Merge chore/job2-fixes into develop

.claude/memory/journal.md

@@ -338,3 +338,4 @@ rules:
 - job2 config-smell audit shipped read-only: `.audit/job2-report.md` — surface skills/agents/hooks/plugins/settings(.local), 17 findings (3 RISK perms, 6 DRIFT, 2 BLOAT, 3 OVERLAP, 2 DEAD, 1 struct), 26 diffs base c6d5e03, 0 decision-conflicts, all fresh-context verified [[EVAL-017]]. Live catch: design hook fired on audit's own task-notifications (14/20 recent fires).
 - Brief premise corrected: Edit/Bash(hooks/*.sh) permission rule NEVER existed — was config-protection case arm (:37) + job1 sentinel bypasses. Phase-0 UNREFERENCED metrics 100% broken (grep -q kills -l).
 - User GO full execution incl. 3 RISK: cp/mv→ask, find -exec deny mirror, settings.local prune (python3 -, rtk git *). F9 fable default committed (user re-chose via /model), F16 gitflow-migrate.sh removed (git-recoverable), F8/find-docs skip (generator-owned). Executor = Sonnet subagent on chore/job2-fixes, NO finish.
+- job2 EXECUTED: 15 commits chore/job2-fixes, all diffs first-try, `make test` wired + first-ever full run ALL GREEN (gitflow 71/0). Measured −309 tok/session (agents 4840→3609 chars); design hook no longer fires on task-notifications. Executor STOP exercised for real: F4 gate red → root-caused to job1 oracle regression (3f639b3), fixed as [[LRN-104]]; 2nd YAML error/file unmasked (onboard/plugin-check) → closed 6a3b197. Skips: F8 (npx skills has no re-pin verb), find-docs (ctx7). Open: F8 route, find-docs/ctx7 (couple job1-F10), merged on user GO.

.claude/memory/learnings.md

@@ -1058,3 +1058,11 @@ rules:
 - **context**: 2026-07-06, job1 audit follow-up (.audit/job1-report.md, finding F13). BLK-009 closed same session; workaround it forced ([[BDR-031]] unconditional + compressed global CLAUDE.md) no longer required by this bug specifically, though BDR-031 itself stands on its own merits pending separate review.
 - **future application**: before acting on ANY open upstream/tool blocker cited to justify a fix, a caveat, or a design constraint — re-probe it live if cheap, don't just trust the registry's last-recorded status.
 - **cousin**: [[BLK-009]] closed this session; [[BDR-031]] (the workaround this bug forced).
+
+## LRN-104 — a hook's output message is part of its test contract; no runner = regression invisible
+
+- **pattern**: job1 F14 (`3f639b3`) changed design-hook stdout to pointer-only; test oracle grepped old literal `design-toolchain` → 9 fire-checks silently red 3 days. Hook itself fine — broken oracle, not broken behavior. Caught ONLY when job2 executor ran the suite as its F4 gate; zero runner existed before (job2 F10). Fix: oracle synced to durable fragment `full toolchain` (heading BDR-021 requires the hook to quote verbatim) + `make test` target wired.
+- **why**: an untested output string IS an interface — its test must anchor on the durable contract part (the mandated heading), not incidental wording. No automated runner → oracle drift accumulates unseen; "18 checks lock it" ([[LRN-091]]) protected nothing while nothing ran them.
+- **2nd facet**: audit yaml.safe_load stops at FIRST error/file — fixing error #1 unmasked pre-existing error #2 (onboard/plugin-check argument-hint). Verify errors-per-file exhaustively, not error-presence.
+- **future application**: change any hook/script output consumed by a test → run its test same commit. `make test` now the deterministic backstop (job2 F10). Audit parse-checks: iterate until file fully clean, count errors not booleans.
+- **cousin**: [[LRN-091]] (the lock that never ran), [[LRN-096]] (a guard is code, prove it can fail), [[EVAL-017]].

