agents still emitted the banned trailer into their commit-message templates;
the settings.attribution backstop does not filter agent-authored message bodies.
Extended sweep of agents/ lib/ hooks/ templates/ for Co-Authored-By|Claude-Session|
--trailer now returns zero. Review finding A1 (BLOQUANT), J4-16 follow-up.
- README + plugins.lock.json graphifyy note: pipx/PyPI install only, never
npm/npx — a different publisher (rhanka/graphify) squats the same
'graphifyy' name on npm as a version-shadowing shim with its own
conflicting 'graphify' bin (F-X1).
- agents/security-auditor.md: one-line caveat that p/* semgrep packs are
fetched from the registry at runtime — the CLI version pin does not
freeze ruleset content, so a new BLOCK can appear on unchanged code.
MCP magic (F-X3): version pin declined by user call (stays @latest in
lib/toggle-external.sh). ${VAR} env expansion confirmed unsupported at
~/.claude.json user scope (Claude Code docs — expansion is .mcp.json
project-scope only), so the BDR-026 reference-not-plaintext pattern
doesn't transfer here; existing mitigations (canonical ~/.claude/.env,
gitignore, audit env-field filtering) remain the practical ceiling.
~/.claude.json regenerated out-of-repo via toggle-external.sh disable+
enable magic to pick up the already-rotated MAGIC_API_KEY (no repo diff,
no commit for that file — traced in the job6 final report).
Upgrade confirmed format-incompatible before use (job6 gate, BATCH-2):
gsd-pi 3.0.0 no longer writes .gsd/ROADMAP.md (verified by generating a
real test milestone in a scratch project) — state moved to .gsd/STATE.md,
.gsd/gsd.db (authoritative DB), and one .gsd/milestones/<ID>/<ID>-ROADMAP.md
per milestone, all in a different markdown shape. Every grep/awk in
status-reporter.md PHASE 3 would silently print 0/blank against the old
path instead of erroring.
Rewired PHASE 3 to read `gsd headless query` (stable JSON snapshot, no LLM
call) instead of scraping markdown — smoke-tested against both the absent
case (this repo, no .gsd/) and a real gsd-managed scratch project.
plugins.lock.json pin bumped deliberately to 3.0.0 (update-all.sh honors
the pin; this is the required manual bump).
Complementary to frontend-design (kept: build-time aesthetic direction).
impeccable adds what the chain lacked: 45 deterministic anti-slop rules
(npx impeccable detect, exit 0/2, --json) — the design counterpart of the
semgrep gate — plus 23 design verbs under one /impeccable skill and
persistent per-project design context.
- plugins.lock.json: CLI pinned 3.2.0 (rules update = audit output change
on unchanged code, LRN-077 class); skill dist = its own release track
- install-plugins.sh Step 8d: staged npx install (tmpdir) -> moved to
skills-external/impeccable (machine-owned, gitignored, ctx7 pattern);
never writes through the ~/.claude/skills symlink into the tracked tree
- update-all.sh: pin-honored refresh, Node<24 or failure -> dist kept
- Node >= 24 required (host at 22): steps skip gracefully, activation
deferred to a deliberate Node bump
- link.sh EXTERNAL_SKILLS, profiles (design/web/web-full/full),
plugin-advisor, CLAUDE.md design routing, design-gate, README, CHANGELOG
- NOT in design GATE-BLOCK yet: promotion after first dogfood
lib/verify-secure-loop.md: shared main-loop include. GATE 1 fresh verifier
(blind, contract from disk) → CONFORME straight to GATE 2, ECARTS loop max
3; GATE 2 fresh security-auditor (MODE gate) → PASS to commit, BLOCK loop
max 3 with re-verify-request-FIRST order invariant. Mute agent never a PASS.
feater.md: STEP 0.7 CONTRACT (proportional, silent on a clear feature) +
STEP 3 VERIFY+SECURE via the include. Nominal = one verifier + one security
dispatch; the loop only costs when it loops.
bugfixer.md: STEP 3.5 CONTRACT fed by the DIAGNOSIS (bug report verbatim +
reproduced-then-gone + regression test criteria) + STEP 5 fresh gates via
the include. Renumbered STEP 5 sub-steps (gates before the commit gate).
hotfixer.md: STEP 1.7 CONTRACT (silent autofill, zero questions) + STEP 3
security gate whose FAILURE REVERTS (git restore to pre-flight SHA + escalate
to /bugfix), never loops — the 1-attempt model preserved. No fresh verifier
at hotfix weight (the smoke-check verifies the trivial contract). Adds the
Agent tool to hotfixer.md + hotfix/SKILL.md for the security dispatch.
lib/tests/loops-light.test.sh: 27 structure locks green, shellcheck clean.
