Merge chore/ctx7-single-surface into develop

.claude/memory/decisions.md

@@ -834,3 +834,11 @@ rules:
 - **Rationale**: mid-run gates defeat the skill's point (hands-off grouped sweep, user away). Auto-checking TODO reproduces the exact lie /reconcile catches — RED-proven, baseline did it. Branch+report = same approval semantics as audit-delta's 3c gate, moved after the fact where a headless run can afford it.
 - **Alternatives rejected**: per-phase AskUserQuestion gates (audit-delta model — blocks headless); one consolidated pre-fix gate (still blocks); auto-edit TODO on oracle proof (inference ≠ approval); plain-branch fallback on non-gitflow repos (violates lib-only doctrine → report-only instead).
 - **Reference**: skills/tour/SKILL.md + CLAUDE.md routing (feature/tour-skill `73e6a1c`). TDD trail [[LRN-099]] [[LRN-100]] [[EVAL-014]].
+
+## BDR-053 — ctx7 single surface: keep find-docs skill, kill context7.md rule
+
+- **Date**: 2026-07-06
+- **Decision**: ctx7 gets ONE session surface = `skills/find-docs` (lazy body, description-only cost). `rules/context7.md` deleted + install-plugins.sh STEP ctx7 purges it unconditionally post-setup (`rm -f`, generator has no skip-rule flag — `--claude`/`--cli` = target/mode only). darwin-skill entry dropped from skills-lock.json same pass (F8: lock stale `6bbcda37…` vs disk `c3220018…`, no re-pin verb in npx skills — unpinned rather than hand-edit undocumented hash).
+- **Rationale**: rule = ~490 tok/session session-start duplicate of the skill (job1 F10 + job2); skill self-suffices (876-char description carries the triggers, body has full CLI flow). Purge-in-installer beats one-shot rm: survives re-runs + manual `ctx7 setup`.
+- **Alternatives rejected**: kill skill keep rule (rule always-on, costs every session even non-lib work; skill lazy — wrong direction); hand-trim generated files (fight the generator, LRN-039 class); hand-edit lock hash (algo undocumented).
+- **Reference**: chore/ctx7-single-surface; job1 F10, job2 F8/F13. User decision 2026-07-06.

.claude/memory/evals.md

@@ -160,3 +160,12 @@ rules:
 - **method**: real prod deploy (VPS). Independent live proof post-mark: curl bchanot.fr → 200 + nosniff + X-Frame-Options + CSP + HSTS + versionless server — tour SEC-2 fixed end-to-end, tour→prod loop closed.
 - **anomalies**: (1) NOT exercised: cold cross-session resume + STEP 4 learn (0 incidents) — natural test at next deploy/failure. (2) UX gap, user feedback: compound `ssh host "cd … && …"` one-liners ≠ wanted session style (one command per line), and the checklist lived only on disk — skill patched same day (step=block grammar, shape rule, hand-back prints NEXT.sh inline; template + bchanot-cv runbook restyled). Re-dogfood at next deploy.
 - **action**: keep. Two-moment contract works in-session; disk artifacts coherent throughout.
+
+## EVAL-017 — job2 audit: fresh-context verify pass caught 3 explorer false claims
+
+- **Date**: 2026-07-06
+- **output**: `.audit/job2-report.md` — 17 findings, 26 diffs, execution prompt. 4 explorers (skills/agents/hooks+lib/registry x-ref) + 1 docs agent (claude-code-guide), then 3 fresh verifiers re-checked all 17 findings + 9 registry quotes from list+paths only.
+- **method**: verifiers blind to auditor reasoning. Mid-run session-limit kill all 3 → resumed from transcript via SendMessage, all completed.
+- **result**: 15/17 REPRODUCED, 2 PARTIALLY (wording only: F3 "exactly 4"→4-of-54; F14 soft precondition existed). 0 discarded. Registry quotes 9/9 verbatim. Exact char counts 100% match (4840 total agents).
+- **anomalies**: 3 explorer false claims, ALL about harness semantics not file content: (1) agents-explorer — `Agent` tool "non-canonical" + `memory:`/`effort:` frontmatter "invalid": wrong, all documented; (2) skills-explorer — skills/gstack/ "stray orphan": refuted by link.sh:54-57 deliberate plumbing; (3) guide agent — `[1m]` model suffix "invalid ANSI": refuted, /model writes it itself. File-content claims (counts, quotes, refs): zero errors.
+- **action**: harness-semantics claims from explorers ALWAYS cross-check vs docs/live evidence; file-content claims reliable after one verify pass.