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help install plugin link doctor update new-skill profile profile-list profile-current profile-reset onboard
+.PHONY: help install plugin link doctor update new-skill profile profile-list profile-current profile-reset onboard test
 
 help: ## Show available commands
 	@grep -E '^[a-zA-Z_-]+:.*##' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*## "}; {printf "  make %-14s %s\n", $$1, $$2}'
@@ -22,6 +22,10 @@ onboard: link ## Onboard an existing project (run from the project directory)
 	@echo "Open Claude Code in your project directory and run: /onboard"
 	@echo "Or with hints: /onboard Python FastAPI monorepo"
 
+test: ## Run deterministic tests (lib/tests/*.test.sh + lib/gitflow-test.sh)
+	@fail=0; for t in lib/tests/*.test.sh lib/gitflow-test.sh; do \
+		echo "== $$t"; bash "$$t" || fail=1; done; exit $$fail
+
 profile: ## Run profile.sh (usage: make profile cmd="set design")
 	@bash lib/profile.sh $(cmd)
 

agents/bugfixer.md

@@ -1,6 +1,6 @@
 ---
 name: bugfixer
-description: Structured bug fix with root cause investigation. Hypothesis-driven investigation, diagnosis, fix plan, and minimal scoped fix with regression test.
+description: Root-cause bug-fix executor — dispatched by /bugfix. Hypothesis-driven investigation, diagnosis, minimal scoped fix with regression test.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 

agents/client-handover-writer.md

@@ -1,6 +1,6 @@
 ---
 name: client-handover-writer
-description: Final ship-and-handover orchestrator. Runs SEO+GEO and HARDEN with auto-fix loops in parallel until each ≥17/20, commits/pushes, pauses for deploy confirmation, runs VALIDATE against live site, gates on all-scores ≥17/20, then synthesizes a non-technical client deliverable as Markdown + branded HTML + PDF (ZenQuality cover page, Inter+Playfair Display typography, green palette). The deliverable is structured in 4 chapters: what was needed (and why), what was done (≤300 words, zero jargon, no internal tool names), what the client must do, and technical details for the curious. Reads git history + .claude/memory/ registries. Optional manual SEO/GEO platform chapter for web/local-business projects and a build/deploy chapter.
+description: Final ship-and-handover orchestrator — called by /client-handover. Runs SEO+GEO+HARDEN auto-fix loops to ≥17/20, gates on live VALIDATE, then writes the non-technical client deliverable (Markdown + branded HTML + PDF).
 tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch, AskUserQuestion, Agent
 model: opus
 ---

agents/commit-changer.md

@@ -1,6 +1,6 @@
 ---
 name: commit-changer
-description: Analyze all changes since the last commit and create commits that retrace the development steps — one commit per logical step, in the order work happened.
+description: Retrace-and-commit engine — dispatched by /commit-change. Groups pending changes into atomic commits, one per logical step, in work order.
 tools: Bash, Read, Grep, Glob, Agent, AskUserQuestion
 ---
 

agents/doc-syncer.md

@@ -1,6 +1,6 @@
 ---
 name: doc-syncer
-description: Detect stale PUBLIC documentation by cross-referencing git history against the project's doc layout (README, INSTALL, CONFIGURE, USAGE, DEPLOY, CONTRIBUTING, CHANGELOG, SECURITY, ARCHITECTURE, LICENSE, docs/**). Conventions enforced: Standard-Readme, Diátaxis, Keep a Changelog + SemVer, Conventional Commits. Reads .claude/ for context only, never modifies or exposes it. Stack-aware deploy-doc gating (DEPLOY.md only when non-trivial). Enforces README presence. Audit, report, patch. Full audit, clean mode, and automatic (silent) mode.
+description: Detect stale PUBLIC documentation by cross-referencing git history against the doc layout (README, CHANGELOG, docs/**…) — dispatched by /doc and orchestrators. Convention-aware (Diátaxis, Keep a Changelog); never touches .claude/. Audit, report, patch.
 tools: Read, Write, Edit, Bash, Grep, Glob
 model: sonnet
 ---

