docs(gitea): add .env.example template for the gitea MCP server env vars

The README documented exporting GITEA_ACCESS_TOKEN and GITEA_HOST directly but gave no discoverable template, and the repo has an established per-plugin example-file convention (plugins/git/config.example.json) this skipped. Adds plugins/gitea/.env.example with placeholder values and points the README at it instead of duplicating the instructions inline. Verified plugins/gitea/.env.example is trackable, not swallowed by .gitignore's .env.* exclusion: the !.env.example allowlist line is unanchored and matches at any depth. Also verified apm has no dotenv auto-load anywhere in its source, so the file's instructions say to source it explicitly rather than implying it's picked up automatically. Full pre-push gate green, all 16 hooks. Test suite green, 26 suites. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EmiHiknxqtZPEBnW7ujgNz
docs: record how a plugin's .mcp.json reaches apm, and document the gitea prerequisites
2026-09-12 10:25:05 +00:00 · 2026-09-12 09:50:48 +00:00 · 2026-09-12 09:32:29 +00:00 · 2026-09-10 19:37:00 +00:00 · 2026-09-10 19:36:34 +00:00 · 2026-09-10 19:36:16 +00:00
144 changed files with 2825 additions and 570 deletions
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -11,28 +11,28 @@
    {
      "name": "kyberforge",
      "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
-      "version": "1.6.1",
+      "version": "1.6.2",
      "category": "Developer Tools",
      "source": "./plugins/kyberforge"
    },
    {
      "name": "bin",
      "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
-      "version": "1.1.6",
+      "version": "1.1.7",
      "category": "Utilities",
      "source": "./plugins/bin"
    },
    {
      "name": "git",
      "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
-      "version": "1.3.6",
+      "version": "1.3.7",
      "category": "Version Control",
      "source": "./plugins/git"
    },
    {
      "name": "gitea",
      "description": "Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.",
-      "version": "1.3.7",
+      "version": "1.3.8",
      "category": "Version Control",
      "source": "./plugins/gitea"
    },
--- a/.github/plugin/marketplace.json
+++ b/.github/plugin/marketplace.json
@@ -11,28 +11,28 @@
    {
      "name": "kyberforge",
      "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
-      "version": "1.6.1",
+      "version": "1.6.2",
      "category": "Developer Tools",
      "source": "./plugins/kyberforge"
    },
    {
      "name": "bin",
      "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
-      "version": "1.1.6",
+      "version": "1.1.7",
      "category": "Utilities",
      "source": "./plugins/bin"
    },
    {
      "name": "git",
      "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
-      "version": "1.3.6",
+      "version": "1.3.7",
      "category": "Version Control",
      "source": "./plugins/git"
    },
    {
      "name": "gitea",
      "description": "Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.",
-      "version": "1.3.7",
+      "version": "1.3.8",
      "category": "Version Control",
      "source": "./plugins/gitea"
    },
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -254,27 +254,79 @@ repos:
        entry: bash
        language: system
        files: '^plugins/[^/]+/\.apm/skills/[^/]+/SKILL\.md$'
+        # Pinned by tests/test-skill-frontmatter.sh, which drives this exact
+        # `bash -c <script> <arg0> <files...>` call shape rather than a copy of
+        # the script -- the bug below was invisible to any test that did not.
        args:
          - -c
          - |
+            # Every check reads the FRONTMATTER only, never the whole file. A
+            # `metadata:` / `name:` / `description:` line inside a body code
+            # fence is documentation (skill-author quotes exactly such a block)
+            # and used to satisfy these greps.
            for f in "$@"; do
-              if [[ -f "$f" ]]; then
+              [[ -f "$f" ]] || continue
+
+              fm="$(awk '
+                { sub(/\r$/, "") }
+                NR == 1 { sub(/^\357\273\277/, "") }
+                !opened && /^[[:blank:]]*$/ { next }
+                !opened {
+                  if ($0 ~ /^---[[:blank:]]*$/) { opened = 1; next }
+                  exit
+                }
+                /^---[[:blank:]]*$/ { closed = 1; exit }
+                { print }
+                END { if (!opened || !closed) exit 3 }
+              ' "$f")" || {
+                echo "ERROR: $f has no closing YAML frontmatter block (expected --- ... --- at the top of the file)"
+                exit 1
+              }
+
              missing=""
-                if ! grep -q "^name:" "$f"; then
-                  missing="${missing}name: "
-                fi
-                if ! grep -q "^description:" "$f"; then
-                  missing="${missing}description: "
-                fi
-                if ! grep -A10 "^metadata:" "$f" | grep -q "  version:"; then
-                  missing="${missing}metadata.version "
-                fi
+              printf '%s\n' "$fm" | grep -q "^name:" || missing="${missing}name: "
+              printf '%s\n' "$fm" | grep -q "^description:" || missing="${missing}description: "
+
+              # Scoped to the `metadata:` block and stopped at the next
+              # top-level key, so a `version:` under a following `source:` list
+              # cannot stand in for it; the `^  version:` anchor is exact, so a
+              # deeper-nested `    version:` cannot either. No line budget, so a
+              # long `metadata:` block does not hide the key.
+              ver="$(printf '%s\n' "$fm" | awk '
+                /^metadata:/ { inm = 1; next }
+                inm && /^[A-Za-z]/ { exit }
+                inm && /^  version:/ {
+                  v = $0
+                  sub(/^  version:[[:blank:]]*/, "", v)
+                  sub(/[[:blank:]]+#.*$/, "", v)
+                  sub(/[[:blank:]]+$/, "", v)
+                  print "found:" v
+                  exit
+                }
+              ')"
+              [[ -n "$ver" ]] || missing="${missing}metadata.version "
+
              if [[ -n "$missing" ]]; then
                echo "ERROR: $f is missing required frontmatter fields (${missing})"
                exit 1
              fi
+
+              raw="${ver#found:}"
+              v="$raw"
+              case "$v" in
+                \"*\") v="${v#\"}"; v="${v%\"}" ;;
+                \'*\') v="${v#\'}"; v="${v%\'}" ;;
+              esac
+              if [[ ! "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                echo "ERROR: $f has a malformed frontmatter metadata.version (${raw:-<empty>}) -- expected a three-part semver, e.g. \"1.0.0\""
+                exit 1
              fi
            done
+          # arg0 for `bash -c`. WITHOUT it pre-commit's first filename lands in
+          # $0 and is dropped from "$@" -- so a single-file commit, the normal
+          # case, ran the loop zero times and reported Passed having checked
+          # nothing. Do not remove; tests/test-skill-frontmatter.sh pins it.
+          - skill-frontmatter

      - id: skill-size-check
        stages: ['pre-commit']
@@ -294,6 +346,21 @@ repos:
        # records for Vale warnings. Costs nothing on a clean file: the script
        # prints only findings.

+      - id: check-rtk-prefix
+        stages: ['pre-commit']
+        name: ADR-0023 rtk prefix on executable git commands
+        description: Enforce ADR-0023 clause 1 -- an executable, instructed git command in a shell code fence or a dispatch-table Run cell is written `rtk git`. Clauses 2 and 3 are not machine-decidable; a deliberately bare command opts out with the literal string ADR-0023 on its own line
+        entry: scripts/check-rtk-prefix.sh
+        language: script
+        files: '^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$'
+        # README.md is excluded on purpose, not by oversight. A skill-directory
+        # README is consumer-facing prose that no agent ever loads, and the
+        # `git clone` lines in the seven tests/README.md files are setup
+        # instructions for a third party who has no rtk installed. Prefixing
+        # those would be actively wrong -- see ADR-0023's consumer section.
+        exclude: '(^|/)README\.md$'
+        pass_filenames: true
+
      - id: vale-audit-prefilter-skill
        stages: ['pre-commit']
        name: Vale audit prefilter (SKILL.md)
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,6 +15,8 @@ This file carries only what applies to **every** session. Setup, prerequisites,

 Not everything in a plugin root is generated. `README.md`, `docs/`, `bin/`, `sources.md`, `.mcp.json` and per-plugin extras are hand-authored there with no `.apm/` source — edit those in place. The rule is per-path, not per-directory. But a file placed *inside* a mirrored directory is deleted on the next sync (`sync_dir` runs `rm -rf` before every copy), so plugin-root documentation goes in `docs/`, never in `hooks/` or `skills/`.

+`.mcp.json` is hand-authored but it is **not** outside apm. MCP is a first-class apm primitive, and a plugin's `.mcp.json` is how this repo declares one: apm reads the `mcpServers` pointer in the generated `.github/plugin/plugin.json`, resolves it to `.mcp.json`, and injects the result into that package's `dependencies.mcp` when a consumer installs it. Declare MCP servers there and **never** in the plugin's own `apm.yml` — that arms a per-package gate this repo cannot satisfy (`LESSONS.md`, 2026-09-12).
+
 Full model: `docs/spec/architecture.md`.

 ## Prefer plugin skills over raw shell
@@ -36,11 +38,7 @@ Fall back to raw shell only when no skill covers it.
 - **Do not add repo-owned keys to `.claude/settings.json`.** apm treats it as its own deployed artifact and `apm audit --ci` replays the install and diffs, so anything apm would not have written is permanent drift that fails the `apm-audit-ci` pre-push hook. A hook you want here is authored in `plugins/<name>/.apm/hooks/` and deployed by apm, never hand-written into that file. The `SessionStart` entry already in it is exactly that: kyberforge authors it in `plugins/kyberforge/.apm/hooks/hooks.json` and apm merges it in, so it is apm's own output, it is what the replay expects, and it belongs in the commit — do not strip it (ADR-0019). Machine-specific settings go in the gitignored `.claude/settings.local.json`; shared enforcement goes in `.pre-commit-config.yaml`.
 - **`apm.lock.yaml` turning up modified is expected, not a bug.** kyberforge's `SessionStart` hook runs `apm outdated` at startup and `apm update --yes` when something is behind, which rewrites the lock. Commit or discard it deliberately.
 - **A `.apm/` edit is not live in this session until it is pushed.** The six dependencies resolve from the holocron remote, unpinned against the default branch. `apm install` deploys from the lock; `apm update` is what re-resolves refs.
- **The ADR-0020 skill gates ship hot, with no baseline — and the corpus is now clean.** All 39 skills clear both FAIL tiers: no description over 400 characters, no body over 900 words (counted body-only). Retrofitted plugin by plugin under #99 (see `docs/spec/gates.md`). Because nothing is grandfathered, the gates now bite on first commit — a new skill, or an edit that pushes a description past 400, is blocked until it complies. **No routing target dangles**, and `tests/test-adr0020-targets.sh` pins that set as empty, so a new boundary clause naming a non-existent skill fails the suite rather than joining a backlog. Two blind spots survive: `skill-size-check` does not cover the Vale half, so `Kyberforge.CompositionNote` fires nowhere today but any new description can reintroduce it; and no `references/` file is linted by anything, so prose relocated out of a body to satisfy the word gate lands outside the prose gate. It has two independent causes and closing either alone changes nothing — `docs/spec/gates.md` has both, issue #117 tracks it. Check both gates: `pre-commit run --all-files`.
- **Run `bash tests/run-tests.sh --strict` before considering any change done.** Keep the flag: without it a suite whose dependency is missing exits 77 and is counted SKIPPED rather than failed, so the run goes green having verified less than it claims.
- **Before pushing, rehearse the gate locally:** `pre-commit run --hook-stage pre-push --all-files`. It runs the 14 pre-push hooks this repo authors itself plus pre-commit's 2 `meta` hooks, so it prints 16; `check-release-needed` passes without checking anything, because it needs a real push to `main`. `docs/spec/gates.md` reconciles both.
 - **Pushing without a network** needs `SKIP=apm-marketplace-check,apm-pack-check-clean git push` — those two resolve a remote marketplace entry via `git ls-remote`. Skip only those two; the rest are real local checks, and adding one to `SKIP` disarms it silently.
- **Author commits with `git-commits`** — it validates Conventional Commits, which `commit-msg` enforces.
 - **This repo and Gitea are the only source of truth.** All project state, decisions, and working conventions live here. Do not use an external memory system for this project — cached state diverges from the repo and you get a split brain. Before answering any design or architecture question, check `docs/adr/` for an existing decision.

 ## Key documents
--- a/LESSONS.md
+++ b/LESSONS.md
@@ -10,6 +10,14 @@ Patterns observed during development of this repo. Three or more entries on the

 ---

+## 2026-09-12 — "Not an `.apm/` primitive" was read as "not an apm primitive", and the review that followed was wrong
+
+`AGENTS.md` and `docs/spec/architecture.md` both listed `.mcp.json` alongside `README.md`, `docs/` and `bin/` as plugin-root material "hand-authored with no `.apm/` source". That is literally true — nothing under `.apm/` produces MCP config — but it reads as "apm has no MCP concept", and a review of PR #132 drew exactly that conclusion and recommended moving the declaration into the plugin's `apm.yml` under `dependencies.mcp`. The recommendation was wrong twice over. It arms `lockfile-exists` in the per-package `apm audit --ci` that the `apm-audit-ci` hook runs in every `plugins/*/`, which then demands the package's whole deployed tree inside the package directory: 93 missing files and 79 drifted paths on `plugins/gitea`. And it was unnecessary, because the `.mcp.json` route already reaches `dependencies.mcp` through the `mcpServers` pointer in the generated Copilot manifest, env references intact.
+
+Two process lessons, not one. First, when a doc says a file is not a primitive **of a specific subsystem**, say which subsystem and what the file actually is instead — the negative claim alone invites the wrong generalisation. Second, the three scratch installs that produced the wrong conclusion all used local `./path` dependencies, where apm skips the plugin-normalisation step that injects `.mcp.json`. The repo consumes its plugins as `git:` + `path:` objects. A scratch test that does not reproduce the real dependency form can invert the result, so reproduce the form, not just the shape.
+
+---
+
 ## 2026-05-17 — Workflow documents should prescribe sub-agent usage, not just allow it

 When writing workflow documents (like `docs/notes/skill-implementation-workflow.md`), the natural tendency is to describe steps at a high level and leave sub-agent usage as an implementation detail. But if the workflow doesn't explicitly prescribe "spawn a sub-agent here," practitioners default to doing everything in the main context — accumulating token cost and losing the isolation benefit. Fix: make sub-agent usage a named step in the workflow, specifying what the agent receives, what it returns, and why it's isolated. This makes the workflow reproducible rather than dependent on the practitioner remembering to use agents.
@@ -60,29 +68,21 @@ write-eval's process requires presenting the full test plan and waiting for user

 The write-skill authoring standard required 8 body sections including Role and When/When not. These were assumed to be agentskills.io requirements. Checking the actual spec revealed the body has no format restrictions at all — recommended sections are step-by-step instructions, examples, and edge cases. Role and When/When not were added by convention without verifying the standard. Fix: before encoding any requirement as part of an authoring standard, check the upstream spec directly. The agentskills.io spec also confirmed that negative triggers belong in the description field — not in a separate body section — which eliminates a persistent duplication pattern across all skills.

-## 2026-05-18 — Provenance fields in frontmatter are loaded on every skill scan
-
-Fields like `source:`, `references:`, `version:`, `updated:`, and `when:` in SKILL.md frontmatter are loaded at agent startup alongside `name` and `description` for every installed skill. None of these are used for routing or runtime execution — they are audit and upgrade-cycle records. Loading them at startup violates progressive disclosure and wastes tokens proportional to the number of installed skills. Fix: move all non-routing frontmatter to a separate `META.md` file in the skill directory. Frontmatter keeps only `name`, `description`, `metadata.category`, and `allowed-tools` (when applicable) — the four fields the spec actually uses for routing and discovery.
-
 ## 2026-05-18 — Copy-fill is more deterministic than generate for structured skill artifacts

-When a skill produces a structured artifact like SKILL.md, the natural approach is to generate it from internalized rules in the Process section. But this means section structure is only as reliable as the agent's instruction-following under token pressure. Copy-fill (copy the template to the target path, then fill in content) separates structure from content: the template mechanically enforces section order and presence, freeing the Process section to focus only on sequencing constraints (what order to decide things) rather than also policing structure. Side benefit: the template is a human-usable artifact that can be adopted independently of the skill. Fix applied in write-skill refactor: SKILL-TEMPLATE.md and META-TEMPLATE.md are the authoritative structure sources; the Process section no longer contains a body structure constraint — the template handles it.
+When a skill produces a structured artifact like SKILL.md, the natural approach is to generate it from internalized rules in the Process section. But this means section structure is only as reliable as the agent's instruction-following under token pressure. Copy-fill (copy the template to the target path, then fill in content) separates structure from content: the template mechanically enforces section order and presence, freeing the Process section to focus only on sequencing constraints (what order to decide things) rather than also policing structure. Side benefit: the template is a human-usable artifact that can be adopted independently of the skill. Fix applied in write-skill refactor: SKILL-TEMPLATE.md is the authoritative structure source; the Process section no longer contains a body structure constraint — the template handles it.

 ## 2026-05-17 — HITL gap: agent delegates confirmation to permission system

 The agent-level HITL rule ("require explicit confirmation before irreversible shared-state operations") is being bypassed: the agent calls the tool and lets the permission dialog catch it. This means the rule is not firing in agent reasoning — it's the permission system acting as a safety net. If a user selects "don't ask again," the net disappears. Fix: the HITL rule needs to be framed as "do not call the tool" rather than "ask before proceeding" — the agent must ask first, then act only after explicit confirmation.

-## 2026-05-26 — META-TEMPLATE uses YAML comments; META.md output retains them
-
-META-TEMPLATE.md uses YAML `#` comments to explain fields inline. SKILL-TEMPLATE.md uses HTML comments inside XML tags, which the agent strips on fill. The structural difference means SKILL.md output is clean but META.md output retains the explanatory `#` lines — an inconsistency. Fix (deferred): restructure META-TEMPLATE.md so all explanatory guidance is prose above the code block (markdown, never copied into the output YAML), and the code block itself uses `<placeholder>` syntax with no `#` comment lines. This makes META.md fill behaviour deterministic for the same reason SKILL.md fill is: `<...>` markers are unambiguously replaceable; prose above the block is not part of the template. Do not apply until the human/copy-fill tradeoff is resolved — see 2026-05-26 session discussion.
-
 ## 2026-05-26 — Overlap checks must scan the deployed directory, not just the source repo

 `write-a-skill` existed only in `~/.agents/skills/` (installed from a pre-refactor source) and was invisible during a repo-level scan of `.agents/skills/`. Governance reviews and overlap checks that only look at the source repo will miss skills added by install.sh from other sources or prior runs. Fix: overlap checks must scan the deployed `~/.agents/skills/` directory, not just the repo's `.agents/skills/`.

-## 2026-05-26 — `model:` field belongs in SKILL.md frontmatter, not META.md
+## 2026-05-26 — `model:` field belongs in SKILL.md frontmatter, not a sidecar file

-Claude Code supports `model:` as a provider extension in SKILL.md frontmatter — it overrides the session model for the skill's turn and reverts after. Attempting to put it in META.md was wrong: META.md is provenance/audit metadata, not runtime config. The boundary: if a field affects agent behaviour at invocation time, it belongs in SKILL.md frontmatter; if it serves upgrade reviews and audit trails, it belongs in META.md.
+Claude Code supports `model:` as a provider extension in SKILL.md frontmatter — it overrides the session model for the skill's turn and reverts after. Attempting to move it out to a provenance sidecar was wrong: a sidecar is audit metadata, not runtime config. The boundary: if a field affects agent behaviour at invocation time, it belongs in SKILL.md frontmatter.

 ## 2026-05-26 — Research agents present synthesis as spec fact

@@ -126,7 +126,7 @@ Two forks independently fixed `references/sources.md` with different approaches

 ## 2026-06-28 — Implementation agents must invoke /skill-author, not write skill files directly

-When briefing an agent to implement a new skill, the instinct is to tell it to write the SKILL.md and supporting files directly. This bypasses Step 5 of the skill-author process (provenance), which requires reading all research `sources.md` files and recording every `extracted` slug in META.md. The `validate-provenance.sh` script catches the gap — but only after the commit, requiring a fix round. This pattern recurred twice in one session (plugin-author and marketplace-author initial implementation, then again in the first round of fix agents). Fix: briefs for implementation agents must explicitly say "invoke `/skill-author` (read and follow `plugins/kyberforge/.apm/skills/skill-author/SKILL.md`)" — not "write the skill files." Invoking the skill is the only reliable way to ensure all process gates, including provenance, run.
+When briefing an agent to implement a new skill, the instinct is to tell it to write the SKILL.md and supporting files directly. This bypasses Step 5 of the skill-author process (provenance), which requires reading all research `sources.md` files and recording every `extracted` slug in the skill's own `references/sources.md`. The `validate-provenance.sh` script catches the gap — but only after the commit, requiring a fix round. This pattern recurred twice in one session (plugin-author and marketplace-author initial implementation, then again in the first round of fix agents). Fix: briefs for implementation agents must explicitly say "invoke `/skill-author` (read and follow `plugins/kyberforge/.apm/skills/skill-author/SKILL.md`)" — not "write the skill files." Invoking the skill is the only reliable way to ensure all process gates, including provenance, run.

 ## 2026-07-05 — Repo root is a bare checkout; work happens in worktrees only

--- a/README.md
+++ b/README.md
@@ -35,6 +35,17 @@ Install all of these before setting up. Each one is a hard dependency of a git h
 | `python3` + PyYAML | Required by `scripts/skill-size-check.sh` (the `skill-size-check` pre-commit hook), which reads folded YAML frontmatter | `python3` is usually present — pre-commit is itself a Python application. `pip install pyyaml` if the hook reports PyYAML missing |
 | `vale` | Required by the `vale-audit-prefilter-skill` / `-agent` pre-commit hooks and the `check-vale-style-sync` pre-push hook | `brew install vale` (macOS), `snap install vale` (Linux), `choco install vale` (Windows), or https://vale.sh/docs/vale-cli/installation/ |
 | `claude` CLI | Required by the `validate-plugins` and `validate-marketplace` pre-push hooks | Claude Code |
+| `go` toolchain | The gitea MCP server runs as `go run gitea.com/gitea/gitea-mcp@v1.7.0`, resolved from `PATH`. Without it the server fails to start and every `gitea-*` skill loses its tools | https://go.dev/dl/ — verify with `go version` |
+
+The gitea MCP server additionally needs two environment variables in the shell that launches your agent — referenced as `${GITEA_ACCESS_TOKEN}` and `${GITEA_HOST}` in `plugins/gitea/.mcp.json`, with apm passing those references through to the deployed config unexpanded so the values are resolved at server startup and never committed. Copy `plugins/gitea/.env.example` to `.env` at the repo root, fill in real values, then export it — nothing in this repo auto-loads a `.env` file:
+
+```bash
+cp plugins/gitea/.env.example .env
+$EDITOR .env
+set -a; source .env; set +a
+```
+
+Generate the token in Gitea under Settings, Applications. Scope it to the repositories you want the agent to reach. If the server starts but every call returns an authorization error, that token is the first thing to check.