.claude/memory/journal.md

@@ -331,3 +331,12 @@ rules:
 - Built /tour skill (grouped sweep clean+security+reconcile+doc, auto, 1..N projects, convergence loop bounded 3×) via writing-skills TDD + skill-creator guidance: RED 6 gaps → GREEN 6/6 closed disk-verified → REFACTOR 2 holes (scratch self-block, BREAKING tag). [[BDR-052]] [[LRN-099]] [[LRN-100]] [[EVAL-014]]. Merged feature/tour-skill → develop + release/1.0.0 on user GO. settings.json /model side-effect reverted (Opus 4.8 1M default restored, attribution backstop kept).
 - /deploy first real run (bchanot-cv): bootstrap→mark full cycle, live-proven (full security-header stack live — tour→prod closed, tag deploy/2026-07-05). Skill patched post-run on user UX feedback: session-style NEXT.sh (one command per line) + hand-back prints the checklist inline ([[EVAL-016]]); template + generated runbook restyled. impeccable chain + Node 24 baseline shipped develop+RC, pushed. settings.json: +inputNeededNotifEnabled committed (layout unchanged).
 - /deploy pass 2 (user feedback live): checklist DISPLAY-ONLY — NEXT.sh file eliminated (throwaway artifact, PENDING+runbook regenerate anywhere), hand-back ends the turn with the checklist as final text (a print above AskUserQuestion never reached the user, [[LRN-102]]). Skill+template+CHANGELOG patched; legacy NEXT.sh removed from bchanot-cv; deploy run 2 (residuals b24c58b) re-handed-back inline.
+
+## 2026-07-06
+
+- job1 fixes merged develop (`c6d5e03`): CLAUDE.md gitflow density pass, F14 hook pointer-only, line-count guard, [[LRN-103]].
+- job2 config-smell audit shipped read-only: `.audit/job2-report.md` — surface skills/agents/hooks/plugins/settings(.local), 17 findings (3 RISK perms, 6 DRIFT, 2 BLOAT, 3 OVERLAP, 2 DEAD, 1 struct), 26 diffs base c6d5e03, 0 decision-conflicts, all fresh-context verified [[EVAL-017]]. Live catch: design hook fired on audit's own task-notifications (14/20 recent fires).
+- Brief premise corrected: Edit/Bash(hooks/*.sh) permission rule NEVER existed — was config-protection case arm (:37) + job1 sentinel bypasses. Phase-0 UNREFERENCED metrics 100% broken (grep -q kills -l).
+- User GO full execution incl. 3 RISK: cp/mv→ask, find -exec deny mirror, settings.local prune (python3 -, rtk git *). F9 fable default committed (user re-chose via /model), F16 gitflow-migrate.sh removed (git-recoverable), F8/find-docs skip (generator-owned). Executor = Sonnet subagent on chore/job2-fixes, NO finish.
+- job2 EXECUTED: 15 commits chore/job2-fixes, all diffs first-try, `make test` wired + first-ever full run ALL GREEN (gitflow 71/0). Measured −309 tok/session (agents 4840→3609 chars); design hook no longer fires on task-notifications. Executor STOP exercised for real: F4 gate red → root-caused to job1 oracle regression (3f639b3), fixed as [[LRN-104]]; 2nd YAML error/file unmasked (onboard/plugin-check) → closed 6a3b197. Skips: F8 (npx skills has no re-pin verb), find-docs (ctx7). Merged develop 964c5dd on user GO.
+- job2 tail closed [[BDR-053]]: context7.md rule killed (file rm + installer purge, find-docs = single ctx7 surface, ~−490 tok/session more) + darwin lock entry dropped (F8). chore/ctx7-single-surface → develop, pushed. job1+job2 fully closed; total measured ≈ −800 tok/session.

.claude/memory/learnings.md

@@ -1058,3 +1058,11 @@ rules:
 - **context**: 2026-07-06, job1 audit follow-up (.audit/job1-report.md, finding F13). BLK-009 closed same session; workaround it forced ([[BDR-031]] unconditional + compressed global CLAUDE.md) no longer required by this bug specifically, though BDR-031 itself stands on its own merits pending separate review.
 - **future application**: before acting on ANY open upstream/tool blocker cited to justify a fix, a caveat, or a design constraint — re-probe it live if cheap, don't just trust the registry's last-recorded status.
 - **cousin**: [[BLK-009]] closed this session; [[BDR-031]] (the workaround this bug forced).
+
+## LRN-104 — a hook's output message is part of its test contract; no runner = regression invisible
+
+- **pattern**: job1 F14 (`3f639b3`) changed design-hook stdout to pointer-only; test oracle grepped old literal `design-toolchain` → 9 fire-checks silently red 3 days. Hook itself fine — broken oracle, not broken behavior. Caught ONLY when job2 executor ran the suite as its F4 gate; zero runner existed before (job2 F10). Fix: oracle synced to durable fragment `full toolchain` (heading BDR-021 requires the hook to quote verbatim) + `make test` target wired.
+- **why**: an untested output string IS an interface — its test must anchor on the durable contract part (the mandated heading), not incidental wording. No automated runner → oracle drift accumulates unseen; "18 checks lock it" ([[LRN-091]]) protected nothing while nothing ran them.
+- **2nd facet**: audit yaml.safe_load stops at FIRST error/file — fixing error #1 unmasked pre-existing error #2 (onboard/plugin-check argument-hint). Verify errors-per-file exhaustively, not error-presence.
+- **future application**: change any hook/script output consumed by a test → run its test same commit. `make test` now the deterministic backstop (job2 F10). Audit parse-checks: iterate until file fully clean, count errors not booleans.
+- **cousin**: [[LRN-091]] (the lock that never ran), [[LRN-096]] (a guard is code, prove it can fail), [[EVAL-017]].