agents/feater.md

@@ -1,6 +1,6 @@
 ---
 name: feater
-description: Small feature implementation (1-5 files). Light planning, direct implementation, no heavy orchestration. No design brainstorm, no subagents, no plugin check gate.
+description: Small-feature implementer (1-5 files) — dispatched by /feat, which owns branching and gates. Light planning, direct implementation, no heavy orchestration.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 

agents/geo-analyzer.md

@@ -1,6 +1,6 @@
 ---
 name: geo-analyzer
-description: Professional GEO (Generative Engine Optimization) audit agent. Optimises sites for AI search engines — ChatGPT, Claude, Perplexity, Gemini, Google AI Overviews, Copilot. Audits AI crawlers, llms.txt, entity signals, Schema.org for AI, content shape, AI visibility. Autonomous code fixes, scored report, prioritized action plan.
+description: GEO audit agent for AI search engines — dispatched by /geo and /seo. Audits AI crawlers, llms.txt, entity signals, Schema.org; autonomous fixes, scored report. Classical SEO → seo-analyzer agent.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent, WebFetch, WebSearch
 ---
 

agents/hotfixer.md

@@ -1,6 +1,6 @@
 ---
 name: hotfixer
-description: Quick fix for superficial bugs (typos, CSS issues, config errors, off-by-one, wrong variable name, missing import, broken link). Max 2 files, obvious root cause only.
+description: Quick-fix executor — dispatched by /hotfix, which owns the routing and gitflow gate. Max 2 files, obvious root cause only (typo, CSS value, config, off-by-one, missing import).
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent
 ---
 

agents/plugin-advisor.md

@@ -1,6 +1,6 @@
 ---
 name: plugin-advisor
-description: Check active plugins vs project needs. Recommend enable/disable before starting work. Gate before init-project and ship-feature.
+description: Plugin-fit checker — dispatched by /plugin-check and orchestrator gates (init-project, ship-feature). Recommends enable/disable.
 tools: Read, Bash, Glob, Grep
 model: haiku
 ---

agents/seo-analyzer.md

@@ -1,6 +1,6 @@
 ---
 name: seo-analyzer
-description: Professional classical SEO audit agent. Targets traditional search engines (Google, Bing, DuckDuckGo). Live site audit, Core Web Vitals, on-page (meta, headings, images, video, a11y, i18n), technical (HTTP, security headers, redirects, indexability), SEO local (NAP, GMB, citations), competitive analysis, legal compliance (FR). Autonomous code fixes, scored report, prioritized action plan. GEO / AI optimization is handled by the geo-analyzer agent.
+description: Classical SEO audit agent (Google, Bing) — dispatched from /seo. Live audit: Core Web Vitals, on-page, technical, local SEO, legal (FR). Autonomous fixes + scored report. AI/GEO → geo-analyzer agent.
 tools: Read, Edit, Write, Bash, Grep, Glob, Agent, WebFetch, WebSearch
 ---
 