 Two notes worth reading before you skip one:

--- a/apm.lock.yaml
+++ b/apm.lock.yaml
@@ -1,12 +1,12 @@
 lockfile_version: '1'
-generated_at: '2026-09-01T14:55:26.980675+00:00'
+generated_at: '2026-09-09T19:35:28.926191+00:00'
 apm_version: 0.28.0
 dependencies:
 - repo_url: Defame1297/holocron
  name: bin
  host: git.dev.rkdr.net
-  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
-  version: 1.1.6
+  resolved_commit: b7bec71b8f5fb15187bcd32b1f76e6f6fa7afce9
+  version: 1.1.7
  virtual_path: plugins/bin
  is_virtual: true
  package_type: marketplace_plugin
@@ -65,33 +65,33 @@ dependencies:
  - .claude/skills/zoom-out/SKILL.md
  deployed_file_hashes:
    .claude/skills/caveman/README.md: sha256:f512fff0ddf11ae216c6806d4c2ad31e130de6ed360c89a39787c2ff6f4a2c62
-    .claude/skills/caveman/SKILL.md: sha256:817ed2655c2188c5c0b1e1dc5f4e762e699ad7fcd2a056e4ef73d5f6601dd1f8
+    .claude/skills/caveman/SKILL.md: sha256:258d7c92c04d42f16b8143c58da66e0fc32a35d9991bb4de2db29856622a92ef
    .claude/skills/diagnose/README.md: sha256:ac59366a09f74bce57d45ebe06e8afb7d12166351a4756a7b89f71ab9e0fc450
-    .claude/skills/diagnose/SKILL.md: sha256:0844ba2bbede408be2e54a20cacd2e280c275c11ba45173381659a76f0c54cad
+    .claude/skills/diagnose/SKILL.md: sha256:f1c66493696890f50333b7515eb5876d26b51571bbafa75c5a66e0d8a0834a33
    .claude/skills/diagnose/assets/hitl-loop.template.sh: sha256:b2932630950e5210075bcd6f850e5accf30c101c5367b29eac3a29b4dd8084c8
    .claude/skills/diagnose/references/feedback-loops.md: sha256:5ed81b331fcf7dfc229b92be7250fd786064f8363dbf55bf6b6e5e9b5f5e1daf
    .claude/skills/diagnose/references/regression-seams.md: sha256:fdb24c383628d239e54424f72258860612d6fe8a1fc5d0057ab5073628cc71f4
    .claude/skills/grill-me/README.md: sha256:4acbda2175bf003f1106a6912cf2cfb8d3d2623f391b1be6f417beb084a65b05
-    .claude/skills/grill-me/SKILL.md: sha256:0af060d6813ed59547be14c7dfd544d5b626c852f7ec0f7213c27c7ec0ae76c1
+    .claude/skills/grill-me/SKILL.md: sha256:e24aa04add72fe6f081b861d6e5389debf12088146a453d3b9a0d3d98a575e6d
    .claude/skills/grill-with-docs/ADR-FORMAT.md: sha256:f1f36cd3f8d3b6474ddd5855da4e233bfc4ae1a1c5024909ccf11871819a41b2
    .claude/skills/grill-with-docs/CONTEXT-FORMAT.md: sha256:8f6baaa3b1c91644bd7c600196b1aee781d5f525c7c345db8cdfbfb368329a05
    .claude/skills/grill-with-docs/README.md: sha256:c94a826df0f85f17957b9fa2fe73d52ab1ff29d7685658b994721378eeea811e
-    .claude/skills/grill-with-docs/SKILL.md: sha256:26d06ea58adae5fa6ca8b406cc4a8d13ec3c9780bfb283c29ef0a8f8845f26f9
+    .claude/skills/grill-with-docs/SKILL.md: sha256:91644db52834a9ce928fa5063c5e4e29a34113cc758bfa3778c12365d56911f2
    .claude/skills/improve-codebase-architecture/DEEPENING.md: sha256:9577485f4fc32c0267639a9151bb41c8af0f8f6086e4bf8b84d5b236e30604e9
    .claude/skills/improve-codebase-architecture/INTERFACE-DESIGN.md: sha256:678c3e34f1339015053212b3316bf0b676c70aa251050a0613667d4e755fb35e
    .claude/skills/improve-codebase-architecture/LANGUAGE.md: sha256:6feca2140439c54a774749e8367f18350899ff69c777144ed2248cd4407949fa
    .claude/skills/improve-codebase-architecture/README.md: sha256:813332e95450c7e3e4c892f5edf777236d213fca40f3d1ff30ac7a644f2ea258
-    .claude/skills/improve-codebase-architecture/SKILL.md: sha256:4e54cc00ec301027f640ac5dd1877b0d9ec94c16e784da0cdab25e220167e53d
+    .claude/skills/improve-codebase-architecture/SKILL.md: sha256:773e0f50c80c2565ff8149d77efbf0a2ea9b25ef2b1ad679bb14ad7e9a3137aa
    .claude/skills/prototype/README.md: sha256:4f09d8742b017da6da3aa87d55a26937dda9ad2a3dcc0e45df62e26d6be10983
-    .claude/skills/prototype/SKILL.md: sha256:873d3c3bf9e46af5e61598a9030ac0304b58f900f48f102e7322c825d5fe435a
+    .claude/skills/prototype/SKILL.md: sha256:ef4e45505cee1e43776da7606fcbe021655c53fd4e5fd9ddab079ae94224b8ca
    .claude/skills/prototype/references/logic.md: sha256:05c193ce98ee01ed3d7558891efa97c8f6a3b61605f24d18f9d405aef7d1b58d
    .claude/skills/prototype/references/ui.md: sha256:bff1746d1f0c5ef42d8c2fac33637249a78a6c0c92cfdf906da933e2e1104ec6
    .claude/skills/research/README.md: sha256:b5fe17aea6a398ceaeebcab9cb2c31ff8fcc806d5793a257916dc16b6ecb9933
-    .claude/skills/research/SKILL.md: sha256:245cec403e83b8c7fbc0f17e684858d49f06d35a3bcbb5f967f81c4efe5bdafc
+    .claude/skills/research/SKILL.md: sha256:0b9099a5836e076b348d3aca606729e8012c46680404f3596467b91416ae6785
    .claude/skills/research/references/file-format.md: sha256:29d5583beaa531d26895c54def112039730490c312401648a6bdb7dd5278fb3c
    .claude/skills/research/references/topics.md: sha256:757abb7b6be44c3d3c0dd1f4818a344e08877810d36bf8be60ea7189cba8d12f
    .claude/skills/tdd/README.md: sha256:ee7c9de4eb494f8a0e4e67153a5b44b560f7e53cc35f5ebdfbeb6dfa5bd1ed16
-    .claude/skills/tdd/SKILL.md: sha256:46bc2a4c55b15e96fdd002167f37b43245e64fcbecb61daed11eac6e0d026da8
+    .claude/skills/tdd/SKILL.md: sha256:b61ae804b51be1c085b636daee24af0065cd07de579242e055fc0ce15dd8daf0
    .claude/skills/tdd/deep-modules.md: sha256:f2123700bf953db1740625686c75bdd145efd486357c47c6818c869fee657a32
    .claude/skills/tdd/interface-design.md: sha256:764c5ff0e3fa6b4ab7095eb65ccc7201e090baf19fa16051dfdb72c06d27417d
    .claude/skills/tdd/mocking.md: sha256:3ceb807fdf4a47d6a93d4d9a891e5ba6d362a6247bd08adc451feebfc17361ef
@@ -100,18 +100,18 @@ dependencies:
    .claude/skills/triage/AGENT-BRIEF.md: sha256:e34b7e9359b8b2b95b4d9795864f2a8ef5ef4f60b3632ddcb5563937110c71e0
    .claude/skills/triage/OUT-OF-SCOPE.md: sha256:8ed8cf27833444060c81b3961a83c0e3d8e6cf2fcb2ddf6f8b07c6655cbb0d85
    .claude/skills/triage/README.md: sha256:9144c8d3262ad42f09d430e4cad17c16310919d68a91c17ac36f1285f6b4110b
-    .claude/skills/triage/SKILL.md: sha256:42042bf7c3e6392d1ff0a0536fe0692fa710d6818e2501db77c7f22fa6e423cb
+    .claude/skills/triage/SKILL.md: sha256:dd2510eeef27f09b6d8d134860515ebe89bd7f1c15e78a961ff930bf1eca0f74
    .claude/skills/write-docs/README.md: sha256:6d6310785603c1f4653be2ae9ffb37008cbe22eee49aed02ac8076ab20f95bcc
-    .claude/skills/write-docs/SKILL.md: sha256:25af5dc9e67a0755bc7a2cb99a1008156ba1fd17b283bdb5cc82dfccdb834421
+    .claude/skills/write-docs/SKILL.md: sha256:1e34da388a48e7a3485de1db47d25bf4610b74dbe8ef5232fc529a69d05bfed7
    .claude/skills/zoom-out/README.md: sha256:5c80fbcf7fc6ee5117872b146aacd630a3d2f2d86693e06aef2e3c8eea9115cf
-    .claude/skills/zoom-out/SKILL.md: sha256:2a6894c7f9b1c9c55f451c625a834c4f377e217b623a85280e55db5fe9cacf48
-  content_hash: sha256:7c568135b260c8fed6d369afeefddfa57f9979590291447007811941d87bb6b4
+    .claude/skills/zoom-out/SKILL.md: sha256:5e7e6689136eb5047da3b90364efe07734d7d741fc0979ee18e19e755a8c9483
+  content_hash: sha256:3719d2a8d5c9a26869cf818ce58f5332b68974eca6c90ac1e415825e2d204805
  declared_license: MIT
  exec_status: gated_pending_approval
 - repo_url: Defame1297/holocron
  name: core
  host: git.dev.rkdr.net
-  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  resolved_commit: b7bec71b8f5fb15187bcd32b1f76e6f6fa7afce9
  version: 1.1.2
  virtual_path: plugins/core
  is_virtual: true
@@ -160,8 +160,8 @@ dependencies:
 - repo_url: Defame1297/holocron
  name: git
  host: git.dev.rkdr.net
-  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
-  version: 1.3.6
+  resolved_commit: b7bec71b8f5fb15187bcd32b1f76e6f6fa7afce9
+  version: 1.3.7
  virtual_path: plugins/git
  is_virtual: true
  package_type: marketplace_plugin
@@ -241,74 +241,74 @@ dependencies:
  deployed_file_hashes:
    .claude/agents/git-orchestrate.md: sha256:8b1b6826bad87b816ea78fc6bdb5aa9c750d542c6266fc3ee3225336450de16f
    .claude/skills/git-branches/README.md: sha256:72ff2e422f39c306fa53eb65c73761f48405cdbd42a3eb98d48c304318c9aa3f
-    .claude/skills/git-branches/SKILL.md: sha256:3a0bcc9a0fce6d0789466a798161743d54d4251b7a4256b87a7cd9d3c0f5b458
-    .claude/skills/git-branches/references/branch-operations.md: sha256:c682142f969e943bae3a05cef24ce9661a4b36861da3b115cf07d762ebed4933
+    .claude/skills/git-branches/SKILL.md: sha256:bb6d467274c0b0ede92ad1520192c58a3784ae04ae6122d10b966ed1cf89a3a4
+    .claude/skills/git-branches/references/branch-operations.md: sha256:a96fac103c01da2fe7a0b7f79ed146dc10ed510683d7b7a7e5223e4c104936b3
    .claude/skills/git-branches/references/branch-patterns.md: sha256:1fdc2cc86634f45d48a3fc4326eec81e1331cef0f8406639f2a712ead2eb5f7b
-    .claude/skills/git-branches/references/comparing-branches.md: sha256:38f22b0324981a0ad60d29b336e0824b63b1108863fb3e9870f1d93e32f09d82
-    .claude/skills/git-branches/references/merging.md: sha256:d144c237e7a8a1e709444af9e16c4d7804ba9f53fcae2326249d98885c48716e
+    .claude/skills/git-branches/references/comparing-branches.md: sha256:301326c4d5812c7e2d22e0d2a5624f18fa2f375b08ea24a878bf43aea4dd9cc4
+    .claude/skills/git-branches/references/merging.md: sha256:8f423cc6391d607bdc6b543d2f3cfe04415dad3334b176d7efee5fb6c4f4616e
    .claude/skills/git-branches/references/orchestrator-contract.md: sha256:d4f5c6517acbe784133c174c076e57348921a3fc5aa12b11bb6cf13b30e087b9
    .claude/skills/git-branches/references/sources.md: sha256:9043d5c90381900dcf7ad6b55b4a73ffee62e3ca6d23f1f89708de635e37534a
    .claude/skills/git-commits/README.md: sha256:f4d2b60926e50a45dbf5621dbd62fb1239a4f3da1163402f7e1a82f0a8a8b568
-    .claude/skills/git-commits/SKILL.md: sha256:1658a63bc3209993580982c0aa7cbd2656a1d2b3519f2c421c65bf929c65ccfd
+    .claude/skills/git-commits/SKILL.md: sha256:68af7b4867992f34a2595a47e3dbd299f6a215c2d16163495027e7d409cc488f
    .claude/skills/git-commits/references/cherry-pick.md: sha256:1d8a89adbdaa37b4fdf8f2aed6b78e6767df5b46f97f083a0bd71288dfb7e1d9
    .claude/skills/git-commits/references/commit-template.md: sha256:50869213d35b563f2b03d2d3782067842a239d378badab55de3cac5492227f09
    .claude/skills/git-commits/references/conventional-commits-spec.md: sha256:105175ba8244cd52096fde3746b4b671a82ba0337c7894dbc68a7d6a37646bc6
    .claude/skills/git-commits/references/create-commit.md: sha256:ac07f0c608b5388d6780b4ab353fb76974d8672423a2f3b6d80c69e8dbdbab4f
-    .claude/skills/git-commits/references/rewrite-history.md: sha256:99fb88d022bbae4d1c1b84642d590439fe3142881821a99ed856aaeca43b699c
+    .claude/skills/git-commits/references/rewrite-history.md: sha256:e80e3cc3608c325a6c14b43a3fed985eed45c5154309dc323c0c9063efcc6a83
    .claude/skills/git-commits/references/sources.md: sha256:215814371e0a83e7231989cfaf095b6ac9fceda124ad17f0490e7ee615764523
    .claude/skills/git-history/README.md: sha256:6219a74783b28e6005c0a69ad92f9a179c9bda3b911bb1790d15d690d3c5de6e
-    .claude/skills/git-history/SKILL.md: sha256:dc117941d49c152e3d7e14f6e0595c308ab24378a24ff472a3f4ed98c003eb6f
+    .claude/skills/git-history/SKILL.md: sha256:7db9fcb475cd61b53e2080ee667f5b6e3bea0080626291e91630d910eb22ff15
    .claude/skills/git-history/references/README.md: sha256:218187f9372a4027f6189420384dece791af74353adc9ea5b143e37c9ca3df5f
-    .claude/skills/git-history/references/bisect.md: sha256:75606d95ff592085b4bf35d09361ebbfcb8f3ba195a3f7d89aff187b99789a3b
-    .claude/skills/git-history/references/git-log-format.md: sha256:b17f36967c32b761a423bb14b900451208daa3be2dc6cba8709a6b60ad9b90fd
+    .claude/skills/git-history/references/bisect.md: sha256:33a387ed026d33141841397c8e08bcd4b52eec05c4e4835c5783dd1a118c8aeb
+    .claude/skills/git-history/references/git-log-format.md: sha256:535d607dec22aa169d33080aea44cf34b637d7623e3fbad494f3b08b5bc80fb8
    .claude/skills/git-history/references/sources.md: sha256:5a0d78e0f3f301dda18e5198dfd5552e90a7250ae14113a8c2d86de68beb3ad8
    .claude/skills/git-remotes/README.md: sha256:945896f6861c77259de0b5318b36c206f54e8b6ba70848d2b65847b64f3b142d
-    .claude/skills/git-remotes/SKILL.md: sha256:88661a769ebb3d3b2bc64b58f11b2ff1c991ab6bc85e6f59c46e9472fe018598
+    .claude/skills/git-remotes/SKILL.md: sha256:23c607ce8caa72b3e718f7a0c09ec8f1d68200494cd1460f5b736a74c683a258
    .claude/skills/git-remotes/references/README.md: sha256:530122741ff0638ca80500b1b376c284238589ec95d5f33437c840aa197e18b9
-    .claude/skills/git-remotes/references/fetch.md: sha256:150c68ef952fafb02f12f1506bfabc5d1fe3b7fc1fcd5df0379943597f808b3a
-    .claude/skills/git-remotes/references/pull.md: sha256:c06eda4c8090fb07d4b788f8fe2b6efdb0b0ab8c27eaafe8b077745997a22962
-    .claude/skills/git-remotes/references/push.md: sha256:880e630792494ce4fab52e7965d548df7bfeaf2a8ba0a4ee775a1299810002b3
-    .claude/skills/git-remotes/references/remote-config.md: sha256:779458aefcc932b90567b119b677789c2010e12eb38c5ad52f1be2e822c55019
+    .claude/skills/git-remotes/references/fetch.md: sha256:e3b52b7d7545faf20403a940580712d16dbc250aa927da566ddf163f949dfe5f
+    .claude/skills/git-remotes/references/pull.md: sha256:e59305d434e6226086d494358ee978ad6213397da8e05cd97aee7c38318f2dca
+    .claude/skills/git-remotes/references/push.md: sha256:3e54bbf46de80afd4080488f3c3d6082f34ca7ed24bf3a29ca4a3b8809baa1b6
+    .claude/skills/git-remotes/references/remote-config.md: sha256:22e3cb9a1b5191d953ec6be88450d9667a7585f7e9d349f3424a0035ec5c8339
    .claude/skills/git-remotes/references/sources.md: sha256:ab4bbb3234eca2f2e71700d83d148dba44b741b7f0515ffe051380a43a0f7c84
    .claude/skills/git-submodules/README.md: sha256:8589e78051a811055b382790252f13a00bd0008ebc220cf023efb05d0d12bd77
-    .claude/skills/git-submodules/SKILL.md: sha256:ef16cfa16b916423e1d5855587403788b4034166318525adcd5dc1ea23cb0bcf
+    .claude/skills/git-submodules/SKILL.md: sha256:39556b16ff488b4626a0292624676d8ca59b887c627eea04712786811b734d1c
    .claude/skills/git-submodules/references/README.md: sha256:217eeefcb78dc9f48e351e9bed4776c54220564f09888b137c1adbe5d5342971
    .claude/skills/git-submodules/references/removal.md: sha256:604d76043ca8644e9425d46593be3267ba3f54e36cfbd454570ef5a9ac962ea8
    .claude/skills/git-submodules/references/setup-and-update.md: sha256:7f03634a15736deac462cd21335f8bda7d2662f36d91a7127ad6b7105361021e
    .claude/skills/git-submodules/references/sources.md: sha256:17187d35af6f6f2dc6515f661f291525cdc7383c731d0547e12521f744c2e604
    .claude/skills/git-submodules/references/urls-and-config.md: sha256:b1269515cf549d52fcf122cc5cdb6fbb56bc4ea974e77d36eef063aa86c7cbec
    .claude/skills/git-workflow/README.md: sha256:cc96c23118e821a2e9ab1f6370484ea5cc97f3a0fd285c1b7f3782f0de62117c
-    .claude/skills/git-workflow/SKILL.md: sha256:06c737da977e4a624a1100fdc502d2e250692cd9f870a7bc3eefac5835c511ef
+    .claude/skills/git-workflow/SKILL.md: sha256:39344f72b57db9d4282f32bbf80950c1e4ba344f9f0f90d3cddf7a95275d7f79
    .claude/skills/git-workflow/references/README.md: sha256:27f978e69d5ffbcdd99c28ff42361da7824e7466b6a34cbf7c4b0feceb16f1ae
    .claude/skills/git-workflow/references/hard-rules.md: sha256:7c7a6888527a3925333e0d44129de819d8c5e5161ae1de8551b2f1536d3b2ff2
    .claude/skills/git-workflow/references/sources.md: sha256:e8078edd12bdbe0c81a7796f330ae2a06d78129ff20038c6bf98a8e638860786
    .claude/skills/git-worktrees/README.md: sha256:eeec5c51f9e0353b9cfcfd3b7309ac23d0fb3a1fdacb9006d6d2fc1c0ef099dc
-    .claude/skills/git-worktrees/SKILL.md: sha256:4758187c798ddb90ebc3e18e76021159aaa857bc3cdd7f8b211a2d6f616db6bd
+    .claude/skills/git-worktrees/SKILL.md: sha256:e4acbd3fcc551d7accbe1f330c0b3b54b960c9dc000073a985744e8b783a308a
    .claude/skills/git-worktrees/references/README.md: sha256:0778b6c81f7e77c84476fd966195b19f7b1c4553d35f5ffa016f72405c943c29
    .claude/skills/git-worktrees/references/sources.md: sha256:f4264a817836959685bfc286209d997295bb964524ba4e17027c39f25c3bccfd
-    .claude/skills/git-worktrees/references/worktrees.md: sha256:655fc3e9848e58a4c996efdd2fa1a90f43cec22a455ddb678959f347d2bc4ef0
+    .claude/skills/git-worktrees/references/worktrees.md: sha256:7c281d3aebccadf48249c2139a7a54c1ebb89ff9e240ea84b00993e723d4cc5b
    .claude/skills/pc-author/README.md: sha256:f363d981e55aa3aafdacb6242ce971c0afbea36c7f2d9ce0dce88dab9c476aeb
-    .claude/skills/pc-author/SKILL.md: sha256:a7a9a34a5efa4a0ec9f73cd2bc626d08dd0c2130f9ffc219e7bdd230eab717ff
+    .claude/skills/pc-author/SKILL.md: sha256:3dfa11b7565b5d29995511f9680b7c804a5ca311bf6b96767fdd5e3dec1a1802
    .claude/skills/pc-author/references/README.md: sha256:8fc13224aa64f5931a4f3e06198f67ed621066a69384b95c61ad91d08e86e602
-    .claude/skills/pc-author/references/create-config.md: sha256:6f52e367de858739fe87e67c1f7c6fbc21c79650ad14289441d2d13884deaee2
+    .claude/skills/pc-author/references/create-config.md: sha256:7b54f582d6919eb10952f4423e322a6e3f0d594984ee3e26c4e13f913e86f96f
    .claude/skills/pc-author/references/hooks-by-language.md: sha256:9d585293c8801dd41a0f1842e5ac495be4552fc188c564bb074cb9244a189e19
-    .claude/skills/pc-author/references/modify-config.md: sha256:7f1c90805e0467e857c67ae20fbb5968136c1e4c703076f2b2cd599990a71216
+    .claude/skills/pc-author/references/modify-config.md: sha256:455fd6308fedfffbf048a22f14a025583c80173d76029666c01f1048e75785ab
    .claude/skills/pc-author/references/sources.md: sha256:5546cccd0bf7e725e97de29c96da128a8e39ef1a23102ecd668018c74c30a4cb
    .claude/skills/pc-run/README.md: sha256:dab1352741c11f8892720f352d38fdf7e501a416d9219d604476185aa3dc0e69
-    .claude/skills/pc-run/SKILL.md: sha256:3f8b75868ff9b8d7b79136c4b02c46cc2719dfb778c1bd2bb8115a2d76e6f95d
+    .claude/skills/pc-run/SKILL.md: sha256:b78b8141483f143661c439ae1db1b004f8ddbb9458e57c9a62ab9017d278129f
    .claude/skills/pc-run/references/README.md: sha256:913f47285687f72716b95cb33a2036327fb4335c4d935aa5cfc2bc043b639773
    .claude/skills/pc-run/references/autoupdate.md: sha256:e0c3c53f8dfb2f1cccaaa38e7902f5b7196a128c41cdd7dfc4e95a5da6fecd9a
    .claude/skills/pc-run/references/clean.md: sha256:49a66a985c5adfabc876da4e0a2355fa8c22cbcbfbd7548e4b154b094080d87a
-    .claude/skills/pc-run/references/failure-patterns.md: sha256:c4ebaec91cbbfdb15cce5601b0e86e8556345ec34de9846e0f66c628be06836a
+    .claude/skills/pc-run/references/failure-patterns.md: sha256:cb89eef879f1408db70c863b567d068e9cbc5a7642e31f1e757db5891f72b558
    .claude/skills/pc-run/references/install.md: sha256:71ec08d58b8797b09574a827ea06d2c9656e3394d40534860fdaf333f5c19070
    .claude/skills/pc-run/references/sources.md: sha256:f23b3f50045bcff9644019c629451ffc90fe9fabf8dbfd3011c16ef011e48aab
-  content_hash: sha256:0210ee4fb9b5b2eaf2695a52dc8681d267245a6e89fa547021bb9292c721982a
+  content_hash: sha256:3226cd865c537d1e7f9d16e99c8583959125e767ba4fd908d64b764ab7ca6e11
  declared_license: MIT
 - repo_url: Defame1297/holocron
  name: gitea
  host: git.dev.rkdr.net
-  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
-  version: 1.3.7
+  resolved_commit: b7bec71b8f5fb15187bcd32b1f76e6f6fa7afce9
+  version: 1.3.8
  virtual_path: plugins/gitea
  is_virtual: true
  package_type: marketplace_plugin
@@ -361,37 +361,37 @@ dependencies:
  - .claude/skills/gitea-workflow/references/sources.md
  - .claude/skills/gitea-workflow/references/status-checkin.md
  deployed_file_hashes:
-    .claude/agents/gitea-orchestrate.md: sha256:57075f127535b201cc6e153d5817ab57d5f9c80dc22c7759092ecb0f0028c0c7
+    .claude/agents/gitea-orchestrate.md: sha256:4bbbbdd450493bde0a39d848e0cb5abfa6fdbccd1be6b20fc15cb5e9da7129ef
    .claude/skills/gitea-branches/README.md: sha256:2f9a0f16351c8b2d6dbb71724d372bb9c267b345b12948ecf840fe4f21faf650
-    .claude/skills/gitea-branches/SKILL.md: sha256:1ac80735b5bccf47b7faaba7d077e6c48c9c43970fc9307104b8986efab90934
-    .claude/skills/gitea-branches/references/branches.md: sha256:cfc3323175ff56d155b57a65194dfa32459a5a1a4f1b266bb62e05449e39a27b
+    .claude/skills/gitea-branches/SKILL.md: sha256:4b0e94536ce165c04d30d63f7814d303c446dcd49fabc52011e6c09b29e1222c
+    .claude/skills/gitea-branches/references/branches.md: sha256:c65791766cfa9f493307bd4d45d44854b4d4eb157838c9a3d565ed0b33ed3359
    .claude/skills/gitea-branches/references/commits.md: sha256:7ded733117e3bf8c1a5bba54786197ad72aa9f743d27afafd8c36242ab7b0ce3
    .claude/skills/gitea-branches/references/sources.md: sha256:f206f9ac91146771539cbf288e73d1202d22f05414d9d1806d0dcf5c7ad02152
    .claude/skills/gitea-files/README.md: sha256:2b9bfafdab57af61f3330fdb37070c3d301ee73c6631fde9cb36cdf28e88c466
-    .claude/skills/gitea-files/SKILL.md: sha256:808612acc0c28fde06cdecefa1d0d413129c7110059041616bc642ea596068c3
+    .claude/skills/gitea-files/SKILL.md: sha256:01e2149539bb8fc571746d59a52d21140ddb37f9b1cac2a590c106f0b893cf32
    .claude/skills/gitea-files/references/reading.md: sha256:93a5d8dd909ffdbf2bac09fbe7d819bd8fe26979808c5f5bf8ca5dcce435c752
    .claude/skills/gitea-files/references/sources.md: sha256:4fbd03f275fb72899fc4489737f13074dfb61704965bd2bd52a372deff426fbb
    .claude/skills/gitea-files/references/writing.md: sha256:3a5b0b5043fef2c55a0b009a6bf7998a45c3e5770f8b7ac11abd4a1e7b6b351e
    .claude/skills/gitea-issues/README.md: sha256:b2781529ea793022765dd4aa96faf5d3dcdaeb088c710b14201a4e73bb1cc580
-    .claude/skills/gitea-issues/SKILL.md: sha256:2b776f204579142e27885a9d6f4456076bf2262d785016c46a973afef44797b6
+    .claude/skills/gitea-issues/SKILL.md: sha256:a3642d87fc1cd6784a3d10ca29fa5cea050b1e9592e1c012bbe6d16bad97fc60
    .claude/skills/gitea-issues/references/enrichments.md: sha256:1daa0758116e818f12f89fa43b031d9cd2518f73de95bc54d94d5536667b68e9
    .claude/skills/gitea-issues/references/issues.md: sha256:7a1c4c42413df84645fbea70b29b2dcd732f52bfee259b2e28506dc101eed9f5
    .claude/skills/gitea-issues/references/search.md: sha256:651a4493b166a498932bd0902d16efde273c49c6fc597bfb0e1b1c0296f7a742
    .claude/skills/gitea-issues/references/sources.md: sha256:d6d358029298537db4d13dea84ee274006bce3e7f99b1aaed963d8703cba2250
    .claude/skills/gitea-labels-milestones/README.md: sha256:4606f16d1639f0a2fe46fcb341a54b673b0bbaeef12c197e2022bdf57b479c37
-    .claude/skills/gitea-labels-milestones/SKILL.md: sha256:52aec1a75050b46e3c386eb20454c7a9bddf9bde9a38ab3331a9b06d2e0f5302
+    .claude/skills/gitea-labels-milestones/SKILL.md: sha256:a650fdaab8300f8395af0f953e918e65baa17810164ad682a3dee15181091b9d
    .claude/skills/gitea-labels-milestones/references/label-inference.md: sha256:9aa51cc751f692932b5eecee698eba6eaa3e9f13e423e0fd3b13ffecaf26fc0e
    .claude/skills/gitea-labels-milestones/references/labels.md: sha256:365730208ccbdf0f8fe3b2b49c1539208811029e3c343edcbe39b674a46a0527
    .claude/skills/gitea-labels-milestones/references/milestones.md: sha256:0b26f006cfb154d13b2a2fbf356b74f6339e7ab9c34041d50ade676f6c2d17d8
    .claude/skills/gitea-labels-milestones/references/sources.md: sha256:b0a1c8cb678e21cf284e4efa5b75a2414c76a8e3898c449e8b60504d1d465bd5
    .claude/skills/gitea-prs/README.md: sha256:c8c11f5e3cfa7768fe3dfabf935564e5b08d1f7f6629d1dc2149c28b3b8e8ec0
-    .claude/skills/gitea-prs/SKILL.md: sha256:ec4b0c38a70cdcaf374ff92a706fcac151dc7b8e358dac36bd202ee3444ea799
+    .claude/skills/gitea-prs/SKILL.md: sha256:8314cdeabed9771d4ed600638e7ec5941b8c13b2cf7031ba66869d45c0787474
    .claude/skills/gitea-prs/references/merging.md: sha256:5f8b55b1a729f122ee265fb5da69369fc27434a13dd02fc112801f945d2c9d19
    .claude/skills/gitea-prs/references/pull-requests.md: sha256:6f4b9de079ebe248282243a2920016bfb172d4115ad712feb1757bb57d5eec3e
    .claude/skills/gitea-prs/references/reviews.md: sha256:97cef439e20595ab90cfa0105cff3ef39a53989172a9c0603374d16498f426b5
    .claude/skills/gitea-prs/references/sources.md: sha256:e2c2792013550f99281f517310bd76d2e5d56751ace6da117ce602048d5342c5
    .claude/skills/gitea-releases/README.md: sha256:e5d2dd0748990c1d99f2065c97c275bb14eb4fb447c94e76c332bc5952fadb99
-    .claude/skills/gitea-releases/SKILL.md: sha256:f3b9e867abf0fe3be88dc34242b18d96bd0f361252d7472ecacdd310689d36e0
+    .claude/skills/gitea-releases/SKILL.md: sha256:94e913a4815cc6c1e118e789542d79a4d46a43f45c2d01495189ef371e85255b
    .claude/skills/gitea-releases/references/call-signatures.md: sha256:1f7b40c390a5d032f8a00609194d8ce2107ac06d420b56d316837a6ec7dda982
    .claude/skills/gitea-releases/references/conventions.md: sha256:2a5613796701d0e27eaec1f71a1dc12f5fd5c2861ea001689d057da8c830cfba
    .claude/skills/gitea-releases/references/sources.md: sha256:30c43a93f4d7ea05ef3d013a68f8656317ef6cef6773ce9944d35b24a93bdc80
@@ -401,13 +401,13 @@ dependencies:
    .claude/skills/gitea-workflow/references/skill-index.md: sha256:b53d8148ea8cf6e4cabd15cab39f60b98167d930f590ca0fdcb5f2f3969edc5e
    .claude/skills/gitea-workflow/references/sources.md: sha256:21305440e8060adbdf5af2b946d2e173ad35f8326dd9e24cd1f769fefde92f7f
    .claude/skills/gitea-workflow/references/status-checkin.md: sha256:c6da98ecbe1d2919222bfb856cf10c3fb9971423e1eb6590a15f6fc7550f102d
-  content_hash: sha256:f306f493e32600c8d1bc2884125e1e455cdc5d4322300f5c3a17c855f81e001f
+  content_hash: sha256:9c5ff569553de6d2c465881aee48991aa64459f68b938671d572c6a65c7e993e
  declared_license: MIT
 - repo_url: Defame1297/holocron
  name: kyberforge
  host: git.dev.rkdr.net
-  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
-  version: 1.6.1
+  resolved_commit: b7bec71b8f5fb15187bcd32b1f76e6f6fa7afce9
+  version: 1.6.2
  virtual_path: plugins/kyberforge
  is_virtual: true
  package_type: marketplace_plugin
@@ -517,7 +517,7 @@ dependencies:
    .claude/agents/apm-orchestrate.md: sha256:7c4b7efb58ecdd26fea835613d0f7f909706607cac4f002a0df2db2a3a0ee477
    .claude/hooks/kyberforge/.apm/hooks/check-apm-current.sh: sha256:96f44d63b5f4906ac1add5c32b718176ec10c8514615151d7303d9845c607b46
    .claude/skills/agent-audit/README.md: sha256:c2f1fca5e0c8c713904d82888691efa605670dc08a03aed5c8233a7f26cf7d53
-    .claude/skills/agent-audit/SKILL.md: sha256:1fa16e4cb540283d2da0d17585df821963a72dc0a0235f134205c54805d95f03
+    .claude/skills/agent-audit/SKILL.md: sha256:ced4700e2c23e0583f153d70386e659277fd1575de096d68e301667b6019c0d9
    .claude/skills/agent-audit/assets/vale/.vale.ini: sha256:d643677585c603edcc8816b15d9c85c81b677ded02247b521ba8b88ae5bfdf57
    .claude/skills/agent-audit/assets/vale/styles/Kyberforge/CompositionNote.yml: sha256:e0a52fb9ff65aee9d21d1f7b61bef0f71d14b8edd9af1d70246715bbb8844ccf
    .claude/skills/agent-audit/assets/vale/styles/Kyberforge/DescriptionOpener.yml: sha256:60984e0af965137a151a07875f388c94ea2da93d4ee4f2b92811bd14105527f2
@@ -527,11 +527,11 @@ dependencies:
    .claude/skills/agent-audit/assets/vale/styles/KyberforgeCopilot/ProactivePhrase.yml: sha256:ba4f91479f66f9f03c74f791cbc6130b24bbc31a25f3897b424f72d02473b9b4
    .claude/skills/agent-audit/references/README.md: sha256:9d2acf43aa4e8b2b71c99224d1ea8c7c2ff4d27d7c6982175bf1a52ceffd7be8
    .claude/skills/agent-audit/references/body-and-delegation.md: sha256:e559a185e3de779ce599ba6ccbad316df43f158a9f002bbc88828eeba748066a
-    .claude/skills/agent-audit/references/description-quality.md: sha256:89572997ca01df1c526759fe5d324c3ebbbee314172849d82caef16c4992a4d3
+    .claude/skills/agent-audit/references/description-quality.md: sha256:9157c3b13f7486339c3c262deb2dbac30ef01ed750f109962ec30f8e4baa78ef
    .claude/skills/agent-audit/references/field-inventory.md: sha256:24feb0d25dd85c4fbd4558fbca78bd66974a8fc5be2d5c952c7a8ed7168f7d65
    .claude/skills/agent-audit/references/finding-criteria.md: sha256:c18934428215154daf5543f4e8e40ca55c9833125e8b29feca513f99376c5663
    .claude/skills/agent-audit/references/scope-plugin-apm.md: sha256:af32acf33aec0cd0a98022ee6796265066c693662e8874a8e4d7e03ce1657c88
-    .claude/skills/agent-audit/references/scope-project-user.md: sha256:9ea0d4014d78a6b02c760e42fb6cb72b3441ae6c93991fdeca666857bad05056
+    .claude/skills/agent-audit/references/scope-project-user.md: sha256:710c2d65fbdc95e98e351a7f698d099969fac767e3c132ddb59989afa8dbe94c
    .claude/skills/agent-audit/references/sources.md: sha256:86f93524eae02c06be01e9feb3b751805b4f6a7da824e242693d588496c9e490
    .claude/skills/agent-audit/references/validation-scripts.md: sha256:99c6d23a1d45184f1b2265dae31f66392defa094522d1f199187d172cbf306ea
    .claude/skills/agent-audit/scripts/README.md: sha256:ee427eed6a562a6e86898c69c35508c518d5b3c633ae803e587fbab37514f2b2
@@ -539,7 +539,7 @@ dependencies:
    .claude/skills/agent-audit/scripts/validate-provenance.sh: sha256:197a9bef1a58fa2457a4ae0b802c7b362911e26cec0a5f0194840c95500057a4
    .claude/skills/agent-audit/scripts/validate.sh: sha256:aa21b99ebc6bcd845066113d74e39d86c8c2858067edfe855d03cbf42531150b
    .claude/skills/agent-author/README.md: sha256:b2d14a3c8fc3ddc3935d0bd1765192b333b944baaf9bfa9a350bef0985890265