Behavioral pipeline dogfood on a fixture (feat adding a feature WITH a SQLi):
GATE1 CONFORME (feature present, SQLi not a conformity gap — orthogonal
gates) → GATE2 BLOCK(1) (checklist caught the %-interp SQLi semgrep's taint
rules missed) → [fix to parameterized] → re-verify CONFORME (order invariant,
feature intact) → re-scan PASS. Loop converges to green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
agents/security-auditor.md: fresh read-only-on-code SAST gate. Pinned
rulesets p/security-audit + p/secrets + p/owasp-top-ten (owasp REQUIRED —
measured: the 2-ruleset baseline misses SQLi + path-traversal entirely on
realistic Flask code), never --config auto, never auto login (BDR-048).
Severity map: secrets ERROR → CRITICAL, other ERROR → HIGH (block),
WARNING/INFO → reported. gate mode (diff, no Write) vs audit mode (Write
only to REPORT, rule-locked). DEGRADED (semgrep absent) still runs the
checklist and still blocks — never a vacuous pass (LRN-048). Anti-gaming:
a new un-gated nosemgrep suppression is BLOCKING. PROOF mandatory, mute
auditor never a PASS, blind (no iteration history), blocks HIGH/CRITICAL
only (LRN-047).
Grafts: onboard STEP 6 L3a dispatches it in audit mode (report
.onboard-audit/semgrep.md) in BOTH gstack branches — complement to cso
(cso is a gstack submodule, unmodifiable); synthesis picks it up via the
existing .onboard-audit/ sweep. audit-delta security axis runs the SAST
pass first, folds findings into the existing gate/fix/re-verify flow.
lib/tests/security-auditor.test.sh: 28 structure locks green, shellcheck
clean. Behavioral dogfood (fresh agents on a planted fixture):
BLOCK(9) on the vuln commit (2 secrets→CRITICAL, semgrep+checklist
complementarity — checklist caught the 6 semgrep missed off-context);
BLOCK(1) on a new nosemgrep suppression (understood semgrep's 0 was the
mask); DEGRADED → BLOCK(7) on grep-detectable secrets with semgrep hidden.
FP measured on real repos (faunosteo, game): owasp adds only hygiene
findings, contained by diff-scoping.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
lib/contract-interview.md: mandatory upstream passage for all orchestrators.
Verbatim REQUEST (immutable), proportional questions (complete request =
zero, max 3 one batch), testable criteria + file scope, written to disk
immediately (.claude/tasks/contracts/<date>-<slug>-<HHMM>.md — a context-only
contract dies at compaction). Lifecycle: enrichment only at human gates
([gated] marker, scope micro-gate), supersedes for re-scope, aborted runs
deleted or committed status:aborted — never left dirty. Hand-off = path,
not restatement.
agents/verifier.md: fresh read-only verifier. Reads the contract from disk,
renders VERIFY — VERDICT: CONFORME | ECARTS(n) | ERROR. Blind: never
receives iteration history. PROOF line mandatory (LRN-048), UNVERIFIABLE
never MET, mute verifier never a PASS (retry once fresh, 2nd structural
failure = human escalation). Orchestrator protocol documented in-file
(max 3 iterations, re-verify request before security).
lib/tests/contract-verifier.test.sh: 31 deterministic structure locks on
the load-bearing doctrine clauses — green, shellcheck clean.
Behavioral dogfood (2 fresh subagents on a planted fixture): gap case →
ECARTS(2) exactly as planted (NOT-MET located + out-of-scope flagged);
conform case with injected fake iteration history → CONFORME, noise
ignored, real python spot-check as evidence. Both outputs parse-clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
(1) lib/doc-shape.sh — deterministic shape oracle re-checks each LLM-classified
MINOR patch before the silent auto-commit; a shape-suspect patch (added heading
/ oversize / new file / non-doc) escalates to the EXISTING SIGNIFICANT gate.