agents/status-reporter.md

@@ -1,6 +1,6 @@
 ---
 name: status-reporter
-description: Consolidated project status — plugins, token budget, git state, build, tests, GSD milestone. Read-only snapshot. Use to orient quickly at session start or after a break.
+description: Read-only project-status engine — dispatched by /status. Collects plugins, token budget, git state, build/tests, GSD milestone into one snapshot.
 tools: Read, Bash, Glob, Grep
 model: haiku
 ---
@@ -17,7 +17,7 @@ No modifications. No design. No proposals. Facts only.
 
 ```bash
 # Config version
-cat ~/.claude/version.txt 2>/dev/null || echo "unknown"
+cat ~/.claude/lib/../version.txt 2>/dev/null || echo "unknown"  # lib symlink resolves into the repo
 
 # Active plugins (from session-start detection)
 command -v rtk &>/dev/null && echo "rtk: installed" || echo "rtk: missing"

hooks/design-toolchain-reminder.sh

@@ -25,6 +25,12 @@ prompt="$(printf '%s' "$input" \
   2>/dev/null || true)"
 [ -z "$prompt" ] && prompt="$input"
 
+# Harness-generated turns (subagent/task notifications) are not user
+# requests — never fire on them (CLAUDE.md trigger = a design/UI *request*).
+case "$prompt" in
+  '<task-notification>'*) exit 0 ;;
+esac
+
 lc="$(printf '%s' "$prompt" | tr '[:upper:]' '[:lower:]')"
 
 # UI/design build and review signals (FR + EN). Word boundaries (\b) avoid

hooks/session-start.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # ============================================================
 # Claude Code — Session start plugin status
-# Runs once per session. Zero API calls. Filesystem only.
+# Runs once per session. Filesystem only, except one quiet
+# git fetch for the version/update check near the end.
 # ============================================================
 
 # ── Quick health check (filesystem only, no subprocesses) ──

lib/gitflow-migrate.sh

@@ -1,95 +0,0 @@
-#!/usr/bin/env bash
-# gitflow-migrate.sh — migrate an existing repo to the gitflow model.
-#   LOCAL  (no token): gitflow init existing → master→main, develop, socle, hook.
-#   PROBE  (token, READ-ONLY): identity + scope/rights, before any write.
-#   REMOTE (token, DESTRUCTIVE): push, default→main, protection, delete master.
-#          Writes ordered reversible→irreversible; DELETE master is LAST and only
-#          runs if every prior step succeeded. Halts on first failure.
-# No `... | grep -q` under pipefail (SIGPIPE false-negative gotcha). Never echo the token.
-set -uo pipefail
-GITEA="${GITEA_URL:-https://git.bchanot.fr}"
-OWNER="${GITEA_OWNER:-bchanot}"
-
-# ── LOCAL half (token-free) ──────────────────────────────────────────────────
-migrate_local() {                      # <repo-path>
-  local repo="$1" renamed="no"
-  cd "$repo" || { echo "  ✗ cannot cd $repo" >&2; return 1; }
-  [ -z "$(git status --porcelain)" ] || { echo "  ✗ working tree not clean — stash/commit first" >&2; return 2; }
-  { [ -n "$(git config user.name)" ] && [ -n "$(git config user.email)" ]; } \
-    || { echo "  ✗ git identity unset (user.name/user.email) — set it before migrating $repo" >&2; return 3; }
-  git show-ref --verify -q refs/heads/master && renamed="yes"
-  bash "$HOME/.claude/lib/gitflow.sh" init || return 1
-  git show-ref --verify -q refs/heads/main    || { echo "  ✗ no main"    >&2; return 1; }
-  git show-ref --verify -q refs/heads/develop || { echo "  ✗ no develop" >&2; return 1; }
-  [ "$(git config core.hooksPath)" = ".githooks" ] || { echo "  ✗ hook not active" >&2; return 1; }
-  [ -z "$(git status --porcelain)" ] || { echo "  ✗ tree dirty after init" >&2; return 1; }
-  echo "  ✓ local: main+develop, hook active, tree clean (master→main: $renamed)"
-}
-
-# ── Gitea API helper (token in header only; never printed) ────────────────────