-    .claude/skills/agent-author/SKILL.md: sha256:8fe96e4744378cd33876cf87a08a20af001898e89f0f27087044e1b87eac61f2
+    .claude/skills/agent-author/SKILL.md: sha256:448f495015b65b7b86c5cd7dfbcfad2dc45238242ab3d149b1019ec33eee6f89
    .claude/skills/agent-author/assets/README.md: sha256:730b2321b5f16dcc63fc5dc842618c116afc75217ae925057dafc490e7d57644
    .claude/skills/agent-author/assets/templates/apm-agent.md: sha256:9b57e2b93a5705388351f14294d60833325d9596cf5294d22f4a586165fc35fa
    .claude/skills/agent-author/assets/templates/claude-code.md: sha256:ea0bac6e8cd91c767c6114cbcf1ecd124d03abff06ba81696dac5115499c395a
@@ -556,10 +556,10 @@ dependencies:
    .claude/skills/agent-author/scripts/README.md: sha256:e8ea2f3391ca297afeda03911768000617a71df0cf9d673bbb260ee5bbfed7c2
    .claude/skills/agent-author/scripts/new-agent.sh: sha256:1c631f5178c6c0c397d7ceefb606892dd7e330cd1b22a03c1e4d11e85fbdb7de
    .claude/skills/apm-install/README.md: sha256:f48ca12116d20584fd4582d3ba44a9f02cddab2ae2f12c41abfc3455b4640203
-    .claude/skills/apm-install/SKILL.md: sha256:ee0877665f2fd9ff4e764b7957ebb9b6f6006ffabc254cba8c2ecfeaf9848278
+    .claude/skills/apm-install/SKILL.md: sha256:822b488d8c205f10bd212812488592a082a2be6ee0acf1953c34cf49d9973966
    .claude/skills/apm-install/references/sources.md: sha256:b80245ff8ae179d458572cb9b03621d00bf7e2f052f0cd71b88112c0ea8a91ce
    .claude/skills/apm-workflow/README.md: sha256:b9e422212c93b188ad0992e2cacb3ef475467b1e1c33981cf26946ce6f11de5a
-    .claude/skills/apm-workflow/SKILL.md: sha256:ac5738fc899ae259977df7b6c20695f18f1b1929e65909fce5311639f0a307d4
+    .claude/skills/apm-workflow/SKILL.md: sha256:740e39be5abd5b7b82b6c665ab162fe8e7ce6a21aaa7f5344041a23c0a11b89d
    .claude/skills/apm-workflow/references/audit.md: sha256:9b3fe128cbe133c8f2880a968b4cd6e875cc0eb79ef6738a9bfdabdf28446fe2
    .claude/skills/apm-workflow/references/compile.md: sha256:26bbdffce73dce9b1b5589b24aec521c7a4d842c94e5a555031144afda4ce437
    .claude/skills/apm-workflow/references/configure.md: sha256:0b053dad39543679c72d8267667b49c9823f6bfeca781f0caf4e26d7380be1fe
@@ -567,13 +567,13 @@ dependencies:
    .claude/skills/apm-workflow/references/marketplace.md: sha256:d170ae4853d6f0f369667044e6e124ba8bc3d9235a268240ac45d58973481dfc
    .claude/skills/apm-workflow/references/sources.md: sha256:4ae44a9e82e8ec3bd4b1a61f32adbd3f3ff5fab21db3b4162765b2c0553e49fd
    .claude/skills/forge/README.md: sha256:e7bc187af3072cb554ffeac5a90e24e87b3e086ba7c8fc104b7b542237070dcc
-    .claude/skills/forge/SKILL.md: sha256:a87b5c375c42142eedc2452b2b9b48033a18fb649e94a458f22cfbd4b0accfe4
+    .claude/skills/forge/SKILL.md: sha256:8c76c6788e20eb1e237d14dc236ff29c83a1ec8f8135989b22c0ca6f414d7a1c
    .claude/skills/forge/references/apm-routes.md: sha256:b7d74d12ff34648be968db3e9db66c1be2efa420cad0eceea20374aa100659aa
    .claude/skills/forge/references/author-routes.md: sha256:3f60ba054d4823adeccd8a83ad06b39860bd599df94056aa94c3d9e4293e0c1f
    .claude/skills/forge/references/sources.md: sha256:08f5c6857fef904e48cc9e8cf159673c2f70c6d27e851175b8ce929b1de08243
    .claude/skills/forge/references/version-bump.md: sha256:8046a8a2a2b019800101cc215e8ee87bdcf42cd6240ea1b484537a06baf27bef
-    .claude/skills/skill-audit/README.md: sha256:fe6002082a5da01579dd2693a3c4cc2ab557d5c63110c818b312fbccb98d0534
-    .claude/skills/skill-audit/SKILL.md: sha256:492d0895374b31f6b65068fd388f0161b47ddffdafc99a571cec4ae1faa0f798
+    .claude/skills/skill-audit/README.md: sha256:d8f557918534c543130806e1acd182da2722c9e62b1319fa18a6caaa69d5befd
+    .claude/skills/skill-audit/SKILL.md: sha256:a628c3a45043d91f9271fbf6b593289ebd0bad842ccf60e07b27e03f05309455
    .claude/skills/skill-audit/assets/vale/.vale.ini: sha256:0d1108b17a941b514dd9a62a7382d1febdd543118750246c81fba406440a9f9f
    .claude/skills/skill-audit/assets/vale/styles/Kyberforge/CompositionNote.yml: sha256:e0a52fb9ff65aee9d21d1f7b61bef0f71d14b8edd9af1d70246715bbb8844ccf
    .claude/skills/skill-audit/assets/vale/styles/Kyberforge/DescriptionOpener.yml: sha256:60984e0af965137a151a07875f388c94ea2da93d4ee4f2b92811bd14105527f2
@@ -587,34 +587,34 @@ dependencies:
    .claude/skills/skill-audit/references/formatting-and-scripts.md: sha256:34a9b3e66b0f1852634a286891c0a9c00cb17bc49ddaa0b039c86f48f12bc282
    .claude/skills/skill-audit/references/patterns.md: sha256:411c0e9f00731c9c5258bb3fcebc74c1208ad8b51740e2fe41810cf72f7951fd
    .claude/skills/skill-audit/references/sources.md: sha256:d3bd14466fede4b62f6ac3d2b40712befcb028ed005c192beddeea31da752d8a
-    .claude/skills/skill-audit/references/validation-scripts.md: sha256:e1436269c2e5f8ed15abd65bcbed0619c5b84618f327ec90a28634980376dcef
+    .claude/skills/skill-audit/references/validation-scripts.md: sha256:b997583d698448649b31333607d9ec4936062629e6180824659afb6320416ffc
    .claude/skills/skill-audit/scripts/vale-wrap.sh: sha256:c17673b3b0de1c1a49fcb73e2b695835a45014ec1c300a77a3ba7b3c7ce4c995
-    .claude/skills/skill-audit/scripts/validate-provenance.sh: sha256:47bd47b710652358ebc687adf370516f1aa25b228d2dace9b49e5bc725eb6f2b
-    .claude/skills/skill-audit/scripts/validate.sh: sha256:1eaae273885f6a68b29086eca60ca72adb83a33d3391037b9461105d7fe9bf01
-    .claude/skills/skill-author/README.md: sha256:d22035d302818e103486e447bd92d2da4c9b73da60f30157941710f32f400b89
-    .claude/skills/skill-author/SKILL.md: sha256:615a936580f44dd8e523496aadf88df6d512ac58369190b90407e8fca86e8345
+    .claude/skills/skill-audit/scripts/validate-provenance.sh: sha256:cef3330b53bdaf56182cf50b237af5f781cecae615b79aba282993d8c6309c39
+    .claude/skills/skill-audit/scripts/validate.sh: sha256:8fb3f74f32c904a58b08c963a70a83ba1782b3a551d9bf1a6f7eb0db40f95a14
+    .claude/skills/skill-author/README.md: sha256:6d9c10bd17ece50f3ef0c1cac061b9e58d9779574ccc8a31d512162660ed52a2
+    .claude/skills/skill-author/SKILL.md: sha256:9e1232235d9be5bfbd0d143ab78c52e0659c19f94a31603fc608fa2c95bab45b
    .claude/skills/skill-author/assets/templates/README.md: sha256:f7e91356f4c85862f96a9f46a7a7ae8b5dc715c8174add5cf070166a8bae0658
-    .claude/skills/skill-author/assets/templates/SKILL.md: sha256:b20c65bd185b300de7e65d16decdf0ab4aaf6c094822c1f798b3c278d52abbff
+    .claude/skills/skill-author/assets/templates/SKILL.md: sha256:7ce8bb49c58ba5ae26e1fb25a6eb67340861ce18f34349144994467d461dc272
    .claude/skills/skill-author/assets/templates/assets/README.md: sha256:b72e51e643c45ded210a257e475d5661035d2aa5ed581e3294fd2aed00765c4b
    .claude/skills/skill-author/assets/templates/references/README.md: sha256:e2ef117972ab2625a456ed80ff085859666d145de4e270f383cde7c8e84ad60a
    .claude/skills/skill-author/assets/templates/references/sources.md: sha256:fe126720ba890b98e829f2626e3f5a361a0c2ce47eda97bd3f7dc1812ddd62b7
    .claude/skills/skill-author/assets/templates/scripts/README.md: sha256:ee427eed6a562a6e86898c69c35508c518d5b3c633ae803e587fbab37514f2b2
    .claude/skills/skill-author/assets/templates/tests/README.md: sha256:5d331de121105ca79b544b9d3779a316a64cee46fa8d51ba0ea789ab5c233442
    .claude/skills/skill-author/references/contract.md: sha256:8b4b1f4f05d5ee5398a332cc2ee48d59f0a09105dd84049f59ca040bda6f65dc
-    .claude/skills/skill-author/references/create.md: sha256:0837a77ad6da7ae9894134d15eebd57950b8505e8bd2b32ee69f281d65a6abcb
+    .claude/skills/skill-author/references/create.md: sha256:0e68eb208087956d92bf18e46b333bca1abca3933ff2e3af1715db9bb7094ec2
    .claude/skills/skill-author/references/deployment-modes.md: sha256:ffe2d928f2b5ec90c509f4d4cc5bd33c71899852cb5cc5a31fe1513b707fb759
-    .claude/skills/skill-author/references/improve.md: sha256:abe029587ce475fed165d8fcfa46ea1abe83f90727d093f8121a9a7a7daa5a3d
-    .claude/skills/skill-author/references/retrofit.md: sha256:414cf356bc7a23bc7af1f2b918159458bd59f3a35f48f00762718baa9f935918
+    .claude/skills/skill-author/references/improve.md: sha256:19acb4a9181f330b0046706db1750aaf178d6307dc81e93315d23cba52909b19
+    .claude/skills/skill-author/references/retrofit.md: sha256:a4b847ea23ec5b7ba4424662a76e2e513c01f8db1fbc6c476fdf1245dca23c72
    .claude/skills/skill-author/references/scripts.md: sha256:fe71da1fb3d947846ad1a37348f90866b0c4f7dbd81331cfe3300981656f6cc2
    .claude/skills/skill-author/references/sources.md: sha256:652f7ce26c0d68a3ed11db09206bff20ba230ca8ff1fe71ae45b6f4505979327
    .claude/skills/skill-author/scripts/new-skill.sh: sha256:c788b56f73ed4fd03edb179159361fe16e3afbf528a9895e9251909c5aa40a7f
-  content_hash: sha256:b04348085f13973504abd5107afa95bc45e7249ec523a5ee135bd9f62c6c4d1a
+  content_hash: sha256:5f2ee11b8094fb1d89dbfc9b8d90977a455128036b2257e9f206f5d55122aeaf
  declared_license: MIT
  exec_status: deployed
 - repo_url: Defame1297/holocron
  name: lint
  host: git.dev.rkdr.net
-  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  resolved_commit: b7bec71b8f5fb15187bcd32b1f76e6f6fa7afce9
  version: 1.1.7
  virtual_path: plugins/lint
  is_virtual: true
@@ -670,7 +670,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:57075f127535b201cc6e153d5817ab57d5f9c80dc22c7759092ecb0f0028c0c7
+  content_hash: sha256:4bbbbdd450493bde0a39d848e0cb5abfa6fdbccd1be6b20fc15cb5e9da7129ef
 - kind: project-relative
  target: claude
  value: .claude/agents/lint-runner.md
@@ -715,7 +715,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:1fa16e4cb540283d2da0d17585df821963a72dc0a0235f134205c54805d95f03
+  content_hash: sha256:ced4700e2c23e0583f153d70386e659277fd1575de096d68e301667b6019c0d9
 - kind: project-relative
  target: claude
  value: .claude/skills/agent-audit/assets/vale/.vale.ini
@@ -805,7 +805,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:89572997ca01df1c526759fe5d324c3ebbbee314172849d82caef16c4992a4d3
+  content_hash: sha256:9157c3b13f7486339c3c262deb2dbac30ef01ed750f109962ec30f8e4baa78ef
 - kind: project-relative
  target: claude
  value: .claude/skills/agent-audit/references/field-inventory.md
@@ -841,7 +841,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:9ea0d4014d78a6b02c760e42fb6cb72b3441ae6c93991fdeca666857bad05056
+  content_hash: sha256:710c2d65fbdc95e98e351a7f698d099969fac767e3c132ddb59989afa8dbe94c
 - kind: project-relative
  target: claude
  value: .claude/skills/agent-audit/references/sources.md
@@ -922,7 +922,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:8fe96e4744378cd33876cf87a08a20af001898e89f0f27087044e1b87eac61f2
+  content_hash: sha256:448f495015b65b7b86c5cd7dfbcfad2dc45238242ab3d149b1019ec33eee6f89
 - kind: project-relative
  target: claude
  value: .claude/skills/agent-author/assets/README.md
@@ -1201,7 +1201,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:ee0877665f2fd9ff4e764b7957ebb9b6f6006ffabc254cba8c2ecfeaf9848278
+  content_hash: sha256:822b488d8c205f10bd212812488592a082a2be6ee0acf1953c34cf49d9973966
 - kind: project-relative
  target: claude
  value: .claude/skills/apm-install/references/sources.md
@@ -1237,7 +1237,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:ac5738fc899ae259977df7b6c20695f18f1b1929e65909fce5311639f0a307d4
+  content_hash: sha256:740e39be5abd5b7b82b6c665ab162fe8e7ce6a21aaa7f5344041a23c0a11b89d
 - kind: project-relative
  target: claude
  value: .claude/skills/apm-workflow/references/audit.md
@@ -1318,7 +1318,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:817ed2655c2188c5c0b1e1dc5f4e762e699ad7fcd2a056e4ef73d5f6601dd1f8
+  content_hash: sha256:258d7c92c04d42f16b8143c58da66e0fc32a35d9991bb4de2db29856622a92ef
 - kind: project-relative
  target: claude
  value: .claude/skills/diagnose
@@ -1345,7 +1345,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:0844ba2bbede408be2e54a20cacd2e280c275c11ba45173381659a76f0c54cad
+  content_hash: sha256:f1c66493696890f50333b7515eb5876d26b51571bbafa75c5a66e0d8a0834a33
 - kind: project-relative
  target: claude
  value: .claude/skills/diagnose/assets/hitl-loop.template.sh
@@ -1399,7 +1399,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:a87b5c375c42142eedc2452b2b9b48033a18fb649e94a458f22cfbd4b0accfe4
+  content_hash: sha256:8c76c6788e20eb1e237d14dc236ff29c83a1ec8f8135989b22c0ca6f414d7a1c
 - kind: project-relative
  target: claude
  value: .claude/skills/forge/references/apm-routes.md
@@ -1462,7 +1462,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:3a0bcc9a0fce6d0789466a798161743d54d4251b7a4256b87a7cd9d3c0f5b458
+  content_hash: sha256:bb6d467274c0b0ede92ad1520192c58a3784ae04ae6122d10b966ed1cf89a3a4
 - kind: project-relative
  target: claude
  value: .claude/skills/git-branches/references/branch-operations.md
@@ -1471,7 +1471,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:c682142f969e943bae3a05cef24ce9661a4b36861da3b115cf07d762ebed4933
+  content_hash: sha256:a96fac103c01da2fe7a0b7f79ed146dc10ed510683d7b7a7e5223e4c104936b3
 - kind: project-relative
  target: claude
  value: .claude/skills/git-branches/references/branch-patterns.md
@@ -1489,7 +1489,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:38f22b0324981a0ad60d29b336e0824b63b1108863fb3e9870f1d93e32f09d82
+  content_hash: sha256:301326c4d5812c7e2d22e0d2a5624f18fa2f375b08ea24a878bf43aea4dd9cc4
 - kind: project-relative
  target: claude
  value: .claude/skills/git-branches/references/merging.md
@@ -1498,7 +1498,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:d144c237e7a8a1e709444af9e16c4d7804ba9f53fcae2326249d98885c48716e
+  content_hash: sha256:8f423cc6391d607bdc6b543d2f3cfe04415dad3334b176d7efee5fb6c4f4616e
 - kind: project-relative
  target: claude
  value: .claude/skills/git-branches/references/orchestrator-contract.md
@@ -1543,7 +1543,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:1658a63bc3209993580982c0aa7cbd2656a1d2b3519f2c421c65bf929c65ccfd
+  content_hash: sha256:68af7b4867992f34a2595a47e3dbd299f6a215c2d16163495027e7d409cc488f
 - kind: project-relative
  target: claude
  value: .claude/skills/git-commits/references/cherry-pick.md
@@ -1588,7 +1588,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:99fb88d022bbae4d1c1b84642d590439fe3142881821a99ed856aaeca43b699c
+  content_hash: sha256:e80e3cc3608c325a6c14b43a3fed985eed45c5154309dc323c0c9063efcc6a83
 - kind: project-relative
  target: claude
  value: .claude/skills/git-commits/references/sources.md
@@ -1624,7 +1624,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:dc117941d49c152e3d7e14f6e0595c308ab24378a24ff472a3f4ed98c003eb6f
+  content_hash: sha256:7db9fcb475cd61b53e2080ee667f5b6e3bea0080626291e91630d910eb22ff15
 - kind: project-relative
  target: claude
  value: .claude/skills/git-history/references/README.md
@@ -1642,7 +1642,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:75606d95ff592085b4bf35d09361ebbfcb8f3ba195a3f7d89aff187b99789a3b
+  content_hash: sha256:33a387ed026d33141841397c8e08bcd4b52eec05c4e4835c5783dd1a118c8aeb
 - kind: project-relative
  target: claude
  value: .claude/skills/git-history/references/git-log-format.md
@@ -1651,7 +1651,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:b17f36967c32b761a423bb14b900451208daa3be2dc6cba8709a6b60ad9b90fd
+  content_hash: sha256:535d607dec22aa169d33080aea44cf34b637d7623e3fbad494f3b08b5bc80fb8
 - kind: project-relative
  target: claude
  value: .claude/skills/git-history/references/sources.md
@@ -1687,7 +1687,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:88661a769ebb3d3b2bc64b58f11b2ff1c991ab6bc85e6f59c46e9472fe018598
+  content_hash: sha256:23c607ce8caa72b3e718f7a0c09ec8f1d68200494cd1460f5b736a74c683a258
 - kind: project-relative
  target: claude
  value: .claude/skills/git-remotes/references/README.md
@@ -1705,7 +1705,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:150c68ef952fafb02f12f1506bfabc5d1fe3b7fc1fcd5df0379943597f808b3a
+  content_hash: sha256:e3b52b7d7545faf20403a940580712d16dbc250aa927da566ddf163f949dfe5f
 - kind: project-relative
  target: claude
  value: .claude/skills/git-remotes/references/pull.md
@@ -1714,7 +1714,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:c06eda4c8090fb07d4b788f8fe2b6efdb0b0ab8c27eaafe8b077745997a22962
+  content_hash: sha256:e59305d434e6226086d494358ee978ad6213397da8e05cd97aee7c38318f2dca
 - kind: project-relative
  target: claude
  value: .claude/skills/git-remotes/references/push.md
@@ -1723,7 +1723,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:880e630792494ce4fab52e7965d548df7bfeaf2a8ba0a4ee775a1299810002b3
+  content_hash: sha256:3e54bbf46de80afd4080488f3c3d6082f34ca7ed24bf3a29ca4a3b8809baa1b6
 - kind: project-relative
  target: claude
  value: .claude/skills/git-remotes/references/remote-config.md
@@ -1732,7 +1732,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:779458aefcc932b90567b119b677789c2010e12eb38c5ad52f1be2e822c55019
+  content_hash: sha256:22e3cb9a1b5191d953ec6be88450d9667a7585f7e9d349f3424a0035ec5c8339
 - kind: project-relative
  target: claude
  value: .claude/skills/git-remotes/references/sources.md
@@ -1768,7 +1768,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:ef16cfa16b916423e1d5855587403788b4034166318525adcd5dc1ea23cb0bcf
+  content_hash: sha256:39556b16ff488b4626a0292624676d8ca59b887c627eea04712786811b734d1c
 - kind: project-relative
  target: claude
  value: .claude/skills/git-submodules/references/README.md
@@ -1840,7 +1840,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:06c737da977e4a624a1100fdc502d2e250692cd9f870a7bc3eefac5835c511ef
+  content_hash: sha256:39344f72b57db9d4282f32bbf80950c1e4ba344f9f0f90d3cddf7a95275d7f79
 - kind: project-relative
  target: claude
  value: .claude/skills/git-workflow/references/README.md
@@ -1894,7 +1894,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:4758187c798ddb90ebc3e18e76021159aaa857bc3cdd7f8b211a2d6f616db6bd
+  content_hash: sha256:e4acbd3fcc551d7accbe1f330c0b3b54b960c9dc000073a985744e8b783a308a
 - kind: project-relative
  target: claude
  value: .claude/skills/git-worktrees/references/README.md
@@ -1921,7 +1921,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:655fc3e9848e58a4c996efdd2fa1a90f43cec22a455ddb678959f347d2bc4ef0
+  content_hash: sha256:7c281d3aebccadf48249c2139a7a54c1ebb89ff9e240ea84b00993e723d4cc5b
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-branches
@@ -1948,7 +1948,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:1ac80735b5bccf47b7faaba7d077e6c48c9c43970fc9307104b8986efab90934
+  content_hash: sha256:4b0e94536ce165c04d30d63f7814d303c446dcd49fabc52011e6c09b29e1222c
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-branches/references/branches.md
@@ -1957,7 +1957,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:cfc3323175ff56d155b57a65194dfa32459a5a1a4f1b266bb62e05449e39a27b
+  content_hash: sha256:c65791766cfa9f493307bd4d45d44854b4d4eb157838c9a3d565ed0b33ed3359
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-branches/references/commits.md
@@ -2002,7 +2002,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:808612acc0c28fde06cdecefa1d0d413129c7110059041616bc642ea596068c3
+  content_hash: sha256:01e2149539bb8fc571746d59a52d21140ddb37f9b1cac2a590c106f0b893cf32
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-files/references/reading.md
@@ -2056,7 +2056,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:2b776f204579142e27885a9d6f4456076bf2262d785016c46a973afef44797b6
+  content_hash: sha256:a3642d87fc1cd6784a3d10ca29fa5cea050b1e9592e1c012bbe6d16bad97fc60
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-issues/references/enrichments.md
@@ -2119,7 +2119,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:52aec1a75050b46e3c386eb20454c7a9bddf9bde9a38ab3331a9b06d2e0f5302
+  content_hash: sha256:a650fdaab8300f8395af0f953e918e65baa17810164ad682a3dee15181091b9d
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-labels-milestones/references/label-inference.md
@@ -2182,7 +2182,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:ec4b0c38a70cdcaf374ff92a706fcac151dc7b8e358dac36bd202ee3444ea799
+  content_hash: sha256:8314cdeabed9771d4ed600638e7ec5941b8c13b2cf7031ba66869d45c0787474
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-prs/references/merging.md
@@ -2245,7 +2245,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:f3b9e867abf0fe3be88dc34242b18d96bd0f361252d7472ecacdd310689d36e0
+  content_hash: sha256:94e913a4815cc6c1e118e789542d79a4d46a43f45c2d01495189ef371e85255b
 - kind: project-relative
  target: claude
  value: .claude/skills/gitea-releases/references/call-signatures.md
@@ -2362,7 +2362,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:0af060d6813ed59547be14c7dfd544d5b626c852f7ec0f7213c27c7ec0ae76c1
+  content_hash: sha256:e24aa04add72fe6f081b861d6e5389debf12088146a453d3b9a0d3d98a575e6d
 - kind: project-relative
  target: claude
  value: .claude/skills/grill-with-docs
@@ -2407,7 +2407,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:26d06ea58adae5fa6ca8b406cc4a8d13ec3c9780bfb283c29ef0a8f8845f26f9
+  content_hash: sha256:91644db52834a9ce928fa5063c5e4e29a34113cc758bfa3778c12365d56911f2
 - kind: project-relative
  target: claude
  value: .claude/skills/improve-codebase-architecture
@@ -2461,7 +2461,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:4e54cc00ec301027f640ac5dd1877b0d9ec94c16e784da0cdab25e220167e53d
+  content_hash: sha256:773e0f50c80c2565ff8149d77efbf0a2ea9b25ef2b1ad679bb14ad7e9a3137aa
 - kind: project-relative
  target: claude
  value: .claude/skills/pc-author
@@ -2488,7 +2488,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:a7a9a34a5efa4a0ec9f73cd2bc626d08dd0c2130f9ffc219e7bdd230eab717ff
+  content_hash: sha256:3dfa11b7565b5d29995511f9680b7c804a5ca311bf6b96767fdd5e3dec1a1802
 - kind: project-relative
  target: claude
  value: .claude/skills/pc-author/references/README.md
@@ -2506,7 +2506,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:6f52e367de858739fe87e67c1f7c6fbc21c79650ad14289441d2d13884deaee2
+  content_hash: sha256:7b54f582d6919eb10952f4423e322a6e3f0d594984ee3e26c4e13f913e86f96f
 - kind: project-relative
  target: claude
  value: .claude/skills/pc-author/references/hooks-by-language.md
@@ -2524,7 +2524,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:7f1c90805e0467e857c67ae20fbb5968136c1e4c703076f2b2cd599990a71216
+  content_hash: sha256:455fd6308fedfffbf048a22f14a025583c80173d76029666c01f1048e75785ab
 - kind: project-relative
  target: claude
  value: .claude/skills/pc-author/references/sources.md
@@ -2560,7 +2560,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:3f8b75868ff9b8d7b79136c4b02c46cc2719dfb778c1bd2bb8115a2d76e6f95d
+  content_hash: sha256:b78b8141483f143661c439ae1db1b004f8ddbb9458e57c9a62ab9017d278129f
 - kind: project-relative
  target: claude
  value: .claude/skills/pc-run/references/README.md
@@ -2596,7 +2596,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:c4ebaec91cbbfdb15cce5601b0e86e8556345ec34de9846e0f66c628be06836a
+  content_hash: sha256:cb89eef879f1408db70c863b567d068e9cbc5a7642e31f1e757db5891f72b558
 - kind: project-relative
  target: claude
  value: .claude/skills/pc-run/references/install.md
@@ -2641,7 +2641,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:873d3c3bf9e46af5e61598a9030ac0304b58f900f48f102e7322c825d5fe435a
+  content_hash: sha256:ef4e45505cee1e43776da7606fcbe021655c53fd4e5fd9ddab079ae94224b8ca
 - kind: project-relative
  target: claude
  value: .claude/skills/prototype/references/logic.md
@@ -2749,7 +2749,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:245cec403e83b8c7fbc0f17e684858d49f06d35a3bcbb5f967f81c4efe5bdafc
+  content_hash: sha256:0b9099a5836e076b348d3aca606729e8012c46680404f3596467b91416ae6785
 - kind: project-relative
  target: claude
  value: .claude/skills/research/references/file-format.md
@@ -2785,7 +2785,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:fe6002082a5da01579dd2693a3c4cc2ab557d5c63110c818b312fbccb98d0534
+  content_hash: sha256:d8f557918534c543130806e1acd182da2722c9e62b1319fa18a6caaa69d5befd
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-audit/SKILL.md
@@ -2794,7 +2794,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:492d0895374b31f6b65068fd388f0161b47ddffdafc99a571cec4ae1faa0f798
+  content_hash: sha256:a628c3a45043d91f9271fbf6b593289ebd0bad842ccf60e07b27e03f05309455
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-audit/assets/vale/.vale.ini
@@ -2920,7 +2920,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:e1436269c2e5f8ed15abd65bcbed0619c5b84618f327ec90a28634980376dcef
+  content_hash: sha256:b997583d698448649b31333607d9ec4936062629e6180824659afb6320416ffc
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-audit/scripts/vale-wrap.sh
@@ -2938,7 +2938,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:47bd47b710652358ebc687adf370516f1aa25b228d2dace9b49e5bc725eb6f2b
+  content_hash: sha256:cef3330b53bdaf56182cf50b237af5f781cecae615b79aba282993d8c6309c39
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-audit/scripts/validate.sh
@@ -2947,7 +2947,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:1eaae273885f6a68b29086eca60ca72adb83a33d3391037b9461105d7fe9bf01
+  content_hash: sha256:8fb3f74f32c904a58b08c963a70a83ba1782b3a551d9bf1a6f7eb0db40f95a14
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author
@@ -2965,7 +2965,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:d22035d302818e103486e447bd92d2da4c9b73da60f30157941710f32f400b89
+  content_hash: sha256:6d9c10bd17ece50f3ef0c1cac061b9e58d9779574ccc8a31d512162660ed52a2
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author/SKILL.md
@@ -2974,7 +2974,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:615a936580f44dd8e523496aadf88df6d512ac58369190b90407e8fca86e8345
+  content_hash: sha256:9e1232235d9be5bfbd0d143ab78c52e0659c19f94a31603fc608fa2c95bab45b
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author/assets/templates/README.md
@@ -2992,7 +2992,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:b20c65bd185b300de7e65d16decdf0ab4aaf6c094822c1f798b3c278d52abbff
+  content_hash: sha256:7ce8bb49c58ba5ae26e1fb25a6eb67340861ce18f34349144994467d461dc272
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author/assets/templates/assets/README.md
@@ -3055,7 +3055,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:0837a77ad6da7ae9894134d15eebd57950b8505e8bd2b32ee69f281d65a6abcb
+  content_hash: sha256:0e68eb208087956d92bf18e46b333bca1abca3933ff2e3af1715db9bb7094ec2
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author/references/deployment-modes.md
@@ -3073,7 +3073,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:abe029587ce475fed165d8fcfa46ea1abe83f90727d093f8121a9a7a7daa5a3d
+  content_hash: sha256:19acb4a9181f330b0046706db1750aaf178d6307dc81e93315d23cba52909b19
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author/references/retrofit.md
@@ -3082,7 +3082,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:414cf356bc7a23bc7af1f2b918159458bd59f3a35f48f00762718baa9f935918
+  content_hash: sha256:a4b847ea23ec5b7ba4424662a76e2e513c01f8db1fbc6c476fdf1245dca23c72
 - kind: project-relative
  target: claude
  value: .claude/skills/skill-author/references/scripts.md
@@ -3136,7 +3136,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:46bc2a4c55b15e96fdd002167f37b43245e64fcbecb61daed11eac6e0d026da8
+  content_hash: sha256:b61ae804b51be1c085b636daee24af0065cd07de579242e055fc0ce15dd8daf0
 - kind: project-relative
  target: claude
  value: .claude/skills/tdd/deep-modules.md
@@ -3226,7 +3226,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:42042bf7c3e6392d1ff0a0536fe0692fa710d6818e2501db77c7f22fa6e423cb
+  content_hash: sha256:dd2510eeef27f09b6d8d134860515ebe89bd7f1c15e78a961ff930bf1eca0f74
 - kind: project-relative
  target: claude
  value: .claude/skills/vale-config
@@ -3343,7 +3343,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:25af5dc9e67a0755bc7a2cb99a1008156ba1fd17b283bdb5cc82dfccdb834421
+  content_hash: sha256:1e34da388a48e7a3485de1db47d25bf4610b74dbe8ef5232fc529a69d05bfed7
 - kind: project-relative
  target: claude
  value: .claude/skills/zoom-out
@@ -3370,7 +3370,7 @@ deployments:
  owners:
  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:2a6894c7f9b1c9c55f451c625a834c4f377e217b623a85280e55db5fe9cacf48
+  content_hash: sha256:5e7e6689136eb5047da3b90364efe07734d7d741fc0979ee18e19e755a8c9483
 - kind: uri
  target: mcp
  value: obsidian
--- a/apm.yml
+++ b/apm.yml
@@ -42,7 +42,7 @@ dependencies:
 # after a kyberforge release, check this first.
 executables:
  allow:
-    kyberforge#1.6.1:
+    kyberforge#1.6.2:
      hooks: true
      bin: true

