After a plan/reflection is elaborated and before it executes, three fresh blind
sub-agents (correctness / robustness / simplicity) attack it on the big model;
the main loop RE-THINKS every aspect a BLOCKER lands (a named plan change, or
[deferred]) and re-challenges once if the plan materially changed. Advisory into
each skill's existing human gate — the human stays the decider.
- lib/challenge-plan.md — reusable phase: fail-safe (never fail open),
severity-driven (any single-lens BLOCKER = must-address), RE-THINK loop
- agents/plan-challenger.md — challenger role (read-only, big-model per BDR-066)
- lib/tests/plan-challenger.test.sh — 41-assertion structure lock
- wired into 11 orchestrators: ship-feature/init-project/feat/bugfix (build-plan),
onboard/audit-delta/code-clean (proposals), seo/geo/harden/web-validate (fix-bundle)
Hardened by dogfooding: 3 blind challengers reviewed this feature's own v1 plan
and caught 4 BLOCKERs (fail-open, consensus-buries-lone-finding, wrong model
tier vs BDR-066, false on-disk-plan premise) — all fixed here.
- A1: delete STEP 5d (graphify --mode quick doesn't exist in the CLI; the
command always failed, masked by `|| true` — STEP 10's full pass already
covers the graph)
- A2: STEP 10 full-pass build flag --output -> --out
- A8: pipeline is 12 steps (STEP 0-11), not 11; header template unchanged
(N/11 correctly denotes the max index of a 0-indexed 12-step sequence)
ship-feature: STEP 0e CONTRACT (request verbatim) → ENRICHED at the STEP 3
validation gate (design criteria appended [gated <date>], the human
micro-gate) → STEP 5 VERIFY+SECURE judges the branch against the ENRICHED
contract via the shared include. Distinct axis from STEP 6 code review, both
run (LRN-095).
init-project: contract seeded from the PROJECT BRIEF (V1 features → criteria)
→ ENRICHED at VALIDATION GATE #1 → STEP 9 VERIFY+SECURE. Adds the security
gate init-project previously lacked (was deferred to a later /onboard).
onboard: explicit NO verify-loop — it produces an audit report, not a change
to verify against a request; contract is scope-only, security-auditor runs
MODE audit (report-only), never a gate. Documented to prevent a misplaced
symmetry loop (BDR-050: dev pipeline != audit).
lib/tests/no-vacuous-locks.test.sh: deterministic backstop for LRN-093 (2nd
recurrence in this chantier → the advisory alone did not hold). Refuses a
literal \n in any grep/tf/tr_/tn pattern across lib/tests/*.test.sh;
flip-tested against a synthetic offender so the guard proves it bites.
lib/tests/loops-heavy.test.sh: 18 structure locks green.
Behavioral dogfood (both vigilance points, real): (1) enrichment — a fresh
verifier reads and checks a [gated] design criterion (ECARTS naming it
precisely); (2) escalation — 3 consecutive ECARTS on the same criterion →
orchestrator STOPs at the max-3 bound + presents the CONTRACT-vs-REALIZED
table, no 4th loop, no commit. First real exercise of the infinite-loop guard.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpphkdTosUzokBDNG7PToS
STEP 12 ran `gsd init` AFTER FINISH, creating ROADMAP.md + .gsd/ in the working
tree once the merge had already integrated committed history only — so the
artifacts stranded outside the merge/PR (BLK-011, 3rd post-FINISH artifact after
memory + docs).
Resolved by REMOVAL, not by plumbing a commit: STEP 12 speculatively bootstrapped
a heavy multi-session engine (state machine / crash recovery / cost tracking /
parallel workers) that is opt-in and rarely used. Deleting the producer means the
orphan is never created — a negative diff beats building a gsd-commit helper for an
artifact nobody commits to using.
Deliberate GSD use is untouched: initializable on-demand (`/onboard add gsd`, or
`gsd init` in a terminal), still recommended by plugin-advisor, still read by
/status. init-project is now an 11-step pipeline.
Coherence sweep (the "test" for a removal): zero dangling STEP-12 refs — header
12->11-step, the STEP 10c note, and 4 USAGE.md worked-example references all updated
to on-demand init.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C6bUdvHnajCNzgVQefZowj
Reorder: SYNC README moves from STEP 12 (post-FINISH) to STEP 10c (after 10b capitalize, before 11 FINISH) and gains lib/doc-commit.md; GSD 13 → 12. Final order: 10b capitalize -> 10c doc-sync -> 11 FINISH -> 12 GSD — both artifact-commits (memory, docs) land before FINISH, so they reach the merge/PR (twin of the ship-feature fix, BDR-034). Partial-fix note added: scaffold + STEP 5b bootstrap-README commit gap (BLK-010) and GSD-post-FINISH ROADMAP (BLK-011) are deliberately out of scope — separate chantiers.