-_gitea() {                             # <METHOD> <api-path> [json-body]
-  local m="$1" p="$2" body="${3:-}"
-  curl -fsS -X "$m" -H "Authorization: token $GITEA_TOKEN" \
-       -H "Content-Type: application/json" ${body:+-d "$body"} "$GITEA/api/v1$p"
-}
-_json() { python3 -c "import sys,json;$1" 2>/dev/null; }   # tiny JSON field reader
-
-# ── PROBE (READ-ONLY: identity informational, rights = the real gate) ─────────
-# /user needs read:user (cosmetic — the migration never calls it) → informational.
-# The gates are the repo-scoped rights the writes actually require: admin+push on
-# the repo, and admin scope confirmed by a readable branch_protections list.
-gitea_probe() {                        # <repo-name to test rights against>
-  local name="$1" me pj perm
-  [ -n "${GITEA_TOKEN:-}" ] || { echo "  ✗ GITEA_TOKEN unset" >&2; return 1; }
-
-  # [a] identity — INFORMATIONAL (needs read:user scope the migration never uses)
-  if me=$(_gitea GET "/user" 2>/dev/null | _json "print(json.load(sys.stdin).get('login','?'))") && [ -n "$me" ]; then
-    echo "  ✓ token identity: $me"
-  else
-    echo "  ⚠ token identity unavailable (no read:user scope) — cosmetic, migration is repo-scoped"
-  fi
-
-  # [b] repo rights — GATE: admin AND push must be true (default_branch, protections, push)
-  pj=$(_gitea GET "/repos/$OWNER/$name") \
-     || { echo "  ✗ GET /repos/$OWNER/$name failed — token lacks repo read scope" >&2; return 1; }
-  perm=$(printf '%s' "$pj" | _json "p=json.load(sys.stdin).get('permissions',{});print('admin=%s push=%s pull=%s'%(p.get('admin'),p.get('push'),p.get('pull')))")
-  printf '%s' "$pj" | _json "p=json.load(sys.stdin).get('permissions',{});sys.exit(0 if (p.get('admin') and p.get('push')) else 1)" \
-     || { echo "  ✗ insufficient rights on $name ($perm) — need admin+push" >&2; return 1; }
-  echo "  ✓ rights on $name: $perm (admin+push confirmed)"
-
-  # [c] admin-scope canary — GATE: branch_protections readable (POST/PATCH/DELETE need repo-admin)
-  _gitea GET "/repos/$OWNER/$name/branch_protections" >/dev/null \
-     || { echo "  ✗ cannot read branch_protections — token lacks repo-admin scope; protection step would fail" >&2; return 1; }
-  echo "  ✓ repo-admin scope confirmed (branch_protections readable → POST/PATCH/DELETE OK)"
-}
-
-# ── REMOTE half (DESTRUCTIVE; reversible→irreversible; delete master LAST) ────
-_protect() {                           # <repo-name> <branch>  (Option 1: owner-pushable)
-  _gitea POST "/repos/$OWNER/$1/branch_protections" \
-    "{\"branch_name\":\"$2\",\"enable_push\":true,\"enable_push_whitelist\":true,\"push_whitelist_usernames\":[\"$OWNER\"]}"
-}
-migrate_remote() {                     # <repo-name>  (cwd = the local repo)
-  local name="$1"
-  [ -n "${GITEA_TOKEN:-}" ] || { echo "  ✗ GITEA_TOKEN unset" >&2; return 1; }
-  echo "  [1/4] push main + develop (ADDITIVE/reversible)…"
-  git push -u origin main    || { echo "  ✗ push main failed (push scope?) — STOP, nothing irreversible done" >&2; return 1; }
-  git push -u origin develop || { echo "  ✗ push develop failed — STOP" >&2; return 1; }
-  echo "  [2/4] default_branch → main (REVERSIBLE — scope canary)…"
-  _gitea PATCH "/repos/$OWNER/$name" '{"default_branch":"main"}' >/dev/null \
-    || { echo "  ✗ PATCH default_branch failed (admin/write scope?) — STOP before protection & delete" >&2; return 1; }
-  echo "  [3/4] branch protection main + develop (REVERSIBLE)…"
-  _protect "$name" main    >/dev/null || { echo "  ✗ protect main failed — STOP before delete" >&2; return 1; }
-  _protect "$name" develop >/dev/null || { echo "  ✗ protect develop failed — STOP before delete" >&2; return 1; }
-  echo "  [4/4] DELETE remote master (IRREVERSIBLE — last; default already repointed)…"