@@ -79,25 +79,25 @@ marketplace:
    - name: kyberforge
      description: Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
      source: ./plugins/kyberforge
-      version: 1.6.1
+      version: 1.6.2
      category: Developer Tools

    - name: bin
      description: Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.
      source: ./plugins/bin
-      version: 1.1.6
+      version: 1.1.7
      category: Utilities

    - name: git
      description: Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.
      source: ./plugins/git
-      version: 1.3.6
+      version: 1.3.7
      category: Version Control

    - name: gitea
      description: Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.
      source: ./plugins/gitea
-      version: 1.3.7
+      version: 1.3.8
      category: Version Control

    - name: core
--- a/docs/adr/0022-skill-metadata-version-is-mandatory.md
+++ b/docs/adr/0022-skill-metadata-version-is-mandatory.md
@@ -43,6 +43,13 @@ per-plugin choice.
 - **The one outlier in the other direction, `git-commits`, keeps its existing value** (`0.1.3`) —
  it already had real tracked history under the old conditional rule, and this decision does not
  reset skills that were already compliant.
+- **`bin/write-docs`'s top-level `version:` moves into `metadata:`, normalized to `1.0.0`.** It is
+  the one skill that carried a version outside the `metadata:` block, which is why the table above
+  counts `bin` as 0 — a top-level `version:` is not `metadata.version`, and nothing reads it. #127
+  raised it alongside the split because "does a skill carry a version" and "where does it live" are
+  the same question. Its value (`1.0`) is not semver and carries no more real history than the 27
+  unversioned skills, so it is relocated and reset to the same `1.0.0` seed rather than preserved
+  like `git-commits`'s tracked `0.1.3`.
 - **`skill-frontmatter`'s pre-commit hook gains the check.** It already fails a SKILL.md missing
  `name:` or `description:`; a missing `metadata.version` is now the same class of failure, not a
  style nit an audit might or might not catch.
@@ -62,9 +69,10 @@ it discards real revision signal for no gain.

 ## Consequences

-27 SKILL.md files gain `metadata.version: "1.0.0"`. `skill-author`'s `create.md` moves the field from
-"Optional frontmatter" to the required list, citing this ADR. `skill-author`'s own SKILL.md drops the
-"with `metadata.version` present" conditional in its bump-rule line, since presence is no longer in
-question. `.pre-commit-config.yaml`'s `skill-frontmatter` hook is extended to require the field,
-closing the gap #113 and #118 both named in the same audit pass: a stated rule with nothing enforcing
-it drifts the same way an unstated one does.
+27 SKILL.md files gain `metadata.version: "1.0.0"`, and a 28th — `bin/write-docs` — reaches the same
+value by relocating its top-level `version: "1.0"` into `metadata:`. `skill-author`'s `create.md`
+moves the field from "Optional frontmatter" to the required list, citing this ADR. `skill-author`'s
+own SKILL.md drops the "with `metadata.version` present" conditional in its bump-rule line, since
+presence is no longer in question. `.pre-commit-config.yaml`'s `skill-frontmatter` hook is extended
+to require the field, closing the gap #113 and #118 both named in the same audit pass: a stated rule
+with nothing enforcing it drifts the same way an unstated one does.
--- a/docs/adr/0023-rtk-prefix-marks-executable-commands-only.md
+++ b/docs/adr/0023-rtk-prefix-marks-executable-commands-only.md
@@ -0,0 +1,168 @@
+# The `rtk` prefix marks executable commands only, and is repo-wide
+
+**Status: accepted (2026-09-08).**
+
+## Context
+
+`CLAUDE.md` states the org convention as a golden rule: "Always prefix commands with `rtk`. If RTK
+has a dedicated filter, it uses it. If not, it passes through unchanged. This means RTK is always
+safe to use." Issue #113 observed that the rule had never been written down for skill *prose*, where
+a `git <subcommand>` mention can be either an instruction to execute or a reference to the concept,
+and that the corpus had drifted into carrying both spellings with no stated rule. PR #130 swept the
+`git` plugin and recorded a two-way split in `plugins/git/README.md`.
+
+Review found two defects in that sweep, and both are in the premise rather than the execution.
+
+**RTK is not output-transparent.** `rtk git --help` enumerates twelve filtered subcommands — `diff`,
+`log`, `status`, `show`, `add`, `commit`, `push`, `pull`, `branch`, `fetch`, `stash`, `worktree`.
+Everything else is a true passthrough. Inside that set the filter is not a formatting preference; it
+changes what the command *reports*. Measured against rtk 0.42.4:
+
+| Command | What rtk does to it |
+|---|---|
+| `worktree list --porcelain -z` | discards both flags; no NUL separators, no `locked`/`lock_reason` field at all |
+| `worktree list -v` | abbreviates `/root/…` to `~/…`, collapses column alignment |
+| `branch --list <name>` | emits a phantom `* ` line even on no match |
+| `diff --name-only` / `--name-status` | appends a blank line and a `Changes:` trailer |
+| `diff --word-diff[=color\|=porcelain]` | emits no `[-removed-] {+added+}` markers; substitutes a diffstat |
+| `log -L` | truncates each diff body line at ~72 characters with an ellipsis |
+| `stash pop` (on conflict) | prints only `FAILED: git stash pop`, swallowing `CONFLICT`, `Unmerged paths` and the retained-entry notice |
+| `stash list` (empty) | prints `No stashes` where git prints nothing |
+
+Every one of those falsified a skill that was written against the bare output. `git-worktrees`'s
+Step 2 required `locked` and `lock_reason` from a command whose rtk rendering has never carried
+them; `git-log-format.md` documented `[-removed-] {+added+}` markers beside a command that no longer
+produces them. The two-way split could not see any of this, because both halves of it are about what
+a *sentence* is doing and none of it is about what the *command* does.
+
+**The rule is not `git`-plugin-scoped.** `plugins/git/README.md` claimed the `gitea-*` skills
+"contain no `git`/`rtk` mentions at all". Five `gitea-*` SKILL.md files run `git remote get-url
+origin` in a fenced ```bash Step block — the README's own canonical example of "executable,
+instructed" — plus `git branch --show-current` in a reference file and three `git remote -v` in
+`gitea-orchestrate.agent.md`. A convention stated inside one plugin's README is invisible from the
+plugin next door, which is how those eight sites stayed bare through the sweep that existed to find
+them.
+
+## Decision
+
+**One rule, three clauses, repo-wide** — every `plugins/*/.apm/skills/**` and
+`plugins/*/.apm/agents/**` file, not the `git` plugin alone.
+
+1. **Executable and instructed → `rtk git`.** Anything telling the agent to run a command now: an
+   imperative step, a dispatch-table "Run" cell, a fenced code-block procedure.
+   `rtk git push -u origin <branch>`.
+2. **Illustrative or referential → bare `git`.** Naming a flag's behaviour, quoting a doc's own
+   heading, describing a command in the abstract, warning against an anti-pattern. "`git switch`
+   refuses rather than clobbering conflicting local edits."
+3. **Machine-parsed or interactive → bare `git`, and say why inline.** A command whose output the
+   skill parses, where rtk is in the filtered set above; or a command that hands control to an
+   interactive child process.
+
+Clause 3 is the new one and it looks arbitrary without the table in Context, which is why the
+measurements are recorded here rather than left in a PR thread. It is applied per subcommand and per
+flag, not per skill: `tag --list` stays prefixed because rtk passes it through byte-identically,
+while `branch --list` two words away goes bare because it does not. `git remote get-url origin`,
+`git remote -v`, `git branch --show-current`, `git log --oneline -1` and `git add -u` were all
+re-measured as byte-identical passthroughs and are therefore prefixed, parsing notwithstanding.
+
+Two consequences of that per-subcommand basis are worth stating, because both are load-bearing and
+neither is comfortable:
+
+- **rtk's filtered set is a moving target.** `git rebase` and `git mergetool` are passthroughs on
+  0.42.4 — verified under `script(1)`, both inherit a real TTY, contradicting an earlier report that
+  they did not. They stay bare anyway, on the interactive limb: a token filter has nothing to offer a
+  command that hands control to an editor, and the prefix would only buy exposure to whatever a later
+  rtk version decides to do with those subcommands. The same reasoning makes the *inner* call in
+  `` `rtk git remote add origin-push $(git config remote.origin.url)` `` bare while the outer stays
+  prefixed — `config` passes through cleanly today, but its stdout becomes a remote URL that is then
+  force-pushed to, and that is not a blast radius to lend to a future filter change.
+- **`branch --show-current` sits on the sharp edge.** It is in the filtered set, it is parsed, and it
+  is prefixed — on a measurement, in a subcommand whose sibling `--list` is exactly the defect clause
+  3 exists for. If rtk's `branch` filter is ever extended, that is the first site to break. It is
+  called out rather than hedged, because a rule whose exceptions are unrecorded is the state this ADR
+  is replacing.
+
+**A clause-3 site says so inline, in a few words.** "bare, not `rtk`: rtk prints a phantom `* ` line
+even on no match". Without it the next sweep re-prefixes the command, which is how #113 recurs.
+
+**The rule lives here, and `docs/spec/gates.md` carries the gate.** `plugins/git/README.md` is
+reduced to a pointer. It had also cited `git-workflow/references/hard-rules.md` as a place the rule
+was written down; that file contains no occurrence of "rtk", and the citation is removed rather than
+repaired.
+
+**Clause 1 is enforced by a `check-rtk-prefix` pre-commit hook; clauses 2 and 3 are not enforceable
+and are not gated.** The hook checks the two places a `git` mention is unambiguously an instruction —
+a line in a shell-tagged code fence, and the opening backticked span of a "Run" column cell — and a
+deliberately-bare command opts out with the literal string `ADR-0023` on its own line. Its coverage
+limits are recorded in `docs/spec/gates.md`, not smoothed over.
+
+## Considered options
+
+**Add `compatibility:` frontmatter to every skill.** These six plugins are installable by third
+parties, and a consumer who installs `git` from the marketplace has no `rtk` on their PATH. Every
+prefixed command in the corpus is a plain `git` invocation with a word in front of it, so the prefix
+is *droppable*: delete `rtk ` and the command is correct. A `compatibility:` line per skill would
+state that in a machine-readable field. Rejected on cost. It is 39 lines of frontmatter restating one
+sentence, it is preloaded into every agent's context every session under ADR-0020's budget — the
+field is not free the way a line in a doc is — and it has no consumer: nothing reads
+`compatibility:`, so the field would be a comment with a colon in it. The consumer situation is
+documented here and in `plugins/git/README.md` instead, which is where a human installing a plugin
+actually looks. The same two-line note is owed to the other five plugin READMEs and is not yet
+written.
+
+**Move rtk to the execution layer entirely.** Skills instruct bare `git` throughout; `CLAUDE.md`'s
+session rule handles prefixing at the point of execution. This is the strongest rejected option and
+it deserves the space: it closes the consumer gap and all eight output defects at once, because the
+executing agent knows what it is about to parse and the skill does not have to predict it. It also
+removes clause 3 entirely — there is nothing to except. Rejected because the prefix is lost wherever
+an agent copies a command literally, which is the common case for a fenced procedure block and the
+whole reason dispatch tables exist. The org convention's value is that the prefix is *already there*
+in the text the agent lifts; a rule that relies on the agent remembering to add it is the rule that
+produced the drift in the first place. Worth revisiting if rtk ever ships a shell shim, which would
+make the execution layer transparent and this trade different.
+
+**Keep the two-way split and fix the eight sites by hand.** Rejected: the split has no vocabulary for
+"this command is executable, instructed, and must still be bare", so the eight sites would be
+unexplained exceptions and the next sweep re-prefixes them. That is the failure this ADR exists to
+stop, not a smaller version of it.
+
+**Gate clauses 2 and 3 as well.** Rejected as undecidable. "Run `git switch <branch>`" and "`git
+switch` refuses rather than clobbering local edits" are the same token sequence; separating them is a
+judgement about what a sentence is doing. A gate that guessed would fire on correct content, and a
+gate that fires on correct content gets added to `SKIP`, which disarms clause 1 along with it.
+
+## The boundary the rule does not decide
+
+Two shapes in the corpus resisted the two-way split. The three-clause rule resolves one and does not
+resolve the other; both are recorded so an author meeting a third one knows which kind it is.
+
+**`git-worktrees/SKILL.md`'s tracking row carries both spellings in one Run cell** — `rtk git
+worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add
+<path> <branch>` expands to exactly this. **Resolved: the clauses apply per mention, not per row,
+per cell or per file.** The first is the instruction (clause 1), the second names what the first
+expands to (clause 2), and one table cell can hold one of each. The rule needed no change; the
+*gate* did, and it checks only a Run cell's opening span for exactly this reason.
+
+**`git-submodules/references/setup-and-update.md:80` has a git command inside a quoted argument to
+another command** — `rtk git submodule foreach 'git pull origin main || :'`. **Not resolved: all
+three clauses describe a command the reading agent executes, and the inner `git pull` is not one.**
+It is the literal text of an argument that `git submodule foreach` hands to a subshell running inside
+each submodule's own working tree, where the local convention does not reach. The file already gets
+this right and already justifies it in prose two lines below ("the git calls in it are the
+submodule's own — that is the one place a bare `git` is correct"). **An author meeting this shape
+should do the same: leave the inner command bare and justify it inline.** It is deliberately not
+promoted to a fourth clause on one instance. The gate does not decide it either — it happens to pass
+this line, because the segment containing the inner command begins with `rtk`, and that is an
+accident of the split rather than an understanding of quoting.
+
+## Consequences
+
+Eleven sites in `plugins/git/.apm/skills/**` revert to bare `git` under clause 3, each carrying a
+short inline reason. Eight sites across `plugins/gitea/.apm/skills/**` and
+`plugins/gitea/.apm/agents/gitea-orchestrate.agent.md` gain the prefix under clause 1, and one in
+`pc-run/SKILL.md` that the #130 sweep's grep missed because the backtick opens with `SKIP=` rather
+than `git `. `plugins/git/README.md`'s Conventions section becomes a pointer here, minus a paragraph
+that was false about the `gitea-*` skills and a citation to a file that does not carry the rule.
+A `check-rtk-prefix` pre-commit hook and `tests/test-check-rtk-prefix.sh` land with it; the test runs
+the gate against the pre-sweep corpus on `main` and asserts it fails there, because a gate that only
+passes on the fixed tree proves nothing about the drift it was written for.
--- a/docs/notes/factory-integration-decisions.md
+++ b/docs/notes/factory-integration-decisions.md
@@ -53,8 +53,7 @@ All skills — new and rebuilt — must follow this standard:
 - `name:` — matches directory name
 - `description:` — trigger-tested before writing the body (explicit, implicit, negative cases)
 - `metadata: category:` — from the category table above
-
-`version:`, `updated:`, `when:`, `source:`, and `references:` are provenance/audit fields — they live in `META.md` alongside the SKILL.md (not in frontmatter). See `META-TEMPLATE.md` in `.agents/skills/write-skill/` for the META.md schema.
+- `metadata: version:` — mandatory for every skill (ADR-0022)

