Merge release/1.3.1 into main

- Fresh-install block: clone URL → github.com/bchanot/claude, bash
  install.sh/doctor.sh → make install / make doctor (user pass)
- magic MCP example: placeholder key line instead of WRONG/RIGHT contrast
- new subsection: SEO data layer needs GOOGLE_OAUTH_CLIENT_ID/SECRET +
  CRUX_API_KEY in ~/.claude/.env (GCP steps, make seo-connect, graceful
  degradation) — mirrors .env.example

.claude/memory/journal.md

@@ -418,3 +418,4 @@ rules:
 - ctx7 coverage audit (user ask "ctx7 appelé à chaque techno ?") → verdict PARTIAL. 4 gaps: find-docs question-only, /feat //bugfix executors blind, ad-hoc coding uncovered, fast-libs hardcoded 3×. All 4 closed → BDR-078 (fast-libs.sh single source + ctx7-reminder hook + description trigger + executor-brief rule). fast-libs test 11/0, make test + review-guards green. feature/ctx7-coverage, UNMERGED.
 - v1.2.0 cut + pushed (release-candidate flow: prep/finish via release-executor, tag on main 51b6572). CHANGELOG backfilled at prep: 10 entries added to Unreleased (plan-challenge, seo-data verbs, model-tiering v2, integrity pass, safe_fetch/url-guard) — was ctx7-only. /doc full post-release: README model-routing table v1→v2 reframe + ctx7 two-surface wording, chore/doc-sync-v1.2.0 merged. All pushed on explicit go.
 - profile↔toggle-external audit (user) → enable side already symmetric (gstack on-demand LIVE), disable side missing → BDR-079: MANAGED_EXTERNALS+MANAGED_MCPS trim at set, external from-source fallback, 16-check hermetic test (claude shim). feature/profile-managed-externals, UNMERGED.
+- README rebuilt: short pitch (what/how/why) top, old content → reference manual below separator. Dedup title/overview/install block, hardcoded version dropped from footer (staleness risk). chore/readme-v2 merged → develop, pushed.

CHANGELOG.md

@@ -6,9 +6,30 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
 
 ## [Unreleased]
 
+## [1.3.1] — 2026-07-20
+
+### Changed
+- **README rebuilt around a short pitch** — new top half: what it is / how
+  it works / why it's good in ~60 lines (skills = entry points, agents =
+  model-tiered execution units, hooks = deterministic guardrails,
+  templates/memory = compounding per-project registries); all previous
+  content demoted to an explicit reference-manual half below a separator.
+  Deduplicated in the process: old title/tagline, Overview prose and the
+  duplicated fresh-install block removed (unique install notes kept under
+  a new "Install notes" section); hardcoded version number dropped from
+  the footer (staleness risk). Docs-only release — no code change.
+
+## [1.3.0] — 2026-07-20
+
 ### Added
 - **Profile switches now toggle external packs and MCPs both ways (BDR-079)** — `profile.sh set` was asymmetric: it enabled what a profile listed (including gstack skills on demand when the whole pack is off, and the `magic` MCP) but never disabled the managed leftovers, so `set backend` after design work kept emil-design-eng / frontend-design / design-motion-principles / impeccable active and magic registered. `set` now trims managed externals (`MANAGED_EXTERNALS`) and managed MCPs (`MANAGED_MCPS`, delegated to `toggle-external.sh`) not listed in the profile — same allowlist doctrine as `MANAGED_PLUGINS`, nothing outside the allowlists is ever auto-touched (darwin-skill stays manual). Also: an `external` entry whose symlink never existed is now created from `skills-external/` (mirroring toggle-external's from-source path), and the stale "NOT toggled automatically" note in `profile.sh` usage was corrected. Covered by a hermetic 16-check test (`lib/tests/profile-set-managed.test.sh`) with a fake `claude` shim.
 