-  git push origin --delete master || { echo "  ✗ delete master failed (left in place — safe)" >&2; return 1; }
-  echo "  ✓ remote: default=main, main/develop protected (owner-pushable), remote master deleted"
-}
-
-if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
-  case "${1:-}" in
-    local)  migrate_local "$2" ;;
-    probe)  gitea_probe "$2" ;;
-    remote) migrate_remote "$2" ;;
-    *) echo "usage: gitflow-migrate.sh {local <repo>|probe <name>|remote <name>}" >&2; exit 2 ;;
-  esac
-fi

lib/tests/design-toolchain-reminder.test.sh

@@ -6,7 +6,7 @@ pass=0; fail=0
 check() { if [ "$2" = "$3" ]; then pass=$((pass+1)); else fail=$((fail+1));
   printf 'FAIL %s: got[%s] want[%s]\n' "$1" "$2" "$3"; fi; }
 # fire() -> "fire" if the hook emits the reminder, else "quiet".
-fire() { if printf '{"prompt":"%s"}' "$1" | bash "$H" | grep -q "design-toolchain"; then
+fire() { if printf '{"prompt":"%s"}' "$1" | bash "$H" | grep -q 'full toolchain'; then
   echo fire; else echo quiet; fi; }
 
 # --- Dropped/neutralized tokens must be QUIET (non-UI senses) ---
@@ -19,6 +19,10 @@ check D6-frontend    "$(fire 'frontend architecture')"         quiet
 check D7-palette     "$(fire 'a palette of options')"          quiet
 check D8-dash-file   "$(fire 'ecc_dashboard.py')"              quiet
 
+# --- Harness-generated inputs must be QUIET even with UI tokens ---
+check D9-tasknotif   "$(fire '<task-notification> <task-id>x</task-id> add css header fonts')" quiet
+check D10-notif-file "$(fire '<task-notification> design-motion-principles keyframe done')"    quiet
+
 # --- Real UI signals must still FIRE ---
 check F1-button      "$(fire 'add a button')"            fire
 check F2-navbar      "$(fire 'the navbar layout')"       fire

settings.json

@@ -1,5 +1,10 @@
 {
   "cleanupPeriodDays": 30,
+  "attribution": {
+    "commit": "",
+    "pr": "",
+    "sessionUrl": false
+  },
   "permissions": {
     "allow": [
       "Bash(git status)",
@@ -36,8 +41,6 @@
       "Bash(uname *)",
       "Bash(mkdir -p *)",
       "Bash(touch *)",
-      "Bash(cp *)",
-      "Bash(mv *)",
       "Bash(jq *)",
       "Bash(yq *)",
       "Bash(awk *)",
@@ -146,6 +149,8 @@
       "Bash(find * -delete*)",
       "Bash(find * -exec rm*)",
       "Bash(find * -execdir rm*)",
+      "Bash(find * -exec *)",
+      "Bash(find * -execdir *)",
       "Bash(perl -e *)",
       "Bash(ruby -e *)",
       "Bash(cat .env)",
@@ -217,6 +222,8 @@
       "WebFetch",
       "Bash(xargs *)",
       "Bash(sed *)",
+      "Bash(cp *)",
+      "Bash(mv *)",
       "Bash(git stash pop*)",
       "Bash(git stash drop*)",
       "Bash(git stash clear)"
@@ -225,12 +232,7 @@
     "disableBypassPermissionsMode": "disable",
     "additionalDirectories": []
   },
-  "model": "claude-opus-4-8[1m]",
+  "model": "claude-fable-5[1m]",
-  "attribution": {
-    "commit": "",
-    "pr": "",
-    "sessionUrl": false
-  },
   "hooks": {
     "SessionStart": [
       {
@@ -315,6 +317,6 @@
   },
   "effortLevel": "xhigh",
   "remoteControlAtStartup": true,
-  "skipAutoPermissionPrompt": true,
+  "inputNeededNotifEnabled": true,
-  "inputNeededNotifEnabled": true
+  "skipAutoPermissionPrompt": true
 }

skills/commit-change/SKILL.md

@@ -1,6 +1,5 @@
 ---
 name: commit-change
-version: 1.0.0
 description: |
   Analyze all pending changes (staged, unstaged, untracked) and create
   atomic commits grouped by logical unit, retracing the work. Any git

skills/graphify/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: graphify
-description: "Use for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools."
+description: "Use when graphify-out/ exists (or the user asks to build a knowledge graph): questions about the codebase, its architecture, file relationships, or project content are then treated as graphify queries first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools."