Genuine MINOR still auto-commits (zero friction, BDR-036 preserved). A structural
floor under the LLM call, not a semantic SIGNIFICANT-detector (BDR-040).
(2) lib/doc-commit.sh — guard the commit itself: a rejected git commit (pre-commit
hook / protected branch / signing) now fails loud with exit 5 + empty stdout,
instead of a false "committed" + the previous HEAD's hash + exit 0 that left docs
silently uncommitted (LRN-071, 3rd occurrence of the swallowed-commit pattern
after LRN-066 and LRN-068/BLK-012).
Wired doc-syncer STEP A4 (whole-set escalation: no=revert all, select=keep subset)
+ doc-commit.md (rc-5 consumer row + ACKNOWLEDGMENTS coherence).
TDD RED->GREEN: run-doc-commit.sh 32/32, run-doc-shape.sh 19/19, behavioral C/D.
shellcheck clean. Branch-guard (3) deferred.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C6bUdvHnajCNzgVQefZowj
Scope expansion surfaced by the Task 6 sweep (not in the original frozen plan). The 3 inline flows each ran doc-syncer at their DOC SYNC step but committed nothing — their CAPITALIZE step commits only memory (capitalize-commit's surgical scope) — so patched docs were left dirty in the working tree (milder than the orchestrator PR-strand, same class). Decider: the memory chantier (BDR-034) wired capitalize-commit into ALL flows; wiring docs only into the 2 orchestrators left an asymmetry that reads as a bug.
Each DOC SYNC step now references lib/doc-commit.md (1-line include + paragraph, mirror of the capitalize-commit reference at the CAPITALIZE step). No FINISH in an inline flow → no ordering concern; it commits the docs on the current branch and no-ops when nothing was patched (the common trivial case). Set = the 3 flows that doc-sync: commit-change has no DOC SYNC step (not wired); hotfix IS wired (its DOC SYNC is unconditional — only its CAPITALIZE is skip-by-default). We replicate a built+tested mechanism mechanically; NEW work (BLK-010/011) stays deferred.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ho5EQCFTSvYamuRtVZpp2d
doc-syncer now emits PATCHED_FILES — every public-doc file created/modified this run, ONE PATH PER LINE — in both STEP 9 OUTPUT (full audit) and AUTO MODE STEP A4 (the path orchestrators call). NONE stays silent (no line → doc-commit sees empty → no-ops). Additive: detection/patching logic and the `auto-mode scope:` input contract are unchanged → callers unaffected.
Separator contract, producer↔consumer aligned + proven: newline is doc-syncer's OUTPUT format (paths carry no newlines); the agent splits on newline and passes EACH path as a SEPARATE argv element to lib/doc-commit.sh. The helper takes argv (no in-band separator) → a path with spaces survives as one argument. lib/doc-commit.md spells this out (never flatten to a space-joined string + re-split, which would mis-split a spaced path the helper then silently drops). New test T7 PROVES it on real git: 'docs/My Guide.md' → committed as one file (28/28, shellcheck clean).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ho5EQCFTSvYamuRtVZpp2d
Shared include lib/analyze-before-plan.md (two-pass on '## <PREFIX>-' headings, disposition-not-reading invariant, guarded no-op). Wired into the dev flows: ship-feature STEP 0d (analyzer code+memory, INPUT INJECTION into brainstorm/plan + STEP 3 reconciliation gate), bugfix STEP 2.5 (blockers-first), feat STEP 0.6 (decisions-first, MINI-PLAN names in-force or states none), hotfix opt-in. analyzer gains a RELATED MEMORY output section pointing at the include (DRY). init-project / onboard no-op by construction (guarded scan on absent/empty registries).