+### Changed
+- **README restructured for public readers** — the project-layout tree and architecture principles moved verbatim to a new `ARCHITECTURE.md` (README links it); bare decision-registry citations (`BDR-XXX`) stripped from README prose, meaning preserved; `/profile` documentation corrected in three places to the real 10-profile set (web / seo / web-full / full / backend / design / dev / qa / audit / minimal); fresh-install block now uses the real clone URL + `make install` / `make doctor`; new "SEO data layer" subsection documents the `GOOGLE_OAUTH_CLIENT_ID` / `GOOGLE_OAUTH_CLIENT_SECRET` / `CRUX_API_KEY` vars in `~/.claude/.env` (mirrors `.env.example`, `make seo-connect` one-time consent).
+
+### Fixed
+- **Transient planning artifacts purged from the repo** — `docs/plans`, `docs/specs`, `docs/superpowers/{plans,specs}` (deploy-skill 2026-06-27, model-routing 2026-07-15) were run-time pipeline artifacts that should have been deleted in their chantiers' post-merge cleanup and slipped through (one pair predates the lifecycle rule, one missed the purge step of a 6-wave chantier). Git history at the feature commits remains their archive; `docs/` no longer exists.
+
 ## [1.2.1] — 2026-07-20
 
 ### Fixed

README.md

@@ -1,21 +1,67 @@
 # claude-config
 
-Global Claude Code configuration — agents, skills, plugins, and project templates.
+One repo that turns Claude Code into a reproducible engineering system —
+skills, agents, hooks, plugins, and per-project memory, versioned and
+symlinked into `~/.claude/`. Clone it on any machine, run one command,
+and every project gets the same assistant with the same rules.
 
-> **Guide d'utilisation complet :** voir [`USAGE.md`](./USAGE.md) — workflows typiques, exemples par type de projet, arbre de décision "quel skill utiliser ?".
+## What it is
-> **Historique des versions :** voir [`CHANGELOG.md`](./CHANGELOG.md).
+
+Not a collection of prompts — an operating layer on top of Claude Code:
+
+- **Skills** (`/feat`, `/bugfix`, `/ship-feature`, `/seo`, `/tour`…) are the
+  entry points: each one encodes a complete workflow, from quick fix to
+  full feature pipeline with validation gates.
+- **Agents** are the execution units skills dispatch to — each pinned to
+  the cheapest model that can do the job (haiku collects, sonnet executes,
+  opus judges, the session model only reflects).
+- **Hooks and permissions** are deterministic guardrails: gitflow enforced
+  by a pre-commit hook, deny-first permission rules, secrets kept in
+  `~/.claude/.env` and never in config files.
+- **Templates and memory** seed every project with persistent registries
+  (decisions, learnings, blockers) — what a session learns, the next
+  session knows.
+
+## How it works
+
+```bash
+git clone --recurse-submodules https://github.com/bchanot/claude
+cd claude
+make install     # CLI + auth + symlinks + plugins (pinned in plugins.lock.json)
+make doctor      # verify everything
+```
+
+`link.sh` symlinks the repo into `~/.claude/`, so editing here updates the
+live config — and `git log` is the audit trail of your entire setup.
+Day to day:
+
+```bash
+/onboard            # bring an existing repo into the framework
+/ship-feature "…"   # brainstorm → plan → adversarial challenge → TDD → review → merge
+/feat "…"           # same idea, 1-5 files, no ceremony
+/close              # flush decisions and learnings to memory before quitting
+make update         # keep CLI, plugins, and submodules current
+```
+
+## Why it's good
+
+- **Reproducible.** One clone rebuilds the whole environment; versions are
+  locked, `make doctor` proves it works.
+- **Cost-shaped.** Model tiering routes reflection to the big model and
+  execution to cheap ones — the expensive context does only what it must.
+- **Safe by default.** Protected branches, ask-before-run on risky tools,
+  parameterized secrets: the guardrails are code, not good intentions.
+- **It compounds.** Memory registries, audit skills, and doc-sync keep every
+  project's knowledge growing across sessions instead of evaporating.
 
 ---
 
-## Overview
+Everything below is the reference manual — model routing, components,
+commands, settings, secrets, maintenance.
 