 ---
 
 # /graphify

skills/harden/SKILL.md

@@ -8,7 +8,7 @@ description: |
   Triggers: "harden", "security headers", "csp", "hsts", "https/ssl
   audit", "redirect audit", "durcissement web", "entêtes sécurité".
   Meta/sitemap/CWV → /seo. llms.txt/AI → /geo. Secrets/CVE/OWASP → /cso.
-argument-hint: [URL] [--fix] [--local|--full] [--no-external]
+argument-hint: "[URL] [--fix] [--local|--full] [--no-external]"
 allowed-tools:
   - Read
   - Edit

skills/init-project/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: init-project
-description: Use when initializing a brand-new project from scratch — needs interview, design, scaffold, and TDD implementation. Multi-agent orchestrator: plugin-advisor + interviewer + analyzer + scaffolder with two validation gates. Triggers: "init project", "new project", "start project from scratch", "scaffold project", "init-project".
+description: 'Use when initializing a brand-new project from scratch — needs interview, design, scaffold, and TDD implementation. Multi-agent orchestrator: plugin-advisor + interviewer + analyzer + scaffolder with two validation gates. Triggers: "init project", "new project", "start project from scratch", "scaffold project", "init-project".'
 argument-hint: <project idea or description>
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

skills/onboard/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: onboard
-description: Use when bringing an existing repo into the claude-config framework — needs archetype detection, config install, full multi-axis audit (debt/SEO/GEO/UI-UX/perf/security/a11y/docs), and prioritized backlog. Multi-agent orchestrator. Do NOT use for repos created via /init-project. Triggers: "onboard", "onboard project", "audit existing repo", "setup existing project".
+description: 'Use when bringing an existing repo into the claude-config framework — needs archetype detection, config install, full multi-axis audit (debt/SEO/GEO/UI-UX/perf/security/a11y/docs), and prioritized backlog. Multi-agent orchestrator. Do NOT use for repos created via /init-project. Triggers: "onboard", "onboard project", "audit existing repo", "setup existing project".'
-argument-hint: [optional hints: "Python FastAPI" | "add gsd" | "Next.js monorepo" | "force-archetype:wordpress"]
+argument-hint: '[optional hints: "Python FastAPI" | "add gsd" | "Next.js monorepo" | "force-archetype:wordpress"]'
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, Agent, Skill
 ---
 

skills/plugin-check/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: plugin-check
-description: Audit active plugins vs project needs. Read-only advisory recommending enable/disable. Triggers: "plugin-check", "quels plugins".
+description: 'Audit active plugins vs project needs. Read-only advisory recommending enable/disable. Triggers: "plugin-check", "quels plugins".'
-argument-hint: [ex: "React + FastAPI" or "Rust CLI, no frontend"]
+argument-hint: '[ex: "React + FastAPI" or "Rust CLI, no frontend"]'
 allowed-tools: Read, Bash, Glob, Grep
 ---
 

skills/refactor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: refactor
-description: Improve code quality without changing behavior — strict norm enforcement. Triggers: "refactor", "clean up code", "normaliser".
+description: 'Improve code quality without changing behavior — strict norm enforcement, targeted scope (file/module). Full-codebase audit+cleanup → /code-clean. Triggers: "refactor", "clean up code", "normaliser".'
 argument-hint: <file, function, or module to refactor>
 allowed-tools: Read, Write, Edit, Grep, Glob, Bash
 ---

skills/release-candidate/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: release-candidate