 **Body required sections:**
 - Constraints (highest-ROI element — prevents overengineering)
--- a/docs/notes/skill-implementation-workflow.md
+++ b/docs/notes/skill-implementation-workflow.md
@@ -103,21 +103,21 @@ Do not write the SKILL.md until the human has confirmed every section. The synth
 **c. SKILL.md** (sub-agent)
 Once all sections are confirmed, spawn a write agent to produce the SKILL.md using `write-skill` (or hand-write for bootstrap skills). The agent receives: trigger description, per-section decisions from step b, upstream content to incorporate, authoring standard (see below).

-**c. META.md — `source:` and `references:` fields**
-Populate `META.md` after upstream review. Two distinct fields:
- `source:` — upstream provenance tracking (repo slug, commit SHA, files adopted with inline comments, updated date). Present only if content was adopted. Absence = self-authored.
- `references:` — general citations (research papers, documentation, standard specifications). Present only if the skill cites external research.
+**d. Provenance — source and reference records**
+Record provenance after upstream review. Two distinct kinds:
+- Upstream provenance (repo slug, commit SHA, files adopted with inline comments, updated date). Present only if content was adopted. Absence = self-authored.
+- General citations (research papers, documentation, standard specifications). Present only if the skill cites external research.

-Both fields live in `META.md` alongside the SKILL.md — not in frontmatter. See `META-TEMPLATE.md` in `.agents/skills/write-skill/` for the full schema.
+Both are recorded in the skill's own `references/sources.md`, keyed by the `source_keys:` its SKILL.md and reference files declare. `validate-provenance.sh` checks that chain.

-**d. eval.yaml** (sub-agent)
+**e. eval.yaml** (sub-agent)
 Invoke `write-eval` in two steps to preserve its confirmation gate:
 1. Sub-agent proposes test cases and returns the plan to the main conversation.
 2. Human confirms the plan; then sub-agent writes the file.

 Do not pass pre-designed test cases directly to a write agent — that collapses the plan-then-confirm gate into a single step, bypassing write-eval's own constraint. Co-located at `.agents/evals/<category>/<skill-name>/eval.yaml`. Must contain all five required test types (see Eval schema below).

-**e. HITL behavioral test**
+**f. HITL behavioral test**
 Human opens a fresh Claude session, invokes the skill with its trigger phrase, and verifies output. Do not batch more than 2–3 skills before running behavioral tests — output volume must stay within genuine human review capacity. An approval that cannot be meaningfully evaluated is not an approval.