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help install plugin link doctor update new-skill profile profile-list profile-current profile-reset onboard
+.PHONY: help install plugin link doctor update new-skill profile profile-list profile-current profile-reset onboard test
 
 help: ## Show available commands
 	@grep -E '^[a-zA-Z_-]+:.*##' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*## "}; {printf "  make %-14s %s\n", $$1, $$2}'
@@ -22,6 +22,10 @@ onboard: link ## Onboard an existing project (run from the project directory)
 	@echo "Open Claude Code in your project directory and run: /onboard"
 	@echo "Or with hints: /onboard Python FastAPI monorepo"
 
+test: ## Run deterministic tests (lib/tests/*.test.sh + lib/gitflow-test.sh)
+	@fail=0; for t in lib/tests/*.test.sh lib/gitflow-test.sh; do \
+		echo "== $$t"; bash "$$t" || fail=1; done; exit $$fail
+
 profile: ## Run profile.sh (usage: make profile cmd="set design")
 	@bash lib/profile.sh $(cmd)
 

agents/bugfixer.md

@@ -1,6 +1,6 @@
 ---
 name: bugfixer
-description: Structured bug fix with root cause investigation. Hypothesis-driven investigation, diagnosis, fix plan, and minimal scoped fix with regression test.
+description: Root-cause bug-fix executor — dispatched by /bugfix. Hypothesis-driven investigation, diagnosis, minimal scoped fix with regression test.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 

agents/client-handover-writer.md

@@ -1,6 +1,6 @@
 ---
 name: client-handover-writer
-description: Final ship-and-handover orchestrator. Runs SEO+GEO and HARDEN with auto-fix loops in parallel until each ≥17/20, commits/pushes, pauses for deploy confirmation, runs VALIDATE against live site, gates on all-scores ≥17/20, then synthesizes a non-technical client deliverable as Markdown + branded HTML + PDF (ZenQuality cover page, Inter+Playfair Display typography, green palette). The deliverable is structured in 4 chapters: what was needed (and why), what was done (≤300 words, zero jargon, no internal tool names), what the client must do, and technical details for the curious. Reads git history + .claude/memory/ registries. Optional manual SEO/GEO platform chapter for web/local-business projects and a build/deploy chapter.
+description: Final ship-and-handover orchestrator — called by /client-handover. Runs SEO+GEO+HARDEN auto-fix loops to ≥17/20, gates on live VALIDATE, then writes the non-technical client deliverable (Markdown + branded HTML + PDF).
 tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch, AskUserQuestion, Agent
 model: opus
 ---

agents/commit-changer.md

@@ -1,6 +1,6 @@
 ---
 name: commit-changer
-description: Analyze all changes since the last commit and create commits that retrace the development steps — one commit per logical step, in the order work happened.
+description: Retrace-and-commit engine — dispatched by /commit-change. Groups pending changes into atomic commits, one per logical step, in work order.
 tools: Bash, Read, Grep, Glob, Agent, AskUserQuestion
 ---
 

agents/doc-syncer.md

@@ -1,6 +1,6 @@
 ---
 name: doc-syncer
-description: Detect stale PUBLIC documentation by cross-referencing git history against the project's doc layout (README, INSTALL, CONFIGURE, USAGE, DEPLOY, CONTRIBUTING, CHANGELOG, SECURITY, ARCHITECTURE, LICENSE, docs/**). Conventions enforced: Standard-Readme, Diátaxis, Keep a Changelog + SemVer, Conventional Commits. Reads .claude/ for context only, never modifies or exposes it. Stack-aware deploy-doc gating (DEPLOY.md only when non-trivial). Enforces README presence. Audit, report, patch. Full audit, clean mode, and automatic (silent) mode.
+description: Detect stale PUBLIC documentation by cross-referencing git history against the doc layout (README, CHANGELOG, docs/**…) — dispatched by /doc and orchestrators. Convention-aware (Diátaxis, Keep a Changelog); never touches .claude/. Audit, report, patch.
 tools: Read, Write, Edit, Bash, Grep, Glob
 model: sonnet
 ---

agents/feater.md

@@ -1,6 +1,6 @@
 ---
 name: feater
-description: Small feature implementation (1-5 files). Light planning, direct implementation, no heavy orchestration. No design brainstorm, no subagents, no plugin check gate.
+description: Small-feature implementer (1-5 files) — dispatched by /feat, which owns branching and gates. Light planning, direct implementation, no heavy orchestration.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 