-description: Use when develop is ahead of main and you want to cut a versioned release — finalize version.txt + CHANGELOG, merge develop→main via the gitflow fan-out, tag it, and push. Triggers: "cut a release", "release candidate", "tag a version", "ship develop to main". NOT feature/bugfix integration (that is gitflow finish via /ship-feature) nor a hotfix.
+description: 'Use when develop is ahead of main and you want to cut a versioned release — finalize version.txt + CHANGELOG, merge develop→main via the gitflow fan-out, tag it, and push. Triggers: "cut a release", "release candidate", "tag a version", "ship develop to main". NOT feature/bugfix integration (that is gitflow finish via /ship-feature) nor a hotfix.'
 ---
 
 # /release-candidate — cut a gitflow release (orchestrator)

skills/ship-feature/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ship-feature
-description: Use when shipping a new feature end-to-end — needs design brainstorm, planning, TDD implementation with subagents, error recovery, code review, and finish. Multi-agent orchestrator (9-step pipeline). Triggers: "ship feature", "ship-feature", "build and merge", "feature end-to-end", "implement and ship".
+description: 'Use when shipping a new feature end-to-end — needs design brainstorm, planning, TDD implementation with subagents, error recovery, code review, and finish. Multi-agent orchestrator (9-step pipeline). Triggers: "ship feature", "ship-feature", "build and merge", "feature end-to-end", "implement and ship".'
 argument-hint: <feature description>
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

skills/status/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: status
-description: Consolidated project snapshot — plugins, token cost, git state, recent commits, GSD v2 milestone progress. Read-only. Run at session start or after a break. Triggers: "status", "sitrep", "where are we", "project state", "after break".
+description: 'Consolidated project snapshot — plugins, token cost, git state, recent commits, GSD v2 milestone progress. Read-only. Run at session start or after a break. Open-work reconciliation (stale TODO vs real git) → /reconcile. Triggers: "status", "sitrep", "where are we", "project state", "after break".'
 argument-hint: (no arguments needed)
 allowed-tools: Read, Bash, Glob, Grep
 ---

skills/tour/SKILL.md

@@ -4,14 +4,11 @@ description: |
   Use when the user wants ONE grouped pass over a whole project (or a
   list of projects) covering all hygiene axes together: code cleanup +
   security (semgrep/cso) + TODO-vs-reality check + doc sync, auto-fixing
-  and re-auditing until a clean pass. Use it whenever the user asks for
+  and re-auditing until a clean pass — even without naming the axes.
-  a "tour" of their projects, a grouped/combined audit-and-fix, or a
-  periodic all-axes sweep — even without naming the axes.
   NOT one axis alone (/code-clean, /cso, /audit-delta, /reconcile, /doc),
   one bug (/hotfix, /bugfix), dashboard (/health), branch diff (/review).
   Triggers: "tour", "tir groupé", "grand ménage", "fais un tour sur les
-  projets", "sweep", "full pass", "vérifie et corrige tout", "passe
+  projets", "sweep", "full pass", "vérifie et corrige tout".
-  tout au propre".
 argument-hint: "[project paths… — blank = current repo] [--report-only]"
 allowed-tools:
   - Read

skills/web-validate/SKILL.md

@@ -7,7 +7,7 @@ description: |
   Triggers: "validate", "w3c", "wcag", "a11y", "accessibility", "axe",
   "pa11y", "accessibilité", "conformité web".
   CSP/HSTS/404 → /harden. Meta/sitemap → /seo. AI engines → /geo.
-argument-hint: [URL] [--fix] [--local|--full] [--no-external]
+argument-hint: "[URL] [--fix] [--local|--full] [--no-external]"
 allowed-tools:
   - Read
   - Edit