 ### Step 6 — Session handoff
@@ -157,12 +157,11 @@ name: skill-name
 description: <trigger description — routing only; written and tested first; max 1024 chars>
 metadata:
  category: <design|factory|implement|test|review|deploy|operate|cross-cutting|iac>
+  version: <semver — mandatory for every skill; see ADR-0022>
 # allowed-tools: <add only when the skill has a narrow, well-defined tool surface; omit otherwise>
 ---
 ```

-Frontmatter contains only these fields. `version`, `updated`, `when`, `source`, and `references` are provenance/audit fields — they are not used for routing or runtime execution. They live in `META.md` alongside the SKILL.md, loaded only when needed. See `META-TEMPLATE.md` in `.agents/skills/write-skill/` for the META.md schema.
-
 ### Body sections

 Use `.agents/skills/write-skill/SKILL-TEMPLATE.md` as the authoritative structure reference. The template defines the required sections, correct order, XML grouping, and placeholder comments for each section.
@@ -230,6 +229,6 @@ Upstream review happens per-skill during step 2, not once at chunk start.

 ## Open decisions carried forward

- **Bidirectional reference convention** — Chunk 4 (reference scanner tooling; reverse map "what files point to X?"). The `when:` field itself is resolved — it lives in `META.md` alongside every skill.
+- **Bidirectional reference convention** — Chunk 4 (reference scanner tooling; reverse map "what files point to X?").
 - **PRD/issue template scope** — refined during `write-prd` (0020) and `write-issue-spec` (0019) implementation
 - **Merging `zoom-out` into architect role** — revisit at Chunk 5 grill
--- a/docs/spec/architecture.md
+++ b/docs/spec/architecture.md
@@ -49,6 +49,13 @@ Two compilers produce the plugin roots you see in the tree:

 `.apm/` is the sole hand-edited authoring source for plugin content. An edit made in the flat mirror is discarded by the next sync and is reported as drift by the `check-plugin-content-sync` pre-push hook. Hand-authored material that is not an `.apm/` primitive — `README.md`, `docs/`, `bin/`, `sources.md`, `.mcp.json`, and per-plugin extras such as `plugins/git/config.example.json`, `plugins/gitea/references/` and `plugins/bin/evals/` — lives at the plugin **root** and is untouched by either compiler.

+`.mcp.json` is the one entry in that list that is still load-bearing for apm rather than merely ignored by it. MCP is a first-class apm primitive — `dependencies.mcp` sits beside `dependencies.apm` in the manifest schema, and apm tracks deployed servers in `apm.lock.yaml` under `mcp_servers`, `mcp_configs` and `mcp_config_provenance`. A plugin reaches that primitive indirectly. `apm pack` writes the string `".mcp.json"` into the generated `.github/plugin/plugin.json` as its `mcpServers` value, and on install apm resolves the plugin manifest in the order `plugin.json`, `.github/plugin/plugin.json`, `.claude-plugin/plugin.json` — so the Copilot manifest wins, the pointer is followed, and `.mcp.json` is injected into the package's `dependencies.mcp` with any `${VAR}` env references intact. Verified against the real remote: a git-sourced install of `plugins/gitea` deploys the gitea server with both env references unexpanded.
+
+Two consequences follow, and both have bitten already:
+
+- **Do not declare `dependencies.mcp` in a plugin's own `apm.yml`.** It is the schema-correct place and it breaks the build. The `apm-audit-ci` pre-push hook runs `apm audit --ci` inside every `plugins/*/`, so a declared dependency arms `lockfile-exists` there, which then demands an `apm.lock.yaml` in the package plus every file of that package's own deployed tree present inside the package directory. Measured on `plugins/gitea`: 93 missing deployed files and 79 drifted paths.
+- **`.claude-plugin/plugin.json` carries an env-stripped copy.** `apm pack` inlines `.mcp.json` there, and its sanitiser drops `env` and `headers` blocks unconditionally at any depth, `${VAR}` indirection included. That copy is inert under apm, which never reaches it, but a native Claude Code plugin install reads exactly that file and would launch the server with no credentials. Anything installed natively rather than through apm needs its MCP env supplied by the host.
+
 That immunity is positional, not by filename. Anything placed *inside* a mirrored directory is destroyed regardless of what it is: `sync_dir` runs `rm -rf "$dst"` before every copy, and `sync_hooks_json` does the same to `hooks/`. A hand-written `README.md` under `plugins/<name>/hooks/` or `plugins/<name>/skills/` is deleted by the next sync with no drift report, because a file with no `.apm/` counterpart is simply absent from the regenerated tree. This has already cost the repo one document — `plugins/kyberforge/hooks/README.md`, since restored to `plugins/kyberforge/docs/hooks.md`. Plugin-root documentation belongs in `docs/`.

 ## Governance layer
--- a/docs/spec/gates.md
+++ b/docs/spec/gates.md
@@ -128,12 +128,43 @@ not an authoring change.
 ### `skill-frontmatter`, the other hook on that scope

 A second `repo: local` pre-commit hook, `skill-frontmatter`, runs on the **same** `files:` pattern at
-the same stage. It is a short shell loop: for each file, `grep -q "^name:"` and
-`grep -q "^description:"`, failing with "missing required frontmatter fields" if either is absent.
+the same stage. It is a shell loop that, **for the YAML frontmatter block only** — everything between
+the opening `---` and the next `---` — asserts four things per file:

-**It overlaps ADR-0020's "description present and non-empty" FAIL, and the overlap is not clean.**
-The ADR (`:95-101`) requires that question be decided on the **YAML-folded value** and nowhere else,
-precisely because a line regex gets it wrong in both directions. Measured on fixtures:
+| Check | Rejects with |
+|---|---|
+| a `^name:` line is present | "missing required frontmatter fields (name: …)" |
+| a `^description:` line is present | "missing required frontmatter fields (description: …)" |
+| `metadata:` contains a `^  version:` key, anchored, scanning to the next top-level key | "missing required frontmatter fields (metadata.version)" |
+| that version's value is three-part semver (`1.0.0`, quoted or not) | "has a malformed frontmatter metadata.version (…)" |
+
+Every one of those qualifiers is load-bearing, and each replaced a defect that let the hook report
+Passed having measured nothing. `tests/test-skill-frontmatter.sh` pins all of them:
+
+- **Frontmatter-scoped, not whole-file.** The checks used to `grep` the entire file, so a `metadata:`
+  or `name:` block quoted in a **body code fence** satisfied them — `skill-author`'s own docs quote
+  exactly such a block.
+- **Bounded by the next top-level key, not by `-A10`.** The version check was
+  `grep -A10 "^metadata:" | grep -q "  version:"`, which ran ten lines past the end of the block: a
+  `version:` belonging to a following `source:` list entry counted (`write-docs` and `research` both
+  have a `source:` list immediately after `metadata:`), while a `metadata:` block with more than ten
+  lines before its `version:` was reported missing.
+- **`^  version:` anchored.** `"  version:"` was an unanchored substring, so a deeper-nested
+  `    version:` matched too.
+- **The value is asserted, not just the key.** `plugins/bin/.apm/skills/write-docs/SKILL.md` carried
+  `version: "1.0"` — present, correctly nested, and not a version — through an entire PR under a
+  presence-only check. Two-part `1.0` is a YAML float, not a version string.
+- **The call shape is pinned.** `entry: bash` with `args: ['-c', <script>, …]` needs an explicit
+  arg0 placeholder after the script: without it `bash -c` puts pre-commit's **first** filename in
+  `$0`, where `for f in "$@"` never sees it. A single-file commit — the normal case — therefore ran
+  the loop body zero times and exited 0. The third `args` entry (`skill-frontmatter`) exists solely
+  to absorb `$0`; do not remove it.
+- **An unreadable file is an error, not a pass.** A file with no closing `---` fails with "no closing
+  YAML frontmatter block" rather than falling through to a green.
+
+**It still overlaps ADR-0020's "description present and non-empty" FAIL, and the overlap is not
+clean.** The ADR (`:95-101`) requires that question be decided on the **YAML-folded value** and
+nowhere else, precisely because a line regex gets it wrong in both directions. Measured on fixtures:

 | Frontmatter | `skill-frontmatter` | `skill-size-check` |
 |---|---|---|
@@ -145,10 +176,34 @@ against, and it is the only one of the two that objects to a quoted key. Neither
 currently live in the corpus, and the honest reading is that presence is `skill-size-check`'s
 question — the grep's contribution to it is noise on one shape and silence on the other.

-What the grep does add is the `name:` key, which **no** ADR-0020 check reads: a `SKILL.md` with no
-`name:` passes `skill-size-check` at exit 0. That is its real and only unique coverage, and the
+What the hook adds that **no** ADR-0020 check reads is two keys: `name:` and `metadata.version`. A
+`SKILL.md` missing either passes `skill-size-check` at exit 0. That is its unique coverage, and the
 reason not to fold it into the size gate on the grounds of redundancy.

+#### Why this one stays a shell parser
+
+[`python3` and PyYAML are hard requirements](#python3-and-pyyaml-are-hard-requirements) below records
+that a hand-rolled frontmatter reader on this exact `files:` scope was **deliberately deleted**,
+because "a reader that mis-parses an unfamiliar scalar shape reports a clean pass on a file it never
+measured." That reasoning is about `skill-size-check` and does **not** transfer here. Do not delete
+this hook citing it. Three differences:
+
+1. **It answers a strictly narrower question.** `skill-size-check` must know the *folded value* of a
+   `>`-block scalar to count its characters, which is where a line reader diverges from a parser —
+   one corpus description measured 270 characters parsed and 412 unparsed. This hook asks only
+   whether a key is on a line and whether one short **plain scalar** matches `N.N.N`. There is no
+   folding, no multi-line value, and no measurement to get subtly wrong.
+2. **It is frontmatter-scoped.** The failure mode that killed the old fallback was silently reading
+   past or short of the block. This one extracts the block explicitly and errors out when it cannot
+   find a closing marker, so "could not parse" is a red, never a green.
+3. **It is pinned by tests.** `tests/test-skill-frontmatter.sh` drives the hook through pre-commit's
+   real `bash -c <script> <arg0> <files…>` invocation and asserts each defect class above. The
+   deleted fallback had no such suite; that is how its disagreement with a real parser survived.
+
+The trade it buys is that the hook stays repo-local. Moving it to a script would change the
+externally exposed `.pre-commit-hooks.yaml` contract for consumers, for a check that has no need of a
+YAML parser.
+
 ### Two independent gate families, neither replaced the other

 **Family 1 — agentskills.io spec backstop** (unchanged, conformance not quality):
@@ -413,6 +468,15 @@ reader that mis-parses an unfamiliar scalar shape reports a clean pass on a file
 which is the exact vacuous-green failure the `python3` check exists to avoid. `pip install pyyaml`
 (or `python3 -m pip install PyYAML`, or the distro's `python3-yaml`) if the hook reports it missing.

+**Neither requirement generalises to every hook on this scope, and one deliberate exception sits
+right next to it.** [`skill-frontmatter`](#skill-frontmatter-the-other-hook-on-that-scope) runs on the
+same `files:` pattern as a **shell** parser, on purpose — it asks only whether a key is on a line and
+whether one short plain scalar matches `N.N.N`, with no folding to get wrong, and moving it to a
+script would change the externally exposed `.pre-commit-hooks.yaml` contract for consumers. That
+section carries the full argument. A reader arriving here first should not read this one as
+condemning it. `check-rtk-prefix` needs `python3` but **not** PyYAML: it reads the markdown body and
+never touches frontmatter, so it has no scalar to fold.
+
 ## Agent files take the description gates, not the body gate

 `check-apm-agents-valid` runs agent-audit's `validate.sh` over every real
@@ -497,6 +561,91 @@ pre-commit run --all-files                    # size AND Vale

 Scoping a retrofit off `skill-size-check` output alone leaves you blocked at the second gate.

+## The `rtk` prefix gate (ADR-0023)
+
+`check-rtk-prefix` is a `repo: local` pre-commit hook running `scripts/check-rtk-prefix.sh` over
+`^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$`, with `README.md` excluded. It enforces
+**ADR-0023 clause 1 and nothing else**: an executable, instructed local git command in plugin skill
+or agent content is written `rtk git`.
+
+It is wider in file scope than the ADR-0020 hooks — every markdown file under a plugin's
+`.apm/skills/` and `.apm/agents/`, not `SKILL.md` alone — because the rule it enforces is about
+commands an agent runs, and most of those live in `references/`, which the ADR-0020 gates do not
+reach ([the `references/` blind spot](#the-blind-spot-references-is-unlinted-for-two-independent-reasons)).
+
+### What it can decide, and what it declines to
+
+ADR-0023 has three clauses and only the first is a pattern:
+
+| Clause | Rule | Gated |
+|---|---|---|
+| 1 | executable + instructed → `rtk git` | yes |
+| 2 | illustrative / referential → bare `git` | no — undecidable |
+| 3 | machine-parsed or interactive → bare `git` | no — opt-out marker |
+
+Clause 2 is a judgement about what a sentence is *doing*. "Run `git switch <branch>`" and "`git
+switch` refuses rather than clobbering local edits" are the same token sequence. A gate that guessed
+would fire on correct prose, and **a gate that fires on correct content gets added to `SKIP`** —
+which disarms clause 1 along with it. So the hook looks only at the two contexts where a `git`
+mention is unambiguously an instruction to execute:
+
+- a line inside a fenced code block whose info string names a shell — `bash`, `sh`, `shell`, `zsh`,
+  `console`, `shell-session`. Fences tagged `text`, `yaml`, `json`, or tagged with nothing, are **not**
+  checked;
+- the **opening** backticked span of a "Run" column cell in a markdown dispatch table, and only the
+  opening span.
+
+That last narrowing is not fussiness. A Run cell routinely carries a command followed by prose about
+it, and the prose is clause 2. `git-worktrees/SKILL.md` has both shapes on adjacent rows — one cell
+reading `` `rtk git worktree add --track …` `` — always correct. `` `git worktree add <path>
+<branch>` `` expands to exactly this (instruction, then reference), and a `**Never** …` row whose Run
+cell is entirely explanation containing a bare `git push`. Checking every backticked span flags both;
+checking only a leading span flags neither, and still catches the ordinary
+`` | List | `git worktree list -v` | `` case the gate exists for.
+
+### The clause-3 opt-out
+
+A command that is deliberately bare — because rtk rewrites the output the skill parses, or because
+the command is interactive — is exempted by putting the literal string `ADR-0023` **on the same
+line**: in a shell comment for a code line, in the cell text for a table row.
+
+Per line, never per block. A fenced procedure routinely mixes `rtk git` steps with one deliberately
+bare command (`git-remotes/references/push.md` does exactly that), and a block-level marker would
+silently disarm every checked line around the marked one. The cost is a repeated `# bare per
+ADR-0023` in the three blocks of `git-log-format.md` where every line is deliberately bare; that
+repetition is the price of the marked line being the only line the marker speaks for.
+
+The marker is a plain substring match, so a line that mentions `ADR-0023` for an unrelated reason is
+also exempt. Accepted deliberately: the marker records an author's opt-out, it is not a security
+boundary, and a stricter form would only move the same trust to a different string.
+
+### What it deliberately does not cover
+
+- **Clause 2.** Nothing checks that an illustrative mention stayed bare. A sweep that re-prefixes a
+  referential `git` passes this gate. The inline reasons ADR-0023 requires on clause-3 sites are the
+  only defence, and they are prose.
+- **Prose bullets.** Most of `branch-operations.md`, `merging.md` and `rewrite-history.md` instruct
+  in list items, not fences. Those are clause-1 sites the gate cannot see, because it cannot
+  distinguish them from clause-2 mentions in the same list.
+- **`README.md`, excluded by pattern.** A skill-directory README is consumer-facing prose no agent
+  loads, and the `git clone https://github.com/bats-core/…` lines in the seven `tests/README.md`
+  files are setup instructions for a third party who has no `rtk`. Prefixing those would be actively
+  wrong, not merely noisy — see ADR-0023's consumer section.
+- **Quoting.** The line splitter breaks on `;`, `|`, `&&`, `||`, `$(` and backticks without tracking
+  quotes, so a git command inside a quoted argument is decided by accident.
+  `rtk git submodule foreach 'git pull origin main || :'` passes because the segment holding the
+  inner command begins with `rtk` — the right answer for the wrong reason. Write
+  `foreach 'git a; git b'` and the second inner command is a false positive needing the marker.
+  ADR-0023 records this shape as one the rule itself does not decide.
+- **Non-git commands.** Only `git` is checked. `rtk` fronts `gh`, `docker`, `kubectl` and others; no
+  gate covers those, and the corpus does not currently instruct them.
+
+`tests/test-check-rtk-prefix.sh` pins all of it, including the false-positive cases. Its first case
+reconstructs the plugin corpus as it stood on `main` before the #113 sweep and asserts the gate
+fails there with at least 20 findings, one of them the `gitea-*` `git remote get-url origin` drift
+the sweep missed — a gate that only passes on the already-fixed tree proves nothing about the drift
+it was written for.
+
 ## Vale

 Install the `vale` binary — `brew install vale` (macOS), `snap install vale` (Linux),
--- a/plugins/bin/.apm/skills/grill-with-docs/README.md
+++ b/plugins/bin/.apm/skills/grill-with-docs/README.md
@@ -33,5 +33,5 @@ Describe the plan or design. Expect questions one at a time, each with a recomme
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | The interview instruction plus the domain-awareness rules: file layout discovery, the five during-session behaviours, and the three-part ADR test |
-| `CONTEXT-FORMAT.md` | Skill-root document, cited when a term is resolved: the structure of a `CONTEXT.md` and how to write a Language entry |
-| `ADR-FORMAT.md` | Skill-root document, cited when an ADR is offered: `docs/adr/` naming, sequential numbering, and the ADR template |
+| `references/context-format.md` | Cited when a term is resolved: the structure of a `CONTEXT.md` and how to write a Language entry |
+| `references/adr-format.md` | Cited when an ADR is offered: `docs/adr/` naming, sequential numbering, and the ADR template |
--- a/plugins/bin/.apm/skills/grill-with-docs/SKILL.md
+++ b/plugins/bin/.apm/skills/grill-with-docs/SKILL.md
@@ -76,7 +76,7 @@ When the user states how something works, check whether the code agrees. If you

 ### Update CONTEXT.md inline

-When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [context-format.md](references/context-format.md).

 Don't couple `CONTEXT.md` to implementation details. Only include terms that are meaningful to domain experts.

@@ -88,6 +88,6 @@ Only offer to create an ADR when all three are true:
 2. **Surprising without context** — a future reader will wonder "why did they do it this way?"
 3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons

-If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).
+If any of the three is missing, skip the ADR. Use the format in [adr-format.md](references/adr-format.md).

 </supporting-info>
--- a/plugins/bin/.apm/skills/grill-with-docs/references/adr-format.md
+++ b/plugins/bin/.apm/skills/grill-with-docs/references/adr-format.md
--- a/plugins/bin/.apm/skills/grill-with-docs/references/context-format.md
+++ b/plugins/bin/.apm/skills/grill-with-docs/references/context-format.md
--- a/plugins/bin/.apm/skills/improve-codebase-architecture/README.md
+++ b/plugins/bin/.apm/skills/improve-codebase-architecture/README.md
@@ -10,7 +10,7 @@ Looks for places where a codebase is hard to understand, hard to test, or hard f
 2. **Present candidates.** A numbered list, each with files, problem, solution and benefits — benefits stated in terms of *locality* and *leverage* and of how tests would improve. No interfaces are proposed yet; the user picks one.
 3. **Grilling loop.** Walks the design tree for the chosen candidate, with documentation side effects landing inline as decisions crystallise.

-The skill is opinionated about vocabulary, and that is the point: **module, interface, implementation, depth, seam, adapter, leverage, locality**, used exactly, with no drift into "component", "service", "API" or "boundary". Domain nouns come from `CONTEXT.md`, architecture nouns from `LANGUAGE.md` — so a proposal reads as "the Order intake module", never "the FooBarHandler".
+The skill is opinionated about vocabulary, and that is the point: **module, interface, implementation, depth, seam, adapter, leverage, locality**, used exactly, with no drift into "component", "service", "API" or "boundary". Domain nouns come from `CONTEXT.md`, architecture nouns from `references/language.md` — so a proposal reads as "the Order intake module", never "the FooBarHandler".

 ADRs are treated as decisions not to be re-litigated. A candidate that contradicts one is surfaced only when the friction is real enough to warrant reopening it, and is marked as such.

@@ -31,6 +31,6 @@ Point at a codebase or an area of one. Expect a numbered candidate list and a "w
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Condensed glossary, key principles, and the three-stage process |
-| `LANGUAGE.md` | Skill-root document, cited throughout `SKILL.md`: full definitions of every term, the words each one replaces, and the full principle list |
-| `INTERFACE-DESIGN.md` | Skill-root document, read at stage 3 when the user wants alternative interfaces explored: the parallel sub-agent "Design It Twice" pattern, framing the problem space, and the per-agent design constraints |
-| `DEEPENING.md` | Skill-root document, cited from `INTERFACE-DESIGN.md`: how to deepen a cluster of shallow modules safely, the four dependency categories (in-process, local-substitutable, remote-but-owned, true external), seam discipline, and the replace-don't-layer testing strategy |
+| `references/language.md` | Cited throughout `SKILL.md`: full definitions of every term, the words each one replaces, and the full principle list |
+| `references/interface-design.md` | Read at stage 3 when the user wants alternative interfaces explored: the parallel sub-agent "Design It Twice" pattern, framing the problem space, and the per-agent design constraints |
+| `references/deepening.md` | Cited from `references/interface-design.md`: how to deepen a cluster of shallow modules safely, the four dependency categories (in-process, local-substitutable, remote-but-owned, true external), seam discipline, and the replace-don't-layer testing strategy |
--- a/plugins/bin/.apm/skills/improve-codebase-architecture/SKILL.md
+++ b/plugins/bin/.apm/skills/improve-codebase-architecture/SKILL.md
@@ -33,7 +33,7 @@ Key principles:
 - **The interface is the test surface.**
 - **One adapter = hypothetical seam. Two adapters = real seam.**

-If a term or principle above is ambiguous in the case in front of you, or you need the definitions and the principles the two lists leave out, read `LANGUAGE.md`.
+If a term or principle above is ambiguous in the case in front of you, or you need the definitions and the principles the two lists leave out, read `references/language.md`.

 This skill is _informed_ by the project's domain model. The domain language gives names to good seams; ADRs record decisions the skill should not re-litigate.

@@ -74,7 +74,7 @@ Once the user picks a candidate, drop into a grilling conversation. Walk the des

 Side effects happen inline as decisions crystallize:

- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `grill-with-docs`, in the format `grill-with-docs`'s `CONTEXT-FORMAT.md` defines. Create the file lazily if it doesn't exist.
+- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `grill-with-docs`, in the format `grill-with-docs`'s `references/context-format.md` defines. Create the file lazily if it doesn't exist.
 - **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See `grill-with-docs`'s `ADR-FORMAT.md`.
- **Want to explore alternative interfaces for the deepened module?** Read `INTERFACE-DESIGN.md`.
+- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See `grill-with-docs`'s `references/adr-format.md`.
+- **Want to explore alternative interfaces for the deepened module?** Read `references/interface-design.md`.
--- a/plugins/bin/.apm/skills/improve-codebase-architecture/references/deepening.md
+++ b/plugins/bin/.apm/skills/improve-codebase-architecture/references/deepening.md
@@ -1,6 +1,6 @@
 # Deepening

-How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**.
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [language.md](language.md) — **module**, **interface**, **seam**, **adapter**.

 ## Dependency categories

--- a/plugins/bin/.apm/skills/improve-codebase-architecture/references/interface-design.md
+++ b/plugins/bin/.apm/skills/improve-codebase-architecture/references/interface-design.md
@@ -2,7 +2,7 @@

 When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.

-Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
+Uses the vocabulary in [language.md](language.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.

 ## Process

@@ -11,7 +11,7 @@ Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**,
 Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:

 - The constraints any new interface would need to satisfy
- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- The dependencies it would rely on, and which category they fall into (see [deepening.md](deepening.md))
 - A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete

 Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
@@ -20,21 +20,21 @@ Show this to the user, then immediately proceed to Step 2. The user reads and th

 Spawn 3+ sub-agents in parallel using the Agent tool. Each must produce a **radically different** interface for the deepened module.

-Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
+Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [deepening.md](deepening.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:

 - Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
 - Agent 2: "Maximise flexibility — support many use cases and extension."
 - Agent 3: "Optimise for the most common caller — make the default case trivial."
 - Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."

-Include both [LANGUAGE.md](LANGUAGE.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
+Include both [language.md](language.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.

 Each sub-agent outputs:

 1. Interface (types, methods, params — plus invariants, ordering, error modes)
 2. Usage example showing how callers use it
 3. What the implementation hides behind the seam
-4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+4. Dependency strategy and adapters (see [deepening.md](deepening.md))
 5. Trade-offs — where leverage is high, where it's thin

 ### 3. Present and compare
--- a/plugins/bin/.apm/skills/improve-codebase-architecture/references/language.md
+++ b/plugins/bin/.apm/skills/improve-codebase-architecture/references/language.md
--- a/plugins/bin/.apm/skills/tdd/README.md
+++ b/plugins/bin/.apm/skills/tdd/README.md
@@ -25,8 +25,8 @@ Describe the feature or bug. Expect the skill to ask what the public interface s
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Philosophy, the horizontal-slicing anti-pattern, the four-stage workflow, and the per-cycle checklist |
-| `tests.md` | Skill-root document, cited from Philosophy: worked good and bad test examples |
-| `mocking.md` | Skill-root document, cited from Philosophy: mock at system boundaries only, and what not to mock |
-| `deep-modules.md` | Skill-root document, cited from stage 1: what a deep module is (small interface, large implementation) and why it is the design to aim for |
-| `interface-design.md` | Skill-root document, cited from stage 1: designing interfaces for testability, starting with accepting dependencies rather than creating them |
-| `refactoring.md` | Skill-root document, cited from stage 4: the refactor-candidate checklist — duplication, long methods, shallow modules, feature envy, primitive obsession |
+| `references/tests.md` | Cited from Philosophy: worked good and bad test examples |
+| `references/mocking.md` | Cited from Philosophy: mock at system boundaries only, and what not to mock |
+| `references/deep-modules.md` | Cited from stage 1: what a deep module is (small interface, large implementation) and why it is the design to aim for |
+| `references/interface-design.md` | Cited from stage 1: designing interfaces for testability, starting with accepting dependencies rather than creating them |
+| `references/refactoring.md` | Cited from stage 4: the refactor-candidate checklist — duplication, long methods, shallow modules, feature envy, primitive obsession |
--- a/plugins/bin/.apm/skills/tdd/SKILL.md
+++ b/plugins/bin/.apm/skills/tdd/SKILL.md
@@ -18,7 +18,7 @@ metadata:

 **Bad tests** are coupled to implementation. They mock internal collaborators, test private methods, or verify through external means (like querying a database directly instead of using the interface). The warning sign: your test breaks when you refactor, but behavior hasn't changed. If you rename an internal function and tests fail, those tests were testing implementation, not behavior.

-If you need worked examples of the difference — a behaviour-level test beside the implementation-coupled version of the same check — read `tests.md`. If a test needs a collaborator faked, read `mocking.md` before reaching for a mock.
+If you need worked examples of the difference — a behaviour-level test beside the implementation-coupled version of the same check — read `references/tests.md`. If a test needs a collaborator faked, read `references/mocking.md` before reaching for a mock.

 ## Anti-Pattern: Horizontal Slices

@@ -55,8 +55,8 @@ Before writing any code:

 - [ ] Confirm with user what interface changes are needed
 - [ ] Confirm with user which behaviors to test (prioritize)
- [ ] Identify opportunities for [deep modules](deep-modules.md) (small interface, deep implementation)
- [ ] Design interfaces for [testability](interface-design.md)
+- [ ] Identify opportunities for [deep modules](references/deep-modules.md) (small interface, deep implementation)
+- [ ] Design interfaces for [testability](references/interface-design.md)
 - [ ] List the behaviors to test (not implementation steps)
 - [ ] Get user approval on the plan

@@ -93,7 +93,7 @@ Rules:

 ### 4. Refactor

-After all tests pass, look for [refactor candidates](refactoring.md):
+After all tests pass, look for [refactor candidates](references/refactoring.md):

 - [ ] Extract duplication
 - [ ] Deepen modules (move complexity behind simple interfaces)
--- a/plugins/bin/.apm/skills/tdd/references/deep-modules.md
+++ b/plugins/bin/.apm/skills/tdd/references/deep-modules.md
--- a/plugins/bin/.apm/skills/tdd/references/interface-design.md
+++ b/plugins/bin/.apm/skills/tdd/references/interface-design.md
--- a/plugins/bin/.apm/skills/tdd/references/mocking.md
+++ b/plugins/bin/.apm/skills/tdd/references/mocking.md
--- a/plugins/bin/.apm/skills/tdd/references/refactoring.md
+++ b/plugins/bin/.apm/skills/tdd/references/refactoring.md
--- a/plugins/bin/.apm/skills/tdd/references/tests.md
+++ b/plugins/bin/.apm/skills/tdd/references/tests.md
--- a/plugins/bin/.apm/skills/triage/README.md
+++ b/plugins/bin/.apm/skills/triage/README.md
@@ -31,5 +31,5 @@ Then describe what you want in natural language — "show me anything that needs
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | The roles and state machine, the three invocation modes, the needs-info template, and how to resume a prior session |
-| `AGENT-BRIEF.md` | Skill-root document, cited when an issue moves to `ready-for-agent` (and reused for `ready-for-human`): how to write a brief that stays durable for weeks while the codebase moves under it — describe interfaces and behavioural contracts, not line numbers |
-| `OUT-OF-SCOPE.md` | Skill-root document, cited when an enhancement is closed `wontfix` and when checking for prior rejections: how the `.out-of-scope/` knowledge base is laid out and what it is for — institutional memory, and deduplication against re-litigated requests |
+| `references/agent-brief.md` | Cited when an issue moves to `ready-for-agent` (and reused for `ready-for-human`): how to write a brief that stays durable for weeks while the codebase moves under it — describe interfaces and behavioural contracts, not line numbers |
+| `references/out-of-scope.md` | Cited when an enhancement is closed `wontfix` and when checking for prior rejections: how the `.out-of-scope/` knowledge base is laid out and what it is for — institutional memory, and deduplication against re-litigated requests |
--- a/plugins/bin/.apm/skills/triage/SKILL.md
+++ b/plugins/bin/.apm/skills/triage/SKILL.md
@@ -20,8 +20,8 @@ Every comment or issue posted to the issue tracker during triage **must** start

 ## Reference docs

- [AGENT-BRIEF.md](AGENT-BRIEF.md) — how to write durable agent briefs
- [OUT-OF-SCOPE.md](OUT-OF-SCOPE.md) — how the `.out-of-scope/` knowledge base works
+- [agent-brief.md](references/agent-brief.md) — how to write durable agent briefs
+- [out-of-scope.md](references/out-of-scope.md) — how the `.out-of-scope/` knowledge base works

 ## Roles

@@ -74,11 +74,11 @@ Show counts and a one-line summary per issue. Let the maintainer pick.
 4. **Grill (if needed).** If the issue needs fleshing out, run a `/grill-with-docs` session.

 5. **Apply the outcome:**
-   - `ready-for-agent` — post an agent brief comment ([AGENT-BRIEF.md](AGENT-BRIEF.md)).
+   - `ready-for-agent` — post an agent brief comment ([agent-brief.md](references/agent-brief.md)).
   - `ready-for-human` — same structure as an agent brief, but note why it can't be delegated (judgment calls, external access, design decisions, manual testing).
   - `needs-info` — post triage notes (template below).
   - `wontfix` (bug) — polite explanation, then close.
-   - `wontfix` (enhancement) — write to `.out-of-scope/`, link to it from a comment, then close ([OUT-OF-SCOPE.md](OUT-OF-SCOPE.md)).
+   - `wontfix` (enhancement) — write to `.out-of-scope/`, link to it from a comment, then close ([out-of-scope.md](references/out-of-scope.md)).
   - `needs-triage` — apply the role. Optional comment if there's partial progress.

 ## Quick state override
--- a/plugins/bin/.apm/skills/triage/references/agent-brief.md
+++ b/plugins/bin/.apm/skills/triage/references/agent-brief.md
--- a/plugins/bin/.apm/skills/triage/references/out-of-scope.md
+++ b/plugins/bin/.apm/skills/triage/references/out-of-scope.md
--- a/plugins/bin/.apm/skills/write-docs/SKILL.md
+++ b/plugins/bin/.apm/skills/write-docs/SKILL.md
@@ -9,7 +9,7 @@ description: >
 updated: 2026-05-17
 when: invoked by explicit trigger ("write docs for X", "document this module", "create docs for this feature") or implicit request to produce technical documentation from code or spec
 metadata:
-  version: "1.0"
+  version: "1.0.0"
  category: implement
 source:
  - repo: anthropics/skills
--- a/plugins/bin/.claude-plugin/plugin.json
+++ b/plugins/bin/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "bin",
-  "version": "1.1.6",
+  "version": "1.1.7",
  "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
  "author": {
    "name": "Defame1297",
--- a/plugins/bin/.github/plugin/plugin.json
+++ b/plugins/bin/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "bin",
-  "version": "1.1.6",
+  "version": "1.1.7",
  "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
  "author": {
    "name": "Defame1297",
--- a/plugins/bin/apm.yml
+++ b/plugins/bin/apm.yml
@@ -1,5 +1,5 @@
 name: bin
-version: 1.1.6
+version: 1.1.7
 description: Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.
 author:
  name: Defame1297
--- a/plugins/bin/skills/grill-with-docs/README.md
+++ b/plugins/bin/skills/grill-with-docs/README.md
@@ -33,5 +33,5 @@ Describe the plan or design. Expect questions one at a time, each with a recomme
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | The interview instruction plus the domain-awareness rules: file layout discovery, the five during-session behaviours, and the three-part ADR test |
-| `CONTEXT-FORMAT.md` | Skill-root document, cited when a term is resolved: the structure of a `CONTEXT.md` and how to write a Language entry |
-| `ADR-FORMAT.md` | Skill-root document, cited when an ADR is offered: `docs/adr/` naming, sequential numbering, and the ADR template |
+| `references/context-format.md` | Cited when a term is resolved: the structure of a `CONTEXT.md` and how to write a Language entry |
+| `references/adr-format.md` | Cited when an ADR is offered: `docs/adr/` naming, sequential numbering, and the ADR template |
--- a/plugins/bin/skills/grill-with-docs/SKILL.md
+++ b/plugins/bin/skills/grill-with-docs/SKILL.md
@@ -76,7 +76,7 @@ When the user states how something works, check whether the code agrees. If you

 ### Update CONTEXT.md inline

-When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [context-format.md](references/context-format.md).

 Don't couple `CONTEXT.md` to implementation details. Only include terms that are meaningful to domain experts.

@@ -88,6 +88,6 @@ Only offer to create an ADR when all three are true:
 2. **Surprising without context** — a future reader will wonder "why did they do it this way?"
 3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons

-If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).
+If any of the three is missing, skip the ADR. Use the format in [adr-format.md](references/adr-format.md).

 </supporting-info>
--- a/plugins/bin/skills/grill-with-docs/references/adr-format.md
+++ b/plugins/bin/skills/grill-with-docs/references/adr-format.md
--- a/plugins/bin/skills/grill-with-docs/references/context-format.md
+++ b/plugins/bin/skills/grill-with-docs/references/context-format.md
--- a/plugins/bin/skills/improve-codebase-architecture/README.md
+++ b/plugins/bin/skills/improve-codebase-architecture/README.md
@@ -10,7 +10,7 @@ Looks for places where a codebase is hard to understand, hard to test, or hard f
 2. **Present candidates.** A numbered list, each with files, problem, solution and benefits — benefits stated in terms of *locality* and *leverage* and of how tests would improve. No interfaces are proposed yet; the user picks one.
 3. **Grilling loop.** Walks the design tree for the chosen candidate, with documentation side effects landing inline as decisions crystallise.

-The skill is opinionated about vocabulary, and that is the point: **module, interface, implementation, depth, seam, adapter, leverage, locality**, used exactly, with no drift into "component", "service", "API" or "boundary". Domain nouns come from `CONTEXT.md`, architecture nouns from `LANGUAGE.md` — so a proposal reads as "the Order intake module", never "the FooBarHandler".
+The skill is opinionated about vocabulary, and that is the point: **module, interface, implementation, depth, seam, adapter, leverage, locality**, used exactly, with no drift into "component", "service", "API" or "boundary". Domain nouns come from `CONTEXT.md`, architecture nouns from `references/language.md` — so a proposal reads as "the Order intake module", never "the FooBarHandler".

 ADRs are treated as decisions not to be re-litigated. A candidate that contradicts one is surfaced only when the friction is real enough to warrant reopening it, and is marked as such.

@@ -31,6 +31,6 @@ Point at a codebase or an area of one. Expect a numbered candidate list and a "w
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Condensed glossary, key principles, and the three-stage process |
-| `LANGUAGE.md` | Skill-root document, cited throughout `SKILL.md`: full definitions of every term, the words each one replaces, and the full principle list |
-| `INTERFACE-DESIGN.md` | Skill-root document, read at stage 3 when the user wants alternative interfaces explored: the parallel sub-agent "Design It Twice" pattern, framing the problem space, and the per-agent design constraints |
-| `DEEPENING.md` | Skill-root document, cited from `INTERFACE-DESIGN.md`: how to deepen a cluster of shallow modules safely, the four dependency categories (in-process, local-substitutable, remote-but-owned, true external), seam discipline, and the replace-don't-layer testing strategy |
+| `references/language.md` | Cited throughout `SKILL.md`: full definitions of every term, the words each one replaces, and the full principle list |
+| `references/interface-design.md` | Read at stage 3 when the user wants alternative interfaces explored: the parallel sub-agent "Design It Twice" pattern, framing the problem space, and the per-agent design constraints |
+| `references/deepening.md` | Cited from `references/interface-design.md`: how to deepen a cluster of shallow modules safely, the four dependency categories (in-process, local-substitutable, remote-but-owned, true external), seam discipline, and the replace-don't-layer testing strategy |
--- a/plugins/bin/skills/improve-codebase-architecture/SKILL.md
+++ b/plugins/bin/skills/improve-codebase-architecture/SKILL.md
@@ -33,7 +33,7 @@ Key principles:
 - **The interface is the test surface.**
 - **One adapter = hypothetical seam. Two adapters = real seam.**

-If a term or principle above is ambiguous in the case in front of you, or you need the definitions and the principles the two lists leave out, read `LANGUAGE.md`.
+If a term or principle above is ambiguous in the case in front of you, or you need the definitions and the principles the two lists leave out, read `references/language.md`.

 This skill is _informed_ by the project's domain model. The domain language gives names to good seams; ADRs record decisions the skill should not re-litigate.

@@ -74,7 +74,7 @@ Once the user picks a candidate, drop into a grilling conversation. Walk the des

 Side effects happen inline as decisions crystallize:

- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `grill-with-docs`, in the format `grill-with-docs`'s `CONTEXT-FORMAT.md` defines. Create the file lazily if it doesn't exist.
+- **Naming a deepened module after a concept not in `CONTEXT.md`?** Add the term to `CONTEXT.md` — same discipline as `grill-with-docs`, in the format `grill-with-docs`'s `references/context-format.md` defines. Create the file lazily if it doesn't exist.
 - **Sharpening a fuzzy term during the conversation?** Update `CONTEXT.md` right there.
- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See `grill-with-docs`'s `ADR-FORMAT.md`.
- **Want to explore alternative interfaces for the deepened module?** Read `INTERFACE-DESIGN.md`.
+- **User rejects the candidate with a load-bearing reason?** Offer an ADR, framed as: _"Want me to record this as an ADR so future architecture reviews don't re-suggest it?"_ Only offer when the reason would actually be needed by a future explorer to avoid re-suggesting the same thing — skip ephemeral reasons ("not worth it right now") and self-evident ones. See `grill-with-docs`'s `references/adr-format.md`.
+- **Want to explore alternative interfaces for the deepened module?** Read `references/interface-design.md`.
--- a/plugins/bin/skills/improve-codebase-architecture/references/deepening.md
+++ b/plugins/bin/skills/improve-codebase-architecture/references/deepening.md
@@ -1,6 +1,6 @@
 # Deepening

-How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**.
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [language.md](language.md) — **module**, **interface**, **seam**, **adapter**.

 ## Dependency categories

--- a/plugins/bin/skills/improve-codebase-architecture/references/interface-design.md
+++ b/plugins/bin/skills/improve-codebase-architecture/references/interface-design.md
@@ -2,7 +2,7 @@

 When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.

-Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
+Uses the vocabulary in [language.md](language.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.

 ## Process

@@ -11,7 +11,7 @@ Uses the vocabulary in [LANGUAGE.md](LANGUAGE.md) — **module**, **interface**,
 Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:

 - The constraints any new interface would need to satisfy
- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- The dependencies it would rely on, and which category they fall into (see [deepening.md](deepening.md))
 - A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete

 Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
@@ -20,21 +20,21 @@ Show this to the user, then immediately proceed to Step 2. The user reads and th

 Spawn 3+ sub-agents in parallel using the Agent tool. Each must produce a **radically different** interface for the deepened module.

-Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
+Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [deepening.md](deepening.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:

 - Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
 - Agent 2: "Maximise flexibility — support many use cases and extension."
 - Agent 3: "Optimise for the most common caller — make the default case trivial."
 - Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."

-Include both [LANGUAGE.md](LANGUAGE.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
+Include both [language.md](language.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.

 Each sub-agent outputs:

 1. Interface (types, methods, params — plus invariants, ordering, error modes)
 2. Usage example showing how callers use it
 3. What the implementation hides behind the seam
-4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+4. Dependency strategy and adapters (see [deepening.md](deepening.md))
 5. Trade-offs — where leverage is high, where it's thin

 ### 3. Present and compare
--- a/plugins/bin/skills/improve-codebase-architecture/references/language.md
+++ b/plugins/bin/skills/improve-codebase-architecture/references/language.md
--- a/plugins/bin/skills/tdd/README.md
+++ b/plugins/bin/skills/tdd/README.md
@@ -25,8 +25,8 @@ Describe the feature or bug. Expect the skill to ask what the public interface s
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Philosophy, the horizontal-slicing anti-pattern, the four-stage workflow, and the per-cycle checklist |
-| `tests.md` | Skill-root document, cited from Philosophy: worked good and bad test examples |
-| `mocking.md` | Skill-root document, cited from Philosophy: mock at system boundaries only, and what not to mock |
-| `deep-modules.md` | Skill-root document, cited from stage 1: what a deep module is (small interface, large implementation) and why it is the design to aim for |
-| `interface-design.md` | Skill-root document, cited from stage 1: designing interfaces for testability, starting with accepting dependencies rather than creating them |
-| `refactoring.md` | Skill-root document, cited from stage 4: the refactor-candidate checklist — duplication, long methods, shallow modules, feature envy, primitive obsession |
+| `references/tests.md` | Cited from Philosophy: worked good and bad test examples |
+| `references/mocking.md` | Cited from Philosophy: mock at system boundaries only, and what not to mock |
+| `references/deep-modules.md` | Cited from stage 1: what a deep module is (small interface, large implementation) and why it is the design to aim for |
+| `references/interface-design.md` | Cited from stage 1: designing interfaces for testability, starting with accepting dependencies rather than creating them |
+| `references/refactoring.md` | Cited from stage 4: the refactor-candidate checklist — duplication, long methods, shallow modules, feature envy, primitive obsession |
--- a/plugins/bin/skills/tdd/SKILL.md
+++ b/plugins/bin/skills/tdd/SKILL.md
@@ -18,7 +18,7 @@ metadata:

 **Bad tests** are coupled to implementation. They mock internal collaborators, test private methods, or verify through external means (like querying a database directly instead of using the interface). The warning sign: your test breaks when you refactor, but behavior hasn't changed. If you rename an internal function and tests fail, those tests were testing implementation, not behavior.

-If you need worked examples of the difference — a behaviour-level test beside the implementation-coupled version of the same check — read `tests.md`. If a test needs a collaborator faked, read `mocking.md` before reaching for a mock.
+If you need worked examples of the difference — a behaviour-level test beside the implementation-coupled version of the same check — read `references/tests.md`. If a test needs a collaborator faked, read `references/mocking.md` before reaching for a mock.

 ## Anti-Pattern: Horizontal Slices

@@ -55,8 +55,8 @@ Before writing any code:

 - [ ] Confirm with user what interface changes are needed
 - [ ] Confirm with user which behaviors to test (prioritize)
- [ ] Identify opportunities for [deep modules](deep-modules.md) (small interface, deep implementation)
- [ ] Design interfaces for [testability](interface-design.md)
+- [ ] Identify opportunities for [deep modules](references/deep-modules.md) (small interface, deep implementation)
+- [ ] Design interfaces for [testability](references/interface-design.md)
 - [ ] List the behaviors to test (not implementation steps)
 - [ ] Get user approval on the plan

@@ -93,7 +93,7 @@ Rules:

 ### 4. Refactor

-After all tests pass, look for [refactor candidates](refactoring.md):
+After all tests pass, look for [refactor candidates](references/refactoring.md):

 - [ ] Extract duplication
 - [ ] Deepen modules (move complexity behind simple interfaces)
--- a/plugins/bin/skills/tdd/references/deep-modules.md
+++ b/plugins/bin/skills/tdd/references/deep-modules.md
--- a/plugins/bin/skills/tdd/references/interface-design.md
+++ b/plugins/bin/skills/tdd/references/interface-design.md
--- a/plugins/bin/skills/tdd/references/mocking.md
+++ b/plugins/bin/skills/tdd/references/mocking.md
--- a/plugins/bin/skills/tdd/references/refactoring.md
+++ b/plugins/bin/skills/tdd/references/refactoring.md
--- a/plugins/bin/skills/tdd/references/tests.md
+++ b/plugins/bin/skills/tdd/references/tests.md
--- a/plugins/bin/skills/triage/README.md
+++ b/plugins/bin/skills/triage/README.md
@@ -31,5 +31,5 @@ Then describe what you want in natural language — "show me anything that needs
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | The roles and state machine, the three invocation modes, the needs-info template, and how to resume a prior session |
-| `AGENT-BRIEF.md` | Skill-root document, cited when an issue moves to `ready-for-agent` (and reused for `ready-for-human`): how to write a brief that stays durable for weeks while the codebase moves under it — describe interfaces and behavioural contracts, not line numbers |
-| `OUT-OF-SCOPE.md` | Skill-root document, cited when an enhancement is closed `wontfix` and when checking for prior rejections: how the `.out-of-scope/` knowledge base is laid out and what it is for — institutional memory, and deduplication against re-litigated requests |
+| `references/agent-brief.md` | Cited when an issue moves to `ready-for-agent` (and reused for `ready-for-human`): how to write a brief that stays durable for weeks while the codebase moves under it — describe interfaces and behavioural contracts, not line numbers |
+| `references/out-of-scope.md` | Cited when an enhancement is closed `wontfix` and when checking for prior rejections: how the `.out-of-scope/` knowledge base is laid out and what it is for — institutional memory, and deduplication against re-litigated requests |
--- a/plugins/bin/skills/triage/SKILL.md
+++ b/plugins/bin/skills/triage/SKILL.md
@@ -20,8 +20,8 @@ Every comment or issue posted to the issue tracker during triage **must** start

 ## Reference docs

- [AGENT-BRIEF.md](AGENT-BRIEF.md) — how to write durable agent briefs
- [OUT-OF-SCOPE.md](OUT-OF-SCOPE.md) — how the `.out-of-scope/` knowledge base works
+- [agent-brief.md](references/agent-brief.md) — how to write durable agent briefs
+- [out-of-scope.md](references/out-of-scope.md) — how the `.out-of-scope/` knowledge base works

 ## Roles

@@ -74,11 +74,11 @@ Show counts and a one-line summary per issue. Let the maintainer pick.
 4. **Grill (if needed).** If the issue needs fleshing out, run a `/grill-with-docs` session.

 5. **Apply the outcome:**
-   - `ready-for-agent` — post an agent brief comment ([AGENT-BRIEF.md](AGENT-BRIEF.md)).
+   - `ready-for-agent` — post an agent brief comment ([agent-brief.md](references/agent-brief.md)).
   - `ready-for-human` — same structure as an agent brief, but note why it can't be delegated (judgment calls, external access, design decisions, manual testing).
   - `needs-info` — post triage notes (template below).
   - `wontfix` (bug) — polite explanation, then close.
-   - `wontfix` (enhancement) — write to `.out-of-scope/`, link to it from a comment, then close ([OUT-OF-SCOPE.md](OUT-OF-SCOPE.md)).
+   - `wontfix` (enhancement) — write to `.out-of-scope/`, link to it from a comment, then close ([out-of-scope.md](references/out-of-scope.md)).
   - `needs-triage` — apply the role. Optional comment if there's partial progress.

 ## Quick state override
--- a/plugins/bin/skills/triage/references/agent-brief.md
+++ b/plugins/bin/skills/triage/references/agent-brief.md
--- a/plugins/bin/skills/triage/references/out-of-scope.md
+++ b/plugins/bin/skills/triage/references/out-of-scope.md
--- a/plugins/bin/skills/write-docs/SKILL.md
+++ b/plugins/bin/skills/write-docs/SKILL.md
@@ -9,7 +9,7 @@ description: >
 updated: 2026-05-17
 when: invoked by explicit trigger ("write docs for X", "document this module", "create docs for this feature") or implicit request to produce technical documentation from code or spec
 metadata:
-  version: "1.0"
+  version: "1.0.0"
  category: implement
 source:
  - repo: anthropics/skills
--- a/plugins/git/.apm/skills/git-branches/SKILL.md
+++ b/plugins/git/.apm/skills/git-branches/SKILL.md
@@ -9,7 +9,7 @@ description: >
  Not a Gitea remote's branches -> `gitea-branches`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - context7-git-htmldocs
@@ -21,7 +21,7 @@ metadata:
 ## Gotchas

 - **Uncommitted changes abort a switch.** `git switch` refuses rather than clobbering conflicting local edits. Offer to stash and retry — forcing the checkout past it is how work disappears.
- **A branch and a tag can carry the same name.** Detect it before acting — `rtk git branch --list <name>` and `rtk git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
+- **A branch and a tag can carry the same name.** Detect it before acting — `git branch --list <name>` (bare, not `rtk`: rtk prints a phantom `* ` line even on no match, which reports every name as ambiguous — ADR-0023) and `rtk git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
 - **`main` and `master` are a refusal, not a gate.** Force-pushing, force-deleting, or renaming them is rejected even when the caller passes `confirm: true` — no flag makes the remote's history recoverable. Offer a new branch instead.

 ## Step 1 — Determine the branching pattern
--- a/plugins/git/.apm/skills/git-branches/references/branch-operations.md
+++ b/plugins/git/.apm/skills/git-branches/references/branch-operations.md
@@ -43,9 +43,12 @@ past it: it shelves the working tree and index so the branch pointer can move.
 - **save** — `rtk git stash push -m "<message>"`. Add `-u` to include untracked files; verified on Git
  2.39.5, a plain `push` leaves them in place, and a plain `push` with *only* untracked changes
  reports `No local changes to save` and stashes nothing. Bare `git stash` is `push` with no message.
- **restore** — `rtk git stash pop` applies the newest entry and deletes it. `rtk git stash apply stash@{n}`
+- **restore** — `git stash pop` applies the newest entry and deletes it. Bare, not `rtk`: on a
+  conflict rtk prints only `FAILED: git stash pop` and swallows the conflict report the paragraph
+  below tells you to read (ADR-0023). `rtk git stash apply stash@{n}`
  applies without deleting, for replaying one shelf onto more than one branch.
- **list** — `rtk git stash list`; `rtk git stash show -p stash@{n}` prints that entry's diff.
+- **list** — `git stash list` — bare, not `rtk`: rtk prints `No stashes` where git prints nothing,
+  so an empty-output test misfires (ADR-0023). `rtk git stash show -p stash@{n}` prints that entry's diff.
 - **drop** — `rtk git stash drop stash@{n}` deletes one entry. `rtk git stash clear` deletes all of them
  and nothing recovers them — confirm before running it.
 - **branch from a stash** — `rtk git stash branch <branch> stash@{n}` creates a branch at the commit the
--- a/plugins/git/.apm/skills/git-branches/references/merging.md
+++ b/plugins/git/.apm/skills/git-branches/references/merging.md
@@ -26,5 +26,6 @@ list the conflicted files, edit each to resolve its markers, then `rtk git add <
 `rtk git merge --continue`.

 - `rtk git merge --abort` restores the pre-merge state.
- `rtk git mergetool` opens the configured merge tool.
+- `git mergetool` opens the configured merge tool — bare, not `rtk`: it hands control to an
+  interactive child process, and a token filter has nothing to offer there (ADR-0023).
 - `rtk git diff --diff-filter=U` shows only the still-conflicted files.
--- a/plugins/git/.apm/skills/git-commits/SKILL.md
+++ b/plugins/git/.apm/skills/git-commits/SKILL.md
@@ -8,7 +8,7 @@ description: >
  Not branch lifecycle -> `git-branches`.

 metadata:
-  version: "0.1.3"
+  version: "0.1.4"
  category: git
  source_keys:
    - conventional-commits-spec
@@ -21,7 +21,7 @@ allowed-tools: Bash

 ## Gotchas

- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too.
+- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too. Exceptions: ADR-0023 clause 3.
 - **Refuse to force-push `main`/`master`** — a rewrite leaves the branch diverged and the reflex is to force it back; safe only where nobody else has based work on it.
 - **`reset --hard` is a confirmation gate, not a default.** It overwrites the working tree, and uncommitted edits it discards were never in git, so no reflog recovers them. Name what will be lost and offer a stash first.
 - **Never add `--no-verify`** — using it when a hook fails bypasses the QA gate the pipeline depends on. Only on the user's explicit demand, with a warning.
--- a/plugins/git/.apm/skills/git-commits/references/rewrite-history.md
+++ b/plugins/git/.apm/skills/git-commits/references/rewrite-history.md
@@ -21,9 +21,9 @@ Prefer this whenever a commit is written to be folded, because git does the mark

 1. `rtk git commit --fixup=<commit>` keeps the target's message; `rtk git commit --squash=<commit>` lets you edit the combined message later. Both prefix the message with `fixup!`/`squash!` and name the target commit.
 2. Get explicit approval — the rebase still rewrites history.
-3. Run `rtk git rebase -i --autosquash HEAD~N`. Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.
+3. Run `git rebase -i --autosquash HEAD~N` — bare, not `rtk`: `-i` opens an interactive sequence editor (ADR-0023). Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.

-**`-i` is not optional here.** On Git 2.39.5, `rtk git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.
+**`-i` is not optional here.** On Git 2.39.5, `git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.

 ## Squash by hand (interactive rebase)

@@ -31,7 +31,7 @@ Use this when the commits were not tagged at commit time. **Interactive rebase h

 1. Identify the commits to squash — typically the last N on the current branch.
 2. Get explicit approval.
-3. Run `rtk git rebase -i HEAD~N`, marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
+3. Run `git rebase -i HEAD~N` — bare, not `rtk`, for the same interactive-editor reason — marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
 4. Compose the combined message when the rebase stops to ask. For a non-trivial combined message, follow the structure in `references/commit-template.md`.

 ## When a rebase halts on a conflict
--- a/plugins/git/.apm/skills/git-history/SKILL.md
+++ b/plugins/git/.apm/skills/git-history/SKILL.md
@@ -8,7 +8,7 @@ description: >
  `git-commits`. Not a Gitea server's history -> `gitea-branches`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - git-scm-bisect-docs
@@ -38,7 +38,7 @@ allowed-tools: Bash
 Default to `rtk git log --oneline`, then narrow by whatever is known:

 - **Content**: `rtk git log -S"string"`, or `-G"regex"` to match any diff line. `--pickaxe-regex` makes the `-S` argument a POSIX ERE; `--pickaxe-all` shows every file in a matching changeset.
- **A line or function**: `rtk git log -L <start>,<end>:<file>` or `rtk git log -L :<function>:<file>`. Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
+- **A line or function**: `git log -L <start>,<end>:<file>` or `git log -L :<function>:<file>` — bare, not `rtk`: rtk truncates each diff line at ~72 characters (ADR-0023). Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
 - **A file across renames**: `rtk git log --follow -- <file>`. Without `--follow` the history stops at the rename boundary.
 - **Mainline only**: `--first-parent` follows the integration branch and skips commits merged in from side branches.
 - **Structured output**: `rtk git log --format="%h | %s | %an (%ar)"`.
--- a/plugins/git/.apm/skills/git-history/references/git-log-format.md
+++ b/plugins/git/.apm/skills/git-history/references/git-log-format.md
@@ -161,11 +161,15 @@ rtk git log --diff-filter=M        # only show commits with modified files

 Traces the evolution of a specific range of lines or a named function through commits. Implies `--patch`.

+Bare `git`, not `rtk git`, on every `-L` form below: rtk truncates each diff body
+line at roughly 72 characters with an ellipsis, on the one query whose whole point
+is showing line content.
+
 ```bash
-rtk git log -L 10,20:file.txt
-rtk git log -L /start_pattern/,/end_pattern/:file.txt
-rtk git log -L :myfunction:src/app.c
-rtk git log -L /init/,+15:config.py          # 15 lines after first match of /init/
+git log -L 10,20:file.txt                          # bare per ADR-0023
+git log -L /start_pattern/,/end_pattern/:file.txt  # bare per ADR-0023
+git log -L :myfunction:src/app.c                   # bare per ADR-0023
+git log -L /init/,+15:config.py                    # bare per ADR-0023; 15 lines after first /init/ match
 ```

 Range formats:
@@ -205,20 +209,26 @@ rtk git diff --numstat                # machine-readable: <added>\t<deleted>\t<p

 ### --name-only / --name-status

+Bare `git`, not `rtk git`: rtk appends a blank line and a `Changes:` trailer, so
+the output is no longer one record per line.
+
 ```bash
-rtk git diff --name-only              # only filenames, one per line
-rtk git diff --name-status            # status letter + filename per line
+git diff --name-only      # bare per ADR-0023; only filenames, one per line
+git diff --name-status    # bare per ADR-0023; status letter + filename per line
 ```

 `--name-status` uses the same status letters as `--diff-filter`.

 ### --word-diff

+Bare `git`, not `rtk git`: rtk replaces the word-diff with its own diffstat
+renderer and emits none of the `[-removed-] {+added+}` markers.
+
 ```bash
-rtk git diff --word-diff              # inline word-level diff with [-removed-] {+added+} markers
-rtk git diff --word-diff=color        # color only, no markers
-rtk git diff --word-diff=porcelain    # machine-readable: +/- prefixed lines, ~ for newlines
-rtk git diff --word-diff-regex=<re>   # define what counts as a "word"
+git diff --word-diff             # bare per ADR-0023; inline word-level diff, [-removed-] {+added+} markers
+git diff --word-diff=color       # bare per ADR-0023; color only, no markers
+git diff --word-diff=porcelain   # bare per ADR-0023; machine-readable: +/- prefixed lines, ~ for newlines
+git diff --word-diff-regex=<re>  # bare per ADR-0023; define what counts as a "word"
 ```

 ### Whitespace Flags
--- a/plugins/git/.apm/skills/git-remotes/SKILL.md
+++ b/plugins/git/.apm/skills/git-remotes/SKILL.md
@@ -10,7 +10,7 @@ description: >
  Not submodule pointers -> `git-submodules`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - git-scm-remote-docs
--- a/plugins/git/.apm/skills/git-remotes/references/push.md
+++ b/plugins/git/.apm/skills/git-remotes/references/push.md
@@ -48,13 +48,15 @@ Two mitigations:
 # Option 1 — dedicated push-only remote: background tools fetch `origin`, you push
 # through a separate remote that nothing else touches, so its tracking ref can't be
 # poisoned by an unrelated fetch.
-rtk git remote add origin-push $(rtk git config remote.origin.url)
+# The inner `git config` is bare: its stdout becomes a remote URL, so any
+# output rewriting would poison the remote silently.
+rtk git remote add origin-push $(git config remote.origin.url)   # inner bare per ADR-0023
 rtk git push --force-with-lease origin-push

 # Option 2 — explicit SHA via a local tag, unaffected by tracking-branch state
 rtk git fetch
 rtk git tag base master
-rtk git rebase -i master
+git rebase -i master   # bare, not `rtk` (ADR-0023): interactive sequence editor
 rtk git push --force-with-lease=master:base master:master
 ```