agents/geo-analyzer.md

@@ -1,6 +1,6 @@
 ---
 name: geo-analyzer
-description: Professional GEO (Generative Engine Optimization) audit agent. Optimises sites for AI search engines — ChatGPT, Claude, Perplexity, Gemini, Google AI Overviews, Copilot. Audits AI crawlers, llms.txt, entity signals, Schema.org for AI, content shape, AI visibility. Autonomous code fixes, scored report, prioritized action plan.
+description: GEO audit agent for AI search engines — dispatched by /geo and /seo. Audits AI crawlers, llms.txt, entity signals, Schema.org; autonomous fixes, scored report. Classical SEO → seo-analyzer agent.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent, WebFetch, WebSearch
 ---
 

agents/hotfixer.md

@@ -1,6 +1,6 @@
 ---
 name: hotfixer
-description: Quick fix for superficial bugs (typos, CSS issues, config errors, off-by-one, wrong variable name, missing import, broken link). Max 2 files, obvious root cause only.
+description: Quick-fix executor — dispatched by /hotfix, which owns the routing and gitflow gate. Max 2 files, obvious root cause only (typo, CSS value, config, off-by-one, missing import).
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 

agents/plugin-advisor.md

@@ -1,6 +1,6 @@
 ---
 name: plugin-advisor
-description: Check active plugins vs project needs. Recommend enable/disable before starting work. Gate before init-project and ship-feature.
+description: Plugin-fit checker — dispatched by /plugin-check and orchestrator gates (init-project, ship-feature). Recommends enable/disable.
 tools: Read, Bash, Glob, Grep
 model: haiku
 ---

agents/seo-analyzer.md

@@ -1,6 +1,6 @@
 ---
 name: seo-analyzer
-description: Professional classical SEO audit agent. Targets traditional search engines (Google, Bing, DuckDuckGo). Live site audit, Core Web Vitals, on-page (meta, headings, images, video, a11y, i18n), technical (HTTP, security headers, redirects, indexability), SEO local (NAP, GMB, citations), competitive analysis, legal compliance (FR). Autonomous code fixes, scored report, prioritized action plan. GEO / AI optimization is handled by the geo-analyzer agent.
+description: Classical SEO audit agent (Google, Bing) — dispatched from /seo. Live audit: Core Web Vitals, on-page, technical, local SEO, legal (FR). Autonomous fixes + scored report. AI/GEO → geo-analyzer agent.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent, WebFetch, WebSearch
 ---
 