Mirror of the coupled-capitalize write-after (BDR-034): read-before / write-after bookend.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ho5EQCFTSvYamuRtVZpp2d
Each flow's CAPITALIZE step now ends by following lib/capitalize-commit.md, which
surgically commits the approved memory (.claude/memory + .claude/tasks only) as one
chore(memory) commit. No flow hand-rolls git; the helper owns the scope guarantee.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9sqAwZxBMZSynZoVrEJhd
Clearer scoped name for the W3C + WCAG skill. Updated: folder (git mv),
frontmatter name, H1 title, command refs, CLAUDE.md routing, 6 profiles
(functional — activate the skill by folder name), cross-refs in
harden/seo/depth-matrix/client-handover, agent dispatch refs, README +
USAGE tables.
Confidentiality: the client-deliverable leak-guard regex
(client-handover-writer.md) now matches BOTH /web-validate and legacy
/validate, so older client docs stay covered.
Left intentionally: validator-analyzer agent name (lockstep with
subagent_type + registry), .validate-cache/ + VALIDATE.md (audit-file
family {SEO,GEO,HARDEN,CSO,VALIDATE}.md), .claude/ history (append-only),
CHANGELOG old entry (added a new "renamed" entry instead). NL trigger
keywords kept so "validate" still routes here. Third-party html-validate
untouched.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9sqAwZxBMZSynZoVrEJhd
The gate's remedy is now /profile design (not an atomic ui-ux-pro-max toggle),
but several callers still described the old "ask user to activate ui-ux-pro-max"
behavior. Repoint the prose — the `Follow lib/design-gate.md` pointers stayed
valid (the gate was extended in place), so only descriptions change:
- agents/feater.md, hotfixer.md, bugfixer.md (STEP 0.5/1.5 gate bullet):
signals found → run design-tool-gate.sh; if INCOMPLETE → /profile design.
- agents/feater.md rule 6: trigger is "design toolchain incomplete", not
"ui-ux-pro-max inactive".
- agents/plugin-advisor.md: gate points at /profile design when the toolchain
is incomplete.
- skills/feat/test-prompts.json (id 2): expected behavior updated; still valid JSON.
No logic change — descriptions only, aligned with the profile-based gate.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Teach doc-syncer to sync an existing ROADMAP.md without ever creating one.
- ROADMAP absent → propose nothing; never bootstrapped (creation belongs
to init/onboard skills). Never enters DOC_MISSING, never a CREATE
candidate.
- ROADMAP present → standard drift detection plus 'shipped reconciliation':
a planned/unchecked item proven delivered by CODE + git is proposed for
the shipped/done section (or checkbox), preserving wording. [AUTO] when
the item-to-code mapping is obvious, [HUMAN] when it needs judgment.
One direction only (planned -> shipped); never invent planned items.
- Forbid reading .claude/tasks/ (or any .claude/) to populate or check
ROADMAP; shipped status is deduced from code/git only.
- Numeric incoherence (e.g. a '22/22' milestone matching no code counter)
is surfaced as a [HUMAN] question, never overwritten with a guess.
Implements BDR-022's read-only .claude/ boundary for the ROADMAP case.
Co-Authored-By: Claude <noreply@anthropic.com>
Rewrite the doc-syncer agent so it only ever targets public docs and
treats .claude/ (and CLAUDE.md) as read-only context.
- Add normative CONVENTIONS section: Standard-Readme, Diátaxis doc-type
separation, Keep a Changelog + SemVer, Conventional Commits.
- Add CONTEXT SOURCES section: .claude/ and CLAUDE.md may be read for
project context but are never modified, never sync targets, and their
content is never copied into a public doc.
- Drop .claude/{tasks,audits,memory} and CLAUDE.md from discovery,
per-doc analysis, tagging, patches, and the report. Remove the STEP 4
blocks that audited TODO.md / audits/*.md / decisions-learnings-blockers.
- Fix sync scope to the modifiable targets: README, INSTALL, CONFIGURE,
USAGE, DEPLOY, CONTRIBUTING, CHANGELOG, SECURITY, ARCHITECTURE, LICENSE,
docs/**. Add SECURITY.md and ARCHITECTURE.md analysis stanzas.
- Make the README template lean (Standard-Readme order): drop Status and
Project layout; forbid roadmap/todo/internal-state; README only links
to the Diátaxis docs, never duplicates them.
- Add CLEAN mode (triggered by a 'clean' arg): propose removal of
out-of-convention sections and copied .claude/ content from existing
public docs, HUMAN-tagged and gate-validated.