--- a/plugins/git/.apm/skills/git-worktrees/SKILL.md
+++ b/plugins/git/.apm/skills/git-worktrees/SKILL.md
@@ -8,7 +8,7 @@ description: >
  Not interactive multi-step git guidance -> `git-workflow`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - git-scm-worktree-docs
@@ -32,7 +32,7 @@ metadata:
 | Create a local branch tracking a remote one | `rtk git worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add <path> <branch>` expands to exactly this, but **only** under the conditions in `references/worktrees.md` |
 | Throwaway experiment, no branch | `rtk git worktree add -d <path>` — detached HEAD |
 | **Never** `git worktree add <path> <remote>/<branch>` | That ref resolves, so the shortcut never fires and you get **a detached HEAD, no branch, no upstream**. Commits there go unreachable once HEAD moves, and `git push` needs an explicit refspec. Use the tracking row above |
-| List | `rtk git worktree list -v`, or `--porcelain -z` to parse |
+| List | `git worktree list -v` to read, or `git worktree list --porcelain -z` to parse — both bare per ADR-0023: rtk re-renders the output and drops the porcelain flags |
 | Lock or unlock | `rtk git worktree lock [--reason <str>] <path>` / `rtk git worktree unlock <path>` |
 | Move | `rtk git worktree move <from> <to>` |
 | Remove | `rtk git worktree remove <path>` |
@@ -62,6 +62,7 @@ worktrees:
    lock_reason: <reason or empty>
 ```

-Derive those fields from `rtk git worktree list --porcelain -z`. For a single
+Derive those fields from `git worktree list --porcelain -z` — bare, not `rtk`:
+rtk drops both flags and never emits `locked`/`lock_reason` (ADR-0023). For a single
 operation, report its outcome instead — `created: true`, `moved: true`,
 `removed: true`.
--- a/plugins/git/.apm/skills/pc-run/SKILL.md
+++ b/plugins/git/.apm/skills/pc-run/SKILL.md
@@ -8,7 +8,7 @@ description: >
 compatibility: Requires pre-commit installed and available on PATH.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: devtools
  source_keys:
    - context7-pre-commit-com
@@ -19,7 +19,7 @@ allowed-tools: Bash Read

 ## Gotchas

- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
+- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks rtk git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
 - Never bypass a failing hook with `git commit --no-verify` (or `-n`). Hooks are the automated QA gate, so a bypassed commit pushes the failure downstream where it costs more — diagnose it instead.
 - `- files were modified by this hook` is not a bug. A fixer hook rewrote a staged file, so the staged snapshot is stale and the commit is blocked on purpose. Re-stage and re-run the same commit: `rtk git add -u && rtk git commit`. Do NOT reach for `pre-commit install -f` here — it overwrites `.git/hooks/` and has nothing to do with re-staging.

--- a/plugins/git/.claude-plugin/plugin.json
+++ b/plugins/git/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "git",
-  "version": "1.3.6",
+  "version": "1.3.7",
  "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
  "author": {
    "name": "Defame1297",
--- a/plugins/git/.github/plugin/plugin.json
+++ b/plugins/git/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "git",
-  "version": "1.3.6",
+  "version": "1.3.7",
  "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
  "author": {
    "name": "Defame1297",
--- a/plugins/git/README.md
+++ b/plugins/git/README.md
@@ -30,12 +30,9 @@ copilot plugin install ./plugins/git

 ## Conventions

-Every skill in this plugin runs local git commands through the org's `rtk` wrapper, never bare `git` — see `git-commits/SKILL.md`'s Gotchas and `git-workflow/references/hard-rules.md`. Issue #113 made that rule precise for skill *prose*, where a `git <subcommand>` mention can be either an instruction to execute or just a reference to the concept:
+Skills here run local git commands through the org's `rtk` wrapper. **When a command is prefixed, when it stays bare, and why some executable commands must stay bare are all decided by ADR-0023** (`docs/adr/0023-rtk-prefix-marks-executable-commands-only.md`), which is repo-wide and not specific to this plugin. `check-rtk-prefix` enforces the part of it that is machine-decidable.

- **Executable, instructed commands** — anything telling the agent to run a command right now (an imperative step, a dispatch-table "Run" cell, a fenced code-block procedure) — use `rtk git`. Example: `rtk git push -u origin <branch>`.
- **Illustrative or referential mentions** — naming a flag's behavior, quoting a doc's own heading, describing what a command does in the abstract, or warning against an anti-pattern — stay bare `git`. Example: "`git switch` refuses rather than clobbering conflicting local edits."
-
-This applies within this plugin's own skill files (`git-*`, `pc-*`) — it does not generalize to other plugins. The `gitea-*` skills, for instance, talk to a remote Gitea server through the `gitea` MCP tools and contain no `git`/`rtk` mentions at all; the distinction has nothing to hold onto there.
+Installing this plugin without `rtk`? Every prefixed command is a plain `git` invocation with a word in front of it — drop the `rtk ` and it is correct.

 ## Contents

--- a/plugins/git/apm.yml
+++ b/plugins/git/apm.yml
@@ -1,5 +1,5 @@
 name: git
-version: 1.3.6
+version: 1.3.7
 description: Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.
 author:
  name: Defame1297
--- a/plugins/git/skills/git-branches/SKILL.md
+++ b/plugins/git/skills/git-branches/SKILL.md
@@ -9,7 +9,7 @@ description: >
  Not a Gitea remote's branches -> `gitea-branches`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - context7-git-htmldocs
@@ -21,7 +21,7 @@ metadata:
 ## Gotchas

 - **Uncommitted changes abort a switch.** `git switch` refuses rather than clobbering conflicting local edits. Offer to stash and retry — forcing the checkout past it is how work disappears.
- **A branch and a tag can carry the same name.** Detect it before acting — `rtk git branch --list <name>` and `rtk git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
+- **A branch and a tag can carry the same name.** Detect it before acting — `git branch --list <name>` (bare, not `rtk`: rtk prints a phantom `* ` line even on no match, which reports every name as ambiguous — ADR-0023) and `rtk git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
 - **`main` and `master` are a refusal, not a gate.** Force-pushing, force-deleting, or renaming them is rejected even when the caller passes `confirm: true` — no flag makes the remote's history recoverable. Offer a new branch instead.

 ## Step 1 — Determine the branching pattern
--- a/plugins/git/skills/git-branches/references/branch-operations.md
+++ b/plugins/git/skills/git-branches/references/branch-operations.md
@@ -43,9 +43,12 @@ past it: it shelves the working tree and index so the branch pointer can move.
 - **save** — `rtk git stash push -m "<message>"`. Add `-u` to include untracked files; verified on Git
  2.39.5, a plain `push` leaves them in place, and a plain `push` with *only* untracked changes
  reports `No local changes to save` and stashes nothing. Bare `git stash` is `push` with no message.
- **restore** — `rtk git stash pop` applies the newest entry and deletes it. `rtk git stash apply stash@{n}`
+- **restore** — `git stash pop` applies the newest entry and deletes it. Bare, not `rtk`: on a
+  conflict rtk prints only `FAILED: git stash pop` and swallows the conflict report the paragraph
+  below tells you to read (ADR-0023). `rtk git stash apply stash@{n}`
  applies without deleting, for replaying one shelf onto more than one branch.
- **list** — `rtk git stash list`; `rtk git stash show -p stash@{n}` prints that entry's diff.
+- **list** — `git stash list` — bare, not `rtk`: rtk prints `No stashes` where git prints nothing,
+  so an empty-output test misfires (ADR-0023). `rtk git stash show -p stash@{n}` prints that entry's diff.
 - **drop** — `rtk git stash drop stash@{n}` deletes one entry. `rtk git stash clear` deletes all of them
  and nothing recovers them — confirm before running it.
 - **branch from a stash** — `rtk git stash branch <branch> stash@{n}` creates a branch at the commit the
--- a/plugins/git/skills/git-branches/references/merging.md
+++ b/plugins/git/skills/git-branches/references/merging.md
@@ -26,5 +26,6 @@ list the conflicted files, edit each to resolve its markers, then `rtk git add <
 `rtk git merge --continue`.

 - `rtk git merge --abort` restores the pre-merge state.
- `rtk git mergetool` opens the configured merge tool.
+- `git mergetool` opens the configured merge tool — bare, not `rtk`: it hands control to an
+  interactive child process, and a token filter has nothing to offer there (ADR-0023).
 - `rtk git diff --diff-filter=U` shows only the still-conflicted files.
--- a/plugins/git/skills/git-commits/SKILL.md
+++ b/plugins/git/skills/git-commits/SKILL.md
@@ -8,7 +8,7 @@ description: >
  Not branch lifecycle -> `git-branches`.

 metadata:
-  version: "0.1.3"
+  version: "0.1.4"
  category: git
  source_keys:
    - conventional-commits-spec
@@ -21,7 +21,7 @@ allowed-tools: Bash

 ## Gotchas

- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too.
+- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too. Exceptions: ADR-0023 clause 3.
 - **Refuse to force-push `main`/`master`** — a rewrite leaves the branch diverged and the reflex is to force it back; safe only where nobody else has based work on it.
 - **`reset --hard` is a confirmation gate, not a default.** It overwrites the working tree, and uncommitted edits it discards were never in git, so no reflog recovers them. Name what will be lost and offer a stash first.
 - **Never add `--no-verify`** — using it when a hook fails bypasses the QA gate the pipeline depends on. Only on the user's explicit demand, with a warning.
--- a/plugins/git/skills/git-commits/references/rewrite-history.md
+++ b/plugins/git/skills/git-commits/references/rewrite-history.md
@@ -21,9 +21,9 @@ Prefer this whenever a commit is written to be folded, because git does the mark

 1. `rtk git commit --fixup=<commit>` keeps the target's message; `rtk git commit --squash=<commit>` lets you edit the combined message later. Both prefix the message with `fixup!`/`squash!` and name the target commit.
 2. Get explicit approval — the rebase still rewrites history.
-3. Run `rtk git rebase -i --autosquash HEAD~N`. Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.
+3. Run `git rebase -i --autosquash HEAD~N` — bare, not `rtk`: `-i` opens an interactive sequence editor (ADR-0023). Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.

-**`-i` is not optional here.** On Git 2.39.5, `rtk git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.
+**`-i` is not optional here.** On Git 2.39.5, `git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.

 ## Squash by hand (interactive rebase)

@@ -31,7 +31,7 @@ Use this when the commits were not tagged at commit time. **Interactive rebase h

 1. Identify the commits to squash — typically the last N on the current branch.
 2. Get explicit approval.
-3. Run `rtk git rebase -i HEAD~N`, marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
+3. Run `git rebase -i HEAD~N` — bare, not `rtk`, for the same interactive-editor reason — marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
 4. Compose the combined message when the rebase stops to ask. For a non-trivial combined message, follow the structure in `references/commit-template.md`.

 ## When a rebase halts on a conflict
--- a/plugins/git/skills/git-history/SKILL.md
+++ b/plugins/git/skills/git-history/SKILL.md
@@ -8,7 +8,7 @@ description: >
  `git-commits`. Not a Gitea server's history -> `gitea-branches`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - git-scm-bisect-docs
@@ -38,7 +38,7 @@ allowed-tools: Bash
 Default to `rtk git log --oneline`, then narrow by whatever is known:

 - **Content**: `rtk git log -S"string"`, or `-G"regex"` to match any diff line. `--pickaxe-regex` makes the `-S` argument a POSIX ERE; `--pickaxe-all` shows every file in a matching changeset.
- **A line or function**: `rtk git log -L <start>,<end>:<file>` or `rtk git log -L :<function>:<file>`. Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
+- **A line or function**: `git log -L <start>,<end>:<file>` or `git log -L :<function>:<file>` — bare, not `rtk`: rtk truncates each diff line at ~72 characters (ADR-0023). Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
 - **A file across renames**: `rtk git log --follow -- <file>`. Without `--follow` the history stops at the rename boundary.
 - **Mainline only**: `--first-parent` follows the integration branch and skips commits merged in from side branches.
 - **Structured output**: `rtk git log --format="%h | %s | %an (%ar)"`.
--- a/plugins/git/skills/git-history/references/git-log-format.md
+++ b/plugins/git/skills/git-history/references/git-log-format.md
@@ -161,11 +161,15 @@ rtk git log --diff-filter=M        # only show commits with modified files

 Traces the evolution of a specific range of lines or a named function through commits. Implies `--patch`.

+Bare `git`, not `rtk git`, on every `-L` form below: rtk truncates each diff body
+line at roughly 72 characters with an ellipsis, on the one query whose whole point
+is showing line content.
+
 ```bash
-rtk git log -L 10,20:file.txt
-rtk git log -L /start_pattern/,/end_pattern/:file.txt
-rtk git log -L :myfunction:src/app.c
-rtk git log -L /init/,+15:config.py          # 15 lines after first match of /init/
+git log -L 10,20:file.txt                          # bare per ADR-0023
+git log -L /start_pattern/,/end_pattern/:file.txt  # bare per ADR-0023
+git log -L :myfunction:src/app.c                   # bare per ADR-0023
+git log -L /init/,+15:config.py                    # bare per ADR-0023; 15 lines after first /init/ match
 ```

 Range formats:
@@ -205,20 +209,26 @@ rtk git diff --numstat                # machine-readable: <added>\t<deleted>\t<p

 ### --name-only / --name-status

+Bare `git`, not `rtk git`: rtk appends a blank line and a `Changes:` trailer, so
+the output is no longer one record per line.
+
 ```bash
-rtk git diff --name-only              # only filenames, one per line
-rtk git diff --name-status            # status letter + filename per line
+git diff --name-only      # bare per ADR-0023; only filenames, one per line
+git diff --name-status    # bare per ADR-0023; status letter + filename per line
 ```

 `--name-status` uses the same status letters as `--diff-filter`.

 ### --word-diff

+Bare `git`, not `rtk git`: rtk replaces the word-diff with its own diffstat
+renderer and emits none of the `[-removed-] {+added+}` markers.
+
 ```bash
-rtk git diff --word-diff              # inline word-level diff with [-removed-] {+added+} markers
-rtk git diff --word-diff=color        # color only, no markers
-rtk git diff --word-diff=porcelain    # machine-readable: +/- prefixed lines, ~ for newlines
-rtk git diff --word-diff-regex=<re>   # define what counts as a "word"
+git diff --word-diff             # bare per ADR-0023; inline word-level diff, [-removed-] {+added+} markers
+git diff --word-diff=color       # bare per ADR-0023; color only, no markers
+git diff --word-diff=porcelain   # bare per ADR-0023; machine-readable: +/- prefixed lines, ~ for newlines
+git diff --word-diff-regex=<re>  # bare per ADR-0023; define what counts as a "word"
 ```

 ### Whitespace Flags
--- a/plugins/git/skills/git-remotes/SKILL.md
+++ b/plugins/git/skills/git-remotes/SKILL.md
@@ -10,7 +10,7 @@ description: >
  Not submodule pointers -> `git-submodules`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - git-scm-remote-docs
--- a/plugins/git/skills/git-remotes/references/push.md
+++ b/plugins/git/skills/git-remotes/references/push.md
@@ -48,13 +48,15 @@ Two mitigations:
 # Option 1 — dedicated push-only remote: background tools fetch `origin`, you push
 # through a separate remote that nothing else touches, so its tracking ref can't be
 # poisoned by an unrelated fetch.
-rtk git remote add origin-push $(rtk git config remote.origin.url)
+# The inner `git config` is bare: its stdout becomes a remote URL, so any
+# output rewriting would poison the remote silently.
+rtk git remote add origin-push $(git config remote.origin.url)   # inner bare per ADR-0023
 rtk git push --force-with-lease origin-push

 # Option 2 — explicit SHA via a local tag, unaffected by tracking-branch state
 rtk git fetch
 rtk git tag base master
-rtk git rebase -i master
+git rebase -i master   # bare, not `rtk` (ADR-0023): interactive sequence editor
 rtk git push --force-with-lease=master:base master:master
 ```