agents/status-reporter.md

@@ -1,6 +1,6 @@
 ---
 name: status-reporter
-description: Consolidated project status — plugins, token budget, git state, build, tests, GSD milestone. Read-only snapshot. Use to orient quickly at session start or after a break.
+description: Read-only project-status engine — dispatched by /status. Collects plugins, token budget, git state, build/tests, GSD milestone into one snapshot.
 tools: Read, Bash, Glob, Grep
 model: haiku
 ---
@@ -17,7 +17,7 @@ No modifications. No design. No proposals. Facts only.
 
 ```bash
 # Config version
-cat ~/.claude/version.txt 2>/dev/null || echo "unknown"
+cat ~/.claude/lib/../version.txt 2>/dev/null || echo "unknown"  # lib symlink resolves into the repo
 
 # Active plugins (from session-start detection)
 command -v rtk &>/dev/null && echo "rtk: installed" || echo "rtk: missing"

hooks/design-toolchain-reminder.sh

@@ -25,6 +25,12 @@ prompt="$(printf '%s' "$input" \
   2>/dev/null || true)"
 [ -z "$prompt" ] && prompt="$input"
 
+# Harness-generated turns (subagent/task notifications) are not user
+# requests — never fire on them (CLAUDE.md trigger = a design/UI *request*).
+case "$prompt" in
+  '<task-notification>'*) exit 0 ;;
+esac
+
 lc="$(printf '%s' "$prompt" | tr '[:upper:]' '[:lower:]')"
 
 # UI/design build and review signals (FR + EN). Word boundaries (\b) avoid

hooks/session-start.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # ============================================================
 # Claude Code — Session start plugin status
-# Runs once per session. Zero API calls. Filesystem only.
+# Runs once per session. Filesystem only, except one quiet
+# git fetch for the version/update check near the end.
 # ============================================================
 
 # ── Quick health check (filesystem only, no subprocesses) ──

install-plugins.sh

@@ -611,8 +611,7 @@ if command -v ctx7 &>/dev/null; then
   fi
   # CLI + Skills mode: install the find-docs skill into ~/.claude/skills when
   # absent (it is gitignored — ctx7 owns it, this regenerates it on a fresh
-  # clone). Guarded on absence so a re-run never clobbers a customized config
+  # clone). Guarded on absence so a re-run never clobbers a customized config.
-  # (setup also (re)writes ~/.claude/rules/context7.md).
   if [ ! -f "$HOME/.claude/skills/find-docs/SKILL.md" ]; then
     if ctx7 setup --claude --cli -y </dev/null &>/dev/null; then
       ok "ctx7 CLI + Skills configured (find-docs skill installed)"
@@ -620,6 +619,11 @@ if command -v ctx7 &>/dev/null; then
       warn "ctx7 setup failed — run manually: ctx7 setup --claude --cli"
     fi
   fi
+  # Single ctx7 surface = the find-docs skill (BDR-053). setup also (re)writes
+  # ~/.claude/rules/context7.md — a session-start duplicate of the skill
+  # (~490 tok/session, job1 F10). Purge it unconditionally so re-runs and
+  # manual `ctx7 setup` invocations stay rule-free.
+  rm -f "$HOME/.claude/rules/context7.md"
   info "Standalone usage:  ctx7 docs /vercel/next.js \"middleware\""
 fi
 

lib/gitflow-migrate.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-# gitflow-migrate.sh — migrate an existing repo to the gitflow model.
-#   LOCAL  (no token): gitflow init existing → master→main, develop, socle, hook.
-#   PROBE  (token, READ-ONLY): identity + scope/rights, before any write.
-#   REMOTE (token, DESTRUCTIVE): push, default→main, protection, delete master.
-#          Writes ordered reversible→irreversible; DELETE master is LAST and only
-#          runs if every prior step succeeded. Halts on first failure.
-# No `... | grep -q` under pipefail (SIGPIPE false-negative gotcha). Never echo the token.
-set -uo pipefail
-GITEA="${GITEA_URL:-https://git.bchanot.fr}"
-OWNER="${GITEA_OWNER:-bchanot}"
-
-# ── LOCAL half (token-free) ──────────────────────────────────────────────────
-migrate_local() {                      # <repo-path>
-  local repo="$1" renamed="no"
-  cd "$repo" || { echo "  ✗ cannot cd $repo" >&2; return 1; }
-  [ -z "$(git status --porcelain)" ] || { echo "  ✗ working tree not clean — stash/commit first" >&2; return 2; }
-  { [ -n "$(git config user.name)" ] && [ -n "$(git config user.email)" ]; } \
-    || { echo "  ✗ git identity unset (user.name/user.email) — set it before migrating $repo" >&2; return 3; }
-  git show-ref --verify -q refs/heads/master && renamed="yes"
-  bash "$HOME/.claude/lib/gitflow.sh" init || return 1
-  git show-ref --verify -q refs/heads/main    || { echo "  ✗ no main"    >&2; return 1; }
-  git show-ref --verify -q refs/heads/develop || { echo "  ✗ no develop" >&2; return 1; }
-  [ "$(git config core.hooksPath)" = ".githooks" ] || { echo "  ✗ hook not active" >&2; return 1; }
-  [ -z "$(git status --porcelain)" ] || { echo "  ✗ tree dirty after init" >&2; return 1; }
-  echo "  ✓ local: main+develop, hook active, tree clean (master→main: $renamed)"
-}
-
-# ── Gitea API helper (token in header only; never printed) ────────────────────
-_gitea() {                             # <METHOD> <api-path> [json-body]
-  local m="$1" p="$2" body="${3:-}"
-  curl -fsS -X "$m" -H "Authorization: token $GITEA_TOKEN" \
-       -H "Content-Type: application/json" ${body:+-d "$body"} "$GITEA/api/v1$p"