- Conserve: stack detection, 14-section DEPLOY gate, validation gate,
AUTO/HUMAN tagging, never-invent rule, AUTO MODE (input contract
'auto-mode scope:' unchanged, so callers are unaffected).
- Preserve frontmatter name/tools/model; update description to reflect
the public-doc scope and 'reads .claude/ for context only'.
Co-Authored-By: Claude <noreply@anthropic.com>
Both blind judges flagged the same residual: without a detection
criterion, a /seo-dispatched subagent could misread itself as headless
and degrade to report-only. Unreachable = no answer obtainable at all
(cron/CI, user explicitly absent); orchestrator dispatch with a main
thread that can relay questions is reachable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
"Update project memory" instructed file writes while RULES say
"Do not modify files". Patterns now surface in the analysis output;
persistence stays in the main thread via the gated capitalize flow.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Live darwin test: with the user unreachable, the triage table's
"Confirmation: No" batches edited 2 source HTML files unsupervised.
Autonomous batches presume a reachable user who saw the printed plan;
headless -> all batches report-only with ready-to-apply content.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
frontend-design (Anthropic's anti-AI-slop skill) was installed but not
referenced in the plugin-advisor decision table, recommended sets, or
conditional rules — nor in the design-gate detection logic.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
README.md creation becomes AUTO and unconditional — strikes through any
"no README" opt-out in CLAUDE.md. Enriched template: Stack, Quick start
(dev), Verifying a change, Build & deploy sections, all rendered from
real project data (manifest, .env.example, scripts).
DEPLOY.md becomes prod-only, expanded into a 14-section VPS-deploy
structure (topology, env, provisioning, two-layer firewall, Docker
tuning, first-time setup, routine deploys, persistence, backups, TLS,
observability, hardening, rollback, runbook). Dev quick-start lives in
README only — mixed dev/prod DEPLOY.md is flagged as drift.
AUTO MODE: missing README surfaced as SIGNIFICANT in STEP A4 with
rendered draft for one-shot end-of-session approval. Validation gate
(STEP 8) now distinguishes AUTO patches / HUMAN items / CREATE items,
and README CREATE has no "no" — only yes/edit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Restructure deliverable from 4 to 6 chapters:
- §2 (new): score table promoted from technical annex to top of doc for
immediate visual proof of impact (tested with local-business clients —
converts "what did I pay for?" doubt within 30 seconds).
- §4 (new): NAP table promoted from §7 annex so client reads identity
values (name, address, phone, hours, categories, short description)
BEFORE attacking §5 todo list. Prevents 10-different-description drift
across external platforms that degrades Google's NAP-consistency signal.
- §5 (todo) and §6 (tech details) renumbered; §7/§8 annexes still optional.
Pandoc bumped to gfm+gfm_auto_identifiers so internal anchor links like
[§4](nap) resolve in the rendered HTML/PDF.
Co-Authored-By: Claude <noreply@anthropic.com>
Three bugs surfaced on the LIVRAISON.pdf test render:
1. **MD→HTML conversion** — host had no pandoc, no python-markdown, fell
back to `npx marked < "$src"`. marked CLI 16.x ignores stdin and
dumps its own cli.js source. Resulting PDF body = marked's binary
source (`#!/usr/bin/env node`, `Marked CLI`, copyright). Fix:
`npx --yes marked --gfm -i "$src"` (file path via -i, not stdin).
2. **Cover background** — original cream `#F5F0EB` + 8mm green stripe
was washed out. Iterated to white-pure bg with subtle radial
sage/forest tints, black-deep title, green-forest accents
(eyebrow, meta labels, footer, border). Solid green-dark tried
first then rejected (too heavy for long client-facing doc).
3. **Default logo** — SVG `logo-horizontal.svg` rendered cream-toned,
blended into bg. Switched LOGO_URL default to
`https://zenquality.fr/assets/logo-horizontal-1024.png`.
Also added test-artifact gitignore rules for LIVRAISON.* / HANDOVER.*
project-local renders.
Verified: regenerated LIVRAISON.pdf → 164 KB, 19 pages, full content
rendered, white cover with black title + green-forest accents +
visible PNG logo.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bastien Chanot