--- a/plugins/git/skills/git-worktrees/SKILL.md
+++ b/plugins/git/skills/git-worktrees/SKILL.md
@@ -8,7 +8,7 @@ description: >
  Not interactive multi-step git guidance -> `git-workflow`.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: git
  source_keys:
    - git-scm-worktree-docs
@@ -32,7 +32,7 @@ metadata:
 | Create a local branch tracking a remote one | `rtk git worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add <path> <branch>` expands to exactly this, but **only** under the conditions in `references/worktrees.md` |
 | Throwaway experiment, no branch | `rtk git worktree add -d <path>` — detached HEAD |
 | **Never** `git worktree add <path> <remote>/<branch>` | That ref resolves, so the shortcut never fires and you get **a detached HEAD, no branch, no upstream**. Commits there go unreachable once HEAD moves, and `git push` needs an explicit refspec. Use the tracking row above |
-| List | `rtk git worktree list -v`, or `--porcelain -z` to parse |
+| List | `git worktree list -v` to read, or `git worktree list --porcelain -z` to parse — both bare per ADR-0023: rtk re-renders the output and drops the porcelain flags |
 | Lock or unlock | `rtk git worktree lock [--reason <str>] <path>` / `rtk git worktree unlock <path>` |
 | Move | `rtk git worktree move <from> <to>` |
 | Remove | `rtk git worktree remove <path>` |
@@ -62,6 +62,7 @@ worktrees:
    lock_reason: <reason or empty>
 ```

-Derive those fields from `rtk git worktree list --porcelain -z`. For a single
+Derive those fields from `git worktree list --porcelain -z` — bare, not `rtk`:
+rtk drops both flags and never emits `locked`/`lock_reason` (ADR-0023). For a single
 operation, report its outcome instead — `created: true`, `moved: true`,
 `removed: true`.
--- a/plugins/git/skills/pc-run/SKILL.md
+++ b/plugins/git/skills/pc-run/SKILL.md
@@ -8,7 +8,7 @@ description: >
 compatibility: Requires pre-commit installed and available on PATH.

 metadata:
-  version: "1.0.0"
+  version: "1.0.1"
  category: devtools
  source_keys:
    - context7-pre-commit-com
@@ -19,7 +19,7 @@ allowed-tools: Bash Read

 ## Gotchas

- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
+- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks rtk git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
 - Never bypass a failing hook with `git commit --no-verify` (or `-n`). Hooks are the automated QA gate, so a bypassed commit pushes the failure downstream where it costs more — diagnose it instead.
 - `- files were modified by this hook` is not a bug. A fixer hook rewrote a staged file, so the staged snapshot is stale and the commit is blocked on purpose. Re-stage and re-run the same commit: `rtk git add -u && rtk git commit`. Do NOT reach for `pre-commit install -f` here — it overwrites `.git/hooks/` and has nothing to do with re-staging.

--- a/plugins/gitea/.apm/agents/gitea-orchestrate.agent.md
+++ b/plugins/gitea/.apm/agents/gitea-orchestrate.agent.md
@@ -14,7 +14,7 @@ disallowedTools: Edit, Write, NotebookEdit

 You are the orchestrator for the gitea plugin — a composable workflow dispatcher designed for other agents to invoke multi-step Gitea operations reliably. Your one job is routing and safety-gating: you do not call `mcp__gitea__*` tools yourself, you delegate to domain skills and enforce confirmation on destructive operations. You never edit files. Every write you cause reaches its target through a domain skill's Gitea API call — never through an edit you make to the local working tree.

-You resolve `owner`/`repo` once per session (via `git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
+You resolve `owner`/`repo` once per session (via `rtk git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.

 **Scope:** this orchestrator routes Gitea-object operations across the six domain skills only: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`. `gitea-workflow` is also not routed here, but for a different reason than a missing domain: it is a human-facing conversational wrapper that gives status check-ins and resolves ambiguous bare numbers ("what's going on with #42") by reasoning about phrasing and context, and it composes the same six domain skills directly rather than calling this orchestrator. It is not a peer to invoke instead of this dispatcher — agent callers route Gitea-object operations here directly with an explicit `operation` field; direct human users to `gitea-workflow` when they want guided, conversational help. Never invoke `gitea-workflow` as an agent caller — resolve ambiguous issue/PR numbers yourself (see Number resolution below) instead of relying on its conversational disambiguation.

@@ -30,7 +30,7 @@ These are non-negotiable regardless of `confirm` or any skill-local override:
 - Issues and PRs share one number space. Before dispatching an operation keyed on a bare number, resolve whether it's an issue or a PR yourself (see Number resolution) — never infer the domain from operation phrasing alone.
 - `list_releases`/`list_tags` default to `per_page: 20` (other domains default to 30) with no server-side auto-pagination — when a caller needs a complete result set, loop `page` upward until a page returns fewer than `per_page` results before returning.
 - Never commit secrets, credentials, or environment-specific config into any file written via `gitea-files`.
- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `git remote -v`) to resolve context.
+- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `rtk git remote -v`) to resolve context.

 ### Number resolution

@@ -68,7 +68,7 @@ When invoked, you:
 1. Validate the request structure and check if `operation` is known
 2. Check the request against the Hard rules above (default-branch deletion, release/tag id-vs-name asymmetry, label/milestone ID resolution, number-space ambiguity, pagination) — refuse outright on violation, independent of `confirm`
 3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
-4. Resolve `owner`/`repo` via `git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
+4. Resolve `owner`/`repo` via `rtk git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
 5. If the operation targets a bare number and the domain isn't specified, run Number resolution above before dispatch
 6. Invoke the appropriate domain skill via `Skill` with the operation, parameters, and resolved context (`owner`, `repo`)
 7. Catch and handle Gitea errors: disambiguate 404s (not-found vs. permission-hidden), retry transient failures, loop pagination for `list_releases`/`list_tags` until exhausted
--- a/plugins/gitea/.apm/skills/gitea-branches/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-branches/SKILL.md
@@ -12,7 +12,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo

 metadata:
  category: integration
-  version: "0.1.2"
+  version: "0.1.3"
  source_keys:
    - gitea-mcp-repo
    - gitea-mcp-slim-go
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__list_branches mcp__gitea__create_branch mcp__git
 Before any tool call, extract `owner` and `repo` from the git remote:

 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```

 `get_me` and `list_my_repos` are blocked under the token scope this skill assumes, so the remote is the only source. If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
--- a/plugins/gitea/.apm/skills/gitea-branches/references/branches.md
+++ b/plugins/gitea/.apm/skills/gitea-branches/references/branches.md
@@ -48,7 +48,7 @@ create_branch owner: <owner> repo: <repo> branch: <new-name> old_branch: <source

 Default dispatch: if the user gives a base ("branch off of X", "from X"), pass it as `old_branch`.
 If they don't specify a base and you're mid-task on a local branch, pass your current branch
-(`git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
+(`rtk git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
 working, rather than silently falling back to the repo default. If neither applies (e.g. a fresh
 top-level request with no working branch context), omit `old_branch` and let it default server-side.

--- a/plugins/gitea/.apm/skills/gitea-issues/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-issues/SKILL.md
@@ -14,7 +14,7 @@ compatibility: Requires Gitea MCP server configured with write:issue and write:r

 metadata:
  category: integration
-  version: "0.1.3"
+  version: "0.1.4"
  source_keys:
    - gitea-mcp-repo
    - gitea-mcp-slim-go
@@ -36,7 +36,7 @@ allowed-tools: Bash mcp__gitea__list_issues mcp__gitea__issue_read mcp__gitea__i
 An orchestrating caller may pass `owner` and `repo` in already, and the `search` row is cross-repository and needs only a query — both skip this step. Otherwise, before any tool call:

 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```

 If origin is unset or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
--- a/plugins/gitea/.apm/skills/gitea-labels-milestones/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-labels-milestones/SKILL.md
@@ -16,7 +16,7 @@ metadata:
    - gitea-mcp-slim-go
    - context7-websites-gitea
    - context7-gitea-tea-cli
-  version: "0.1.4"
+  version: "0.1.5"

 allowed-tools: Bash mcp__gitea__label_read mcp__gitea__label_write mcp__gitea__milestone_read mcp__gitea__milestone_write
 ---
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__label_read mcp__gitea__label_write mcp__gitea__m
 Before any tool call, extract `owner` and `repo` from the git remote (skip this if an orchestrating caller already passed them in):

 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```

 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
--- a/plugins/gitea/.apm/skills/gitea-prs/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-prs/SKILL.md
@@ -19,7 +19,7 @@ metadata:
    - gitea-mcp-slim-go
    - context7-websites-gitea
    - context7-gitea-tea-cli
-  version: "0.1.2"
+  version: "0.1.3"

 allowed-tools: Bash mcp__gitea__list_pull_requests mcp__gitea__pull_request_read mcp__gitea__pull_request_write mcp__gitea__pull_request_review_write
 ---
@@ -34,7 +34,7 @@ allowed-tools: Bash mcp__gitea__list_pull_requests mcp__gitea__pull_request_read
 Extract them from the git remote before any tool call, skipping this when an orchestrating caller already passed them in:

 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```

 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
--- a/plugins/gitea/.apm/skills/gitea-releases/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-releases/SKILL.md
@@ -14,7 +14,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo

 metadata:
  category: integration
-  version: "0.1.0"
+  version: "0.1.1"
  source_keys:
    - gitea-mcp-repo
    - gitea-mcp-slim-go
@@ -36,7 +36,7 @@ allowed-tools: Bash mcp__gitea__list_releases mcp__gitea__get_release mcp__gitea
 `owner` and `repo` are required on every tool below. Extract them from the git remote, unless an orchestrating caller passed them in already:

 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```

 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
--- a/plugins/gitea/.claude-plugin/plugin.json
+++ b/plugins/gitea/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "gitea",
-  "version": "1.3.7",
+  "version": "1.3.8",
  "description": "Skills and agents for working with a Gitea forge through its HTTP API \u2014 the forge's own objects, as distinct from the local git clone.",
  "author": {
    "name": "Defame1297",
@@ -17,5 +17,17 @@
    "milestones",
    "releases",
    "branches"
-  ]
+  ],
+  "mcpServers": {
+    "gitea": {
+      "args": [
+        "run",
+        "gitea.com/gitea/gitea-mcp@v1.7.0",
+        "-t",
+        "stdio"
+      ],
+      "command": "go",
+      "type": "stdio"
+    }
+  }
 }
--- a/plugins/gitea/.env.example
+++ b/plugins/gitea/.env.example
@@ -0,0 +1,20 @@
+# Environment variables required by the gitea MCP server declared in
+# plugins/gitea/.mcp.json. apm passes these ${VAR} references through to the
+# deployed MCP config unexpanded; Claude Code resolves them from the process
+# environment at server startup. Neither value is ever committed to this repo.
+#
+# Nothing in this repo auto-loads a .env file -- apm has no dotenv support.
+# Copy this file to .env at the repo root, fill in real values, then export it
+# into your shell before starting Claude Code, e.g.:
+#
+#   set -a; source .env; set +a
+#
+# Or skip the file and export the two variables directly in your shell
+# profile. Either way, never commit .env -- .gitignore already excludes it.
+
+# A Gitea access token, scoped to the repositories this agent should reach.
+# Generate one in Gitea under Settings > Applications.
+GITEA_ACCESS_TOKEN=<your-gitea-access-token>
+
+# The base URL of your Gitea instance, including scheme.
+GITEA_HOST=https://<your-gitea-host>
--- a/plugins/gitea/.github/plugin/plugin.json
+++ b/plugins/gitea/.github/plugin/plugin.json
@@ -1,7 +1,7 @@
 {
  "name": "gitea",
-  "version": "1.3.7",
-  "description": "Skills and agents for working with a Gitea forge through its HTTP API \u2014 the forge's own objects, as distinct from the local git clone.",
+  "version": "1.3.8",
+  "description": "Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.",
  "author": {
    "name": "Defame1297",
    "email": "defame1297@rkdr.net",
@@ -17,5 +17,6 @@
    "milestones",
    "releases",
    "branches"
-  ]
+  ],
+  "mcpServers": ".mcp.json"
 }
--- a/plugins/gitea/.mcp.json
+++ b/plugins/gitea/.mcp.json
@@ -1,3 +1,18 @@
 {
-  "mcpServers": {}
+  "mcpServers": {
+    "gitea": {
+      "args": [
+        "run",
+        "gitea.com/gitea/gitea-mcp@v1.7.0",
+        "-t",
+        "stdio"
+      ],
+      "command": "go",
+      "env": {
+        "GITEA_ACCESS_TOKEN": "${GITEA_ACCESS_TOKEN}",
+        "GITEA_HOST": "${GITEA_HOST}"
+      },
+      "type": "stdio"
+    }
+  }
 }
--- a/plugins/gitea/agents/gitea-orchestrate.agent.md
+++ b/plugins/gitea/agents/gitea-orchestrate.agent.md
@@ -14,7 +14,7 @@ disallowedTools: Edit, Write, NotebookEdit

 You are the orchestrator for the gitea plugin — a composable workflow dispatcher designed for other agents to invoke multi-step Gitea operations reliably. Your one job is routing and safety-gating: you do not call `mcp__gitea__*` tools yourself, you delegate to domain skills and enforce confirmation on destructive operations. You never edit files. Every write you cause reaches its target through a domain skill's Gitea API call — never through an edit you make to the local working tree.

-You resolve `owner`/`repo` once per session (via `git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
+You resolve `owner`/`repo` once per session (via `rtk git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.

 **Scope:** this orchestrator routes Gitea-object operations across the six domain skills only: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`. `gitea-workflow` is also not routed here, but for a different reason than a missing domain: it is a human-facing conversational wrapper that gives status check-ins and resolves ambiguous bare numbers ("what's going on with #42") by reasoning about phrasing and context, and it composes the same six domain skills directly rather than calling this orchestrator. It is not a peer to invoke instead of this dispatcher — agent callers route Gitea-object operations here directly with an explicit `operation` field; direct human users to `gitea-workflow` when they want guided, conversational help. Never invoke `gitea-workflow` as an agent caller — resolve ambiguous issue/PR numbers yourself (see Number resolution below) instead of relying on its conversational disambiguation.

@@ -30,7 +30,7 @@ These are non-negotiable regardless of `confirm` or any skill-local override:
 - Issues and PRs share one number space. Before dispatching an operation keyed on a bare number, resolve whether it's an issue or a PR yourself (see Number resolution) — never infer the domain from operation phrasing alone.
 - `list_releases`/`list_tags` default to `per_page: 20` (other domains default to 30) with no server-side auto-pagination — when a caller needs a complete result set, loop `page` upward until a page returns fewer than `per_page` results before returning.
 - Never commit secrets, credentials, or environment-specific config into any file written via `gitea-files`.
- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `git remote -v`) to resolve context.
+- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `rtk git remote -v`) to resolve context.

 ### Number resolution

@@ -68,7 +68,7 @@ When invoked, you:
 1. Validate the request structure and check if `operation` is known
 2. Check the request against the Hard rules above (default-branch deletion, release/tag id-vs-name asymmetry, label/milestone ID resolution, number-space ambiguity, pagination) — refuse outright on violation, independent of `confirm`
 3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
-4. Resolve `owner`/`repo` via `git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
+4. Resolve `owner`/`repo` via `rtk git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
 5. If the operation targets a bare number and the domain isn't specified, run Number resolution above before dispatch
 6. Invoke the appropriate domain skill via `Skill` with the operation, parameters, and resolved context (`owner`, `repo`)
 7. Catch and handle Gitea errors: disambiguate 404s (not-found vs. permission-hidden), retry transient failures, loop pagination for `list_releases`/`list_tags` until exhausted
--- a/plugins/gitea/apm.yml
+++ b/plugins/gitea/apm.yml
@@ -1,5 +1,5 @@
 name: gitea
-version: 1.3.7
+version: 1.3.8
 description: Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.
 author:
  name: Defame1297
--- a/plugins/gitea/skills/gitea-branches/SKILL.md
+++ b/plugins/gitea/skills/gitea-branches/SKILL.md
@@ -12,7 +12,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo

 metadata:
  category: integration
-  version: "0.1.2"
+  version: "0.1.3"
  source_keys:
    - gitea-mcp-repo
    - gitea-mcp-slim-go
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__list_branches mcp__gitea__create_branch mcp__git
 Before any tool call, extract `owner` and `repo` from the git remote:

 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```

 `get_me` and `list_my_repos` are blocked under the token scope this skill assumes, so the remote is the only source. If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
--- a/plugins/gitea/skills/gitea-branches/references/branches.md
+++ b/plugins/gitea/skills/gitea-branches/references/branches.md
@@ -48,7 +48,7 @@ create_branch owner: <owner> repo: <repo> branch: <new-name> old_branch: <source

 Default dispatch: if the user gives a base ("branch off of X", "from X"), pass it as `old_branch`.
 If they don't specify a base and you're mid-task on a local branch, pass your current branch
-(`git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
+(`rtk git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
 working, rather than silently falling back to the repo default. If neither applies (e.g. a fresh
 top-level request with no working branch context), omit `old_branch` and let it default server-side.

--- a/Show More
+++ b/Show More