-}
-_json() { python3 -c "import sys,json;$1" 2>/dev/null; }   # tiny JSON field reader
-
-# ── PROBE (READ-ONLY: identity informational, rights = the real gate) ─────────
-# /user needs read:user (cosmetic — the migration never calls it) → informational.
-# The gates are the repo-scoped rights the writes actually require: admin+push on
-# the repo, and admin scope confirmed by a readable branch_protections list.
-gitea_probe() {                        # <repo-name to test rights against>
-  local name="$1" me pj perm
-  [ -n "${GITEA_TOKEN:-}" ] || { echo "  ✗ GITEA_TOKEN unset" >&2; return 1; }
-
-  # [a] identity — INFORMATIONAL (needs read:user scope the migration never uses)
-  if me=$(_gitea GET "/user" 2>/dev/null | _json "print(json.load(sys.stdin).get('login','?'))") && [ -n "$me" ]; then
-    echo "  ✓ token identity: $me"
-  else
-    echo "  ⚠ token identity unavailable (no read:user scope) — cosmetic, migration is repo-scoped"
-  fi
-
-  # [b] repo rights — GATE: admin AND push must be true (default_branch, protections, push)
-  pj=$(_gitea GET "/repos/$OWNER/$name") \
-     || { echo "  ✗ GET /repos/$OWNER/$name failed — token lacks repo read scope" >&2; return 1; }
-  perm=$(printf '%s' "$pj" | _json "p=json.load(sys.stdin).get('permissions',{});print('admin=%s push=%s pull=%s'%(p.get('admin'),p.get('push'),p.get('pull')))")
-  printf '%s' "$pj" | _json "p=json.load(sys.stdin).get('permissions',{});sys.exit(0 if (p.get('admin') and p.get('push')) else 1)" \
-     || { echo "  ✗ insufficient rights on $name ($perm) — need admin+push" >&2; return 1; }
-  echo "  ✓ rights on $name: $perm (admin+push confirmed)"
-
-  # [c] admin-scope canary — GATE: branch_protections readable (POST/PATCH/DELETE need repo-admin)
-  _gitea GET "/repos/$OWNER/$name/branch_protections" >/dev/null \
-     || { echo "  ✗ cannot read branch_protections — token lacks repo-admin scope; protection step would fail" >&2; return 1; }
-  echo "  ✓ repo-admin scope confirmed (branch_protections readable → POST/PATCH/DELETE OK)"
-}
-
-# ── REMOTE half (DESTRUCTIVE; reversible→irreversible; delete master LAST) ────
-_protect() {                           # <repo-name> <branch>  (Option 1: owner-pushable)
-  _gitea POST "/repos/$OWNER/$1/branch_protections" \
-    "{\"branch_name\":\"$2\",\"enable_push\":true,\"enable_push_whitelist\":true,\"push_whitelist_usernames\":[\"$OWNER\"]}"
-}
-migrate_remote() {                     # <repo-name>  (cwd = the local repo)
-  local name="$1"
-  [ -n "${GITEA_TOKEN:-}" ] || { echo "  ✗ GITEA_TOKEN unset" >&2; return 1; }
-  echo "  [1/4] push main + develop (ADDITIVE/reversible)…"
-  git push -u origin main    || { echo "  ✗ push main failed (push scope?) — STOP, nothing irreversible done" >&2; return 1; }
-  git push -u origin develop || { echo "  ✗ push develop failed — STOP" >&2; return 1; }
-  echo "  [2/4] default_branch → main (REVERSIBLE — scope canary)…"
-  _gitea PATCH "/repos/$OWNER/$name" '{"default_branch":"main"}' >/dev/null \
-    || { echo "  ✗ PATCH default_branch failed (admin/write scope?) — STOP before protection & delete" >&2; return 1; }
-  echo "  [3/4] branch protection main + develop (REVERSIBLE)…"
-  _protect "$name" main    >/dev/null || { echo "  ✗ protect main failed — STOP before delete" >&2; return 1; }
-  _protect "$name" develop >/dev/null || { echo "  ✗ protect develop failed — STOP before delete" >&2; return 1; }
-  echo "  [4/4] DELETE remote master (IRREVERSIBLE — last; default already repointed)…"
-  git push origin --delete master || { echo "  ✗ delete master failed (left in place — safe)" >&2; return 1; }
-  echo "  ✓ remote: default=main, main/develop protected (owner-pushable), remote master deleted"
-}
-
-if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
-  case "${1:-}" in
-    local)  migrate_local "$2" ;;
-    probe)  gitea_probe "$2" ;;
-    remote) migrate_remote "$2" ;;
-    *) echo "usage: gitflow-migrate.sh {local <repo>|probe <name>|remote <name>}" >&2; exit 2 ;;
-  esac
-fi

lib/tests/design-toolchain-reminder.test.sh

@@ -6,7 +6,7 @@ pass=0; fail=0
 check() { if [ "$2" = "$3" ]; then pass=$((pass+1)); else fail=$((fail+1));
   printf 'FAIL %s: got[%s] want[%s]\n' "$1" "$2" "$3"; fi; }
 # fire() -> "fire" if the hook emits the reminder, else "quiet".
-fire() { if printf '{"prompt":"%s"}' "$1" | bash "$H" | grep -q "design-toolchain"; then
+fire() { if printf '{"prompt":"%s"}' "$1" | bash "$H" | grep -q 'full toolchain'; then
   echo fire; else echo quiet; fi; }
 
 # --- Dropped/neutralized tokens must be QUIET (non-UI senses) ---
@@ -19,6 +19,10 @@ check D6-frontend    "$(fire 'frontend architecture')"         quiet
 check D7-palette     "$(fire 'a palette of options')"          quiet
 check D8-dash-file   "$(fire 'ecc_dashboard.py')"              quiet
 
+# --- Harness-generated inputs must be QUIET even with UI tokens ---
+check D9-tasknotif   "$(fire '<task-notification> <task-id>x</task-id> add css header fonts')" quiet
+check D10-notif-file "$(fire '<task-notification> design-motion-principles keyframe done')"    quiet
+
 # --- Real UI signals must still FIRE ---
 check F1-button      "$(fire 'add a button')"            fire