Ref-coherence (the swap flips STEP 12's meaning SYNC-README -> GSD and removes 13, so refs by number must move, not just a vanishing number): PROGRESS PROTOCOL 13-step -> 12-step + STEP <N>/13 -> /12. USAGE.md: 5 refs corrected (table 12-13 -> 11-12 steps; pipeline illustration reworked so sync README shows BEFORE finish; 3 GSD-as-STEP-13 refs -> STEP 12). Each USAGE ref read individually post-swap — all were correct at 13, correct at 12 after fix, none accidentally-true/silently-false. Latent-bug check: init-project had NO stale ref from the capitalize chantier (STEP 10b was a non-shifting letter insertion, not a swap). Historical records (BDR-017 '13 steps', CHANGELOG STEP 13 GSD, BLK-011) left as-is — append-only; closing entry documents the renumber.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ho5EQCFTSvYamuRtVZpp2d
New STEP 10b (letter-suffix, no renumber): capture the greenfield's founding
decisions (stack choice + why, doctrinal exclusions, conventions) as BDRs before
STEP 11 FINISH, via lib/capitalize-commit.md. F5 filter table distinguishes
founding decision (capitalize) from scaffold detail (skip). Two explicit rules:
- No decision → no entry: trivial projects fabricate nothing; the helper no-ops.
- Founding decisions carry NO commit hash (path+date) by nature — they precede the
code, so anchoring to the scaffold commit would be a false anchor that dilutes
the meaning of hash-anchoring elsewhere. Second case where anchoring does not
apply, after a squash-merged PR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9sqAwZxBMZSynZoVrEJhd
readme-updater.md does not exist on disk; STEPs 5b and 12 were broken
references. doc-syncer.md AUTO MODE covers both cases (README bootstrap
when missing, drift sync after changes).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Strip the disable-model-invocation frontmatter key from all 19 editable skills. Absent = default = model invocation enabled. 8 were 'true' and blocked the model AND orchestrators from self-routing (status, plugin-check, analyze, onboard, refactor, init-project, pdf-translate, ship-feature) — contradicting the CLAUDE.md skill-routing rules. The other 11 were 'false', a no-op noise line.
The setting is binary (no per-caller granularity), so enabling orchestrator chaining also enables model auto-fire — accepted. Genuinely destructive operations remain guarded by the careful/guard hooks, independent of this flag.
Capitalized: BDR-019 (decision), LRN-026 (learning), journal 2026-06-09.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two issues fixed across personal skills:
1. Five skills had frontmatter > 1024 chars (spec limit per agentskills.io):
- client-handover: 1920 → 924
- doc: 1390 → 734
- seo: 1378 → 885
- geo: 1189 → 734
- validate: 1050 → 742
All now compliant.
2. Three orchestrators had workflow-summary descriptions that create
"shortcut" risk per writing-skills CSO (Claude may follow the
description instead of reading the full skill body, skipping steps):
- ship-feature: "design → plan → implement (TDD) → review → finish"
→ "Use when shipping a feature end-to-end — needs… (9-step pipeline)"
- init-project: "interview → design → scaffold → implement (TDD)"
→ "Use when initializing a brand-new project from scratch — needs…"
- onboard: "detect archetype, install claude-config, run full audit…"
→ "Use when bringing an existing repo into the framework — needs…"
Descriptions now follow "Use when [triggers]…" pattern. Workflow detail
preserved in skill body where it belongs. Triggers consolidated and
trimmed of duplicates.
Co-Authored-By: Claude <noreply@anthropic.com>
Adapt the two skills that scaffold project config + the underlying
onboarder agent + the dotfiles-meta archetype folder tree to the new
governance layout. AUDIT_* files go to .claude/audits/, TODO goes to
.claude/tasks/, and .claude/memory/ is seeded from ~/.claude/templates/memory/
with all 5 registries (decisions/learnings/blockers/journal/evals).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- detect_plan() auto-detects Max/Pro/Free from ~/.claude.json
- session-start budget adapts to plan (Max=20k, Pro=11k, Free=5k)
- token counting now uses only ACTIVE plugins, not installed binaries
- statusline shows plan label + session duration instead of start time
- plugin-advisor: complexity assessment (0-100%) drives tool selection
- plugin-advisor: auto-activation with confirmation (PHASE 4)
- ruflo OFF by default, GSD v2 preferred for multi-session
- init-project: ctx7 pre-fetch + graphify scaffold + graphify full
- ship-feature: ctx7 cache check before implementation
- frontend-design disabled in installer (doublon with ui-ux-pro-max)
- python3 -c moved from deny to ask (unblocks graphify)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bastien Chanot