-This repo is your personal Claude Code setup, versioned and reproducible across machines.
+---
 
-See [`ARCHITECTURE.md`](./ARCHITECTURE.md) for the full project layout and
+## Agent model routing (model-tiering v2)
-structural principles (skills = entry points, agents = execution units,
-templates = per-project scaffolding, graphify = codebase knowledge graph).
-
-### Agent model routing (model-tiering v2)
 
 Doctrine: the session model (Fable) does main-loop reflection ONLY —
 brainstorm, plan, contract, audit judgment, gates, loop decisions — enforced
@@ -47,21 +93,7 @@ children are dispatched `model:"fable"` (they carry reflection).
 
 ---
 
-## Fresh install (new machine)
+## Install notes
-
-```bash
-# 1. Clone with submodules
-git clone --recurse-submodules git@github.com:youruser/claude-config.git
-cd claude-config
-
-# 2. Bootstrap (CLI + auth + symlinks + plugins)
-bash install.sh
-
-# 3. Verify setup
-bash doctor.sh
-
-# 4. Restart Claude Code — plugins load automatically
-```
 
 All scripts use their own location to find the repo — run them from anywhere.
 The plugins step logs to `install-YYYYMMDD-HHMMSS.log`.
@@ -221,10 +253,8 @@ in `env`, `command`, `args`, `url`, and `headers` — for both project (`.mcp.js
 and user (`~/.claude.json`) scope. Use that instead of a literal value:
 
 ```bash
-# WRONG — plaintext key lands in ~/.claude.json:
+MAGIC_API_KEY=<Enter your magic api key here from https://21st.dev/settings/api-keys >
-claude mcp add magic --scope user --env API_KEY="$MAGIC_API_KEY" -- npx -y @21st-dev/magic@latest
+# single-quoted so bash doesn't expand it; Claude Code expands it at
-
-# RIGHT — single-quoted so bash doesn't expand it; Claude Code expands it at
 # launch, reading the var from its own process environment:
 claude mcp add magic --scope user --env 'API_KEY=${MAGIC_API_KEY}' -- npx -y @21st-dev/magic@latest
 ```
@@ -242,6 +272,26 @@ There is no `claude mcp add` flag that writes the reference form for you —
 the `${VAR}` syntax has to be typed by hand (or via a wrapper script), same as
 above.
 
+### SEO data layer (`/seo` FULL) — Google OAuth + CrUX keys
+
+The same `~/.claude/.env` also feeds `lib/seo-data`, which pulls real Google
+Search Console and Chrome UX Report data into `/seo` FULL audits. Add these
+three vars (template with the GCP console steps in `.env.example`):
+
+```bash
+# OAuth Desktop client — GCP console → APIs & Services → Credentials →
+# OAuth client (Desktop). Consent scope: webmasters.readonly only.
+GOOGLE_OAUTH_CLIENT_ID=<your-client-id.apps.googleusercontent.com>
+GOOGLE_OAUTH_CLIENT_SECRET=<your-client-secret>
+# CrUX + PageSpeed API key — GCP console → Credentials → API key,
+# restricted to those two APIs. https://developer.chrome.com/docs/crux/api
+CRUX_API_KEY=<your-crux-api-key>
+```
+
+Then run the one-time consent flow: `make seo-connect` (per-label token
+store, multi-site safe). Missing credentials never break an audit — `/seo`
+degrades gracefully to anonymous PageSpeed lab data.
+
 ### magic MCP (`@21st-dev/magic`) — known callback-injection risk
 
 `21st_magic_component_builder` opens an **unauthenticated** local callback
@@ -288,3 +338,11 @@ make new-skill name=myskill # scaffold agent + skill files
 ```
 
 `doctor.sh` checks: symlinks, GStack submodule, prerequisites (git, Node, Cargo, Python, Claude Code), plugins, permissions, token budget, config consistency.
+
+---
+
+## Going further
+
+[`USAGE.md`](./USAGE.md) — workflows and skill decision tree ·
+[`ARCHITECTURE.md`](./ARCHITECTURE.md) — layout and principles ·
+[`CHANGELOG.md`](./CHANGELOG.md) — version history.

version.txt

@@ -1 +1 @@
-1.2.1
+1.3.1