 check F2-navbar      "$(fire 'the navbar layout')"       fire

rules/README.md

@@ -23,9 +23,11 @@ Docs: https://code.claude.com/docs/en/memory.md#path-specific-rules
 
 ## Machine-owned files (gitignored, regenerated)
 
-- `context7.md` — written by `ctx7 setup --claude --cli`
+- `context7.md` — DELETED BY DESIGN (BDR-053, 2026-07-06): `ctx7 setup
-  (install-plugins.sh STEP ctx7). Not vendored: ctx7 owns its content
+  --claude --cli` still writes it, but install-plugins.sh STEP ctx7
-  and rewrites it on setup; the repo would fight the generator. Same
+  purges it right after — the find-docs skill is the single ctx7
-  treatment as `skills/find-docs/`.
+  surface; the rule was a ~490 tok/session session-start duplicate
+  (job1 F10). If it reappears (manual `ctx7 setup`), delete it or
+  re-run `make plugin`.
 
 Hand-written rules ARE tracked — add them normally.

settings.json

@@ -1,5 +1,10 @@
 {
   "cleanupPeriodDays": 30,
+  "attribution": {
+    "commit": "",
+    "pr": "",
+    "sessionUrl": false
+  },
   "permissions": {
     "allow": [
       "Bash(git status)",
@@ -36,8 +41,6 @@
       "Bash(uname *)",
       "Bash(mkdir -p *)",
       "Bash(touch *)",
-      "Bash(cp *)",
-      "Bash(mv *)",
       "Bash(jq *)",
       "Bash(yq *)",
       "Bash(awk *)",
@@ -146,6 +149,8 @@
       "Bash(find * -delete*)",
       "Bash(find * -exec rm*)",
       "Bash(find * -execdir rm*)",
+      "Bash(find * -exec *)",
+      "Bash(find * -execdir *)",
       "Bash(perl -e *)",
       "Bash(ruby -e *)",
       "Bash(cat .env)",
@@ -217,6 +222,8 @@
       "WebFetch",
       "Bash(xargs *)",
       "Bash(sed *)",
+      "Bash(cp *)",
+      "Bash(mv *)",
       "Bash(git stash pop*)",
       "Bash(git stash drop*)",
       "Bash(git stash clear)"
@@ -225,12 +232,7 @@
     "disableBypassPermissionsMode": "disable",
     "additionalDirectories": []
   },
-  "model": "claude-opus-4-8[1m]",
+  "model": "claude-fable-5[1m]",
-  "attribution": {
-    "commit": "",
-    "pr": "",
-    "sessionUrl": false
-  },
   "hooks": {
     "SessionStart": [
       {
@@ -315,6 +317,6 @@
   },
   "effortLevel": "xhigh",
   "remoteControlAtStartup": true,
-  "skipAutoPermissionPrompt": true,
+  "inputNeededNotifEnabled": true,
-  "inputNeededNotifEnabled": true
+  "skipAutoPermissionPrompt": true
 }

skills/commit-change/SKILL.md

@@ -1,6 +1,5 @@
 ---
 name: commit-change
-version: 1.0.0
 description: |
   Analyze all pending changes (staged, unstaged, untracked) and create
   atomic commits grouped by logical unit, retracing the work. Any git

skills/graphify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: graphify
-description: "Use for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools."
+description: "Use when graphify-out/ exists (or the user asks to build a knowledge graph): questions about the codebase, its architecture, file relationships, or project content are then treated as graphify queries first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools."
 ---
 
 # /graphify

skills/harden/SKILL.md

@@ -8,7 +8,7 @@ description: |
   Triggers: "harden", "security headers", "csp", "hsts", "https/ssl
   audit", "redirect audit", "durcissement web", "entêtes sécurité".
   Meta/sitemap/CWV → /seo. llms.txt/AI → /geo. Secrets/CVE/OWASP → /cso.
-argument-hint: [URL] [--fix] [--local|--full] [--no-external]
+argument-hint: "[URL] [--fix] [--local|--full] [--no-external]"
 allowed-tools:
   - Read
   - Edit

skills/init-project/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: init-project
-description: Use when initializing a brand-new project from scratch — needs interview, design, scaffold, and TDD implementation. Multi-agent orchestrator: plugin-advisor + interviewer + analyzer + scaffolder with two validation gates. Triggers: "init project", "new project", "start project from scratch", "scaffold project", "init-project".
+description: 'Use when initializing a brand-new project from scratch — needs interview, design, scaffold, and TDD implementation. Multi-agent orchestrator: plugin-advisor + interviewer + analyzer + scaffolder with two validation gates. Triggers: "init project", "new project", "start project from scratch", "scaffold project", "init-project".'
 argument-hint: <project idea or description>
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

skills/onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: onboard
-description: Use when bringing an existing repo into the claude-config framework — needs archetype detection, config install, full multi-axis audit (debt/SEO/GEO/UI-UX/perf/security/a11y/docs), and prioritized backlog. Multi-agent orchestrator. Do NOT use for repos created via /init-project. Triggers: "onboard", "onboard project", "audit existing repo", "setup existing project".
+description: 'Use when bringing an existing repo into the claude-config framework — needs archetype detection, config install, full multi-axis audit (debt/SEO/GEO/UI-UX/perf/security/a11y/docs), and prioritized backlog. Multi-agent orchestrator. Do NOT use for repos created via /init-project. Triggers: "onboard", "onboard project", "audit existing repo", "setup existing project".'
-argument-hint: [optional hints: "Python FastAPI" | "add gsd" | "Next.js monorepo" | "force-archetype:wordpress"]
+argument-hint: '[optional hints: "Python FastAPI" | "add gsd" | "Next.js monorepo" | "force-archetype:wordpress"]'
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, Agent, Skill
 ---
 

skills/plugin-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: plugin-check
-description: Audit active plugins vs project needs. Read-only advisory recommending enable/disable. Triggers: "plugin-check", "quels plugins".
+description: 'Audit active plugins vs project needs. Read-only advisory recommending enable/disable. Triggers: "plugin-check", "quels plugins".'
-argument-hint: [ex: "React + FastAPI" or "Rust CLI, no frontend"]
+argument-hint: '[ex: "React + FastAPI" or "Rust CLI, no frontend"]'
 allowed-tools: Read, Bash, Glob, Grep
 ---
 

skills/refactor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: refactor
-description: Improve code quality without changing behavior — strict norm enforcement. Triggers: "refactor", "clean up code", "normaliser".
+description: 'Improve code quality without changing behavior — strict norm enforcement, targeted scope (file/module). Full-codebase audit+cleanup → /code-clean. Triggers: "refactor", "clean up code", "normaliser".'
 argument-hint: <file, function, or module to refactor>
 allowed-tools: Read, Write, Edit, Grep, Glob, Bash
 ---

skills/release-candidate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: release-candidate
-description: Use when develop is ahead of main and you want to cut a versioned release — finalize version.txt + CHANGELOG, merge develop→main via the gitflow fan-out, tag it, and push. Triggers: "cut a release", "release candidate", "tag a version", "ship develop to main". NOT feature/bugfix integration (that is gitflow finish via /ship-feature) nor a hotfix.
+description: 'Use when develop is ahead of main and you want to cut a versioned release — finalize version.txt + CHANGELOG, merge develop→main via the gitflow fan-out, tag it, and push. Triggers: "cut a release", "release candidate", "tag a version", "ship develop to main". NOT feature/bugfix integration (that is gitflow finish via /ship-feature) nor a hotfix.'
 ---
 
 # /release-candidate — cut a gitflow release (orchestrator)

skills/ship-feature/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ship-feature
-description: Use when shipping a new feature end-to-end — needs design brainstorm, planning, TDD implementation with subagents, error recovery, code review, and finish. Multi-agent orchestrator (9-step pipeline). Triggers: "ship feature", "ship-feature", "build and merge", "feature end-to-end", "implement and ship".
+description: 'Use when shipping a new feature end-to-end — needs design brainstorm, planning, TDD implementation with subagents, error recovery, code review, and finish. Multi-agent orchestrator (9-step pipeline). Triggers: "ship feature", "ship-feature", "build and merge", "feature end-to-end", "implement and ship".'
 argument-hint: <feature description>
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

skills/status/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: status
-description: Consolidated project snapshot — plugins, token cost, git state, recent commits, GSD v2 milestone progress. Read-only. Run at session start or after a break. Triggers: "status", "sitrep", "where are we", "project state", "after break".
+description: 'Consolidated project snapshot — plugins, token cost, git state, recent commits, GSD v2 milestone progress. Read-only. Run at session start or after a break. Open-work reconciliation (stale TODO vs real git) → /reconcile. Triggers: "status", "sitrep", "where are we", "project state", "after break".'
 argument-hint: (no arguments needed)
 allowed-tools: Read, Bash, Glob, Grep
 ---

skills/tour/SKILL.md

@@ -4,14 +4,11 @@ description: |
   Use when the user wants ONE grouped pass over a whole project (or a
   list of projects) covering all hygiene axes together: code cleanup +
   security (semgrep/cso) + TODO-vs-reality check + doc sync, auto-fixing
-  and re-auditing until a clean pass. Use it whenever the user asks for
+  and re-auditing until a clean pass — even without naming the axes.
-  a "tour" of their projects, a grouped/combined audit-and-fix, or a
-  periodic all-axes sweep — even without naming the axes.
   NOT one axis alone (/code-clean, /cso, /audit-delta, /reconcile, /doc),
   one bug (/hotfix, /bugfix), dashboard (/health), branch diff (/review).
   Triggers: "tour", "tir groupé", "grand ménage", "fais un tour sur les
-  projets", "sweep", "full pass", "vérifie et corrige tout", "passe
+  projets", "sweep", "full pass", "vérifie et corrige tout".
-  tout au propre".
 argument-hint: "[project paths… — blank = current repo] [--report-only]"
 allowed-tools:
   - Read

skills/web-validate/SKILL.md

@@ -7,7 +7,7 @@ description: |
   Triggers: "validate", "w3c", "wcag", "a11y", "accessibility", "axe",
   "pa11y", "accessibilité", "conformité web".
   CSP/HSTS/404 → /harden. Meta/sitemap → /seo. AI engines → /geo.
-argument-hint: [URL] [--fix] [--local|--full] [--no-external]
+argument-hint: "[URL] [--fix] [--local|--full] [--no-external]"
 allowed-tools:
   - Read
   - Edit