diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 4f11b93..38f696d 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -11,28 +11,28 @@
     {
       "name": "kyberforge",
       "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
-      "version": "1.6.1",
+      "version": "1.6.2",
       "category": "Developer Tools",
       "source": "./plugins/kyberforge"
     },
     {
       "name": "bin",
       "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
-      "version": "1.1.6",
+      "version": "1.1.7",
       "category": "Utilities",
       "source": "./plugins/bin"
     },
     {
       "name": "git",
       "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
-      "version": "1.3.6",
+      "version": "1.3.7",
       "category": "Version Control",
       "source": "./plugins/git"
     },
     {
       "name": "gitea",
       "description": "Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.",
-      "version": "1.3.7",
+      "version": "1.3.8",
       "category": "Version Control",
       "source": "./plugins/gitea"
     },
diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json
index 4f11b93..38f696d 100644
--- a/.github/plugin/marketplace.json
+++ b/.github/plugin/marketplace.json
@@ -11,28 +11,28 @@
     {
       "name": "kyberforge",
       "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
-      "version": "1.6.1",
+      "version": "1.6.2",
       "category": "Developer Tools",
       "source": "./plugins/kyberforge"
     },
     {
       "name": "bin",
       "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
-      "version": "1.1.6",
+      "version": "1.1.7",
       "category": "Utilities",
       "source": "./plugins/bin"
     },
     {
       "name": "git",
       "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
-      "version": "1.3.6",
+      "version": "1.3.7",
       "category": "Version Control",
       "source": "./plugins/git"
     },
     {
       "name": "gitea",
       "description": "Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.",
-      "version": "1.3.7",
+      "version": "1.3.8",
       "category": "Version Control",
       "source": "./plugins/gitea"
     },
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ce44c29..71b9b2a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -254,17 +254,79 @@ repos:
         entry: bash
         language: system
         files: '^plugins/[^/]+/\.apm/skills/[^/]+/SKILL\.md$'
+        # Pinned by tests/test-skill-frontmatter.sh, which drives this exact
+        # `bash -c <script> <arg0> <files...>` call shape rather than a copy of
+        # the script -- the bug below was invisible to any test that did not.
         args:
           - -c
           - |
+            # Every check reads the FRONTMATTER only, never the whole file. A
+            # `metadata:` / `name:` / `description:` line inside a body code
+            # fence is documentation (skill-author quotes exactly such a block)
+            # and used to satisfy these greps.
             for f in "$@"; do
-              if [[ -f "$f" ]]; then
-                if ! grep -q "^name:" "$f" || ! grep -q "^description:" "$f"; then
-                  echo "ERROR: $f is missing required frontmatter fields (name: and description:)"
-                  exit 1
-                fi
+              [[ -f "$f" ]] || continue
+
+              fm="$(awk '
+                { sub(/\r$/, "") }
+                NR == 1 { sub(/^\357\273\277/, "") }
+                !opened && /^[[:blank:]]*$/ { next }
+                !opened {
+                  if ($0 ~ /^---[[:blank:]]*$/) { opened = 1; next }
+                  exit
+                }
+                /^---[[:blank:]]*$/ { closed = 1; exit }
+                { print }
+                END { if (!opened || !closed) exit 3 }
+              ' "$f")" || {
+                echo "ERROR: $f has no closing YAML frontmatter block (expected --- ... --- at the top of the file)"
+                exit 1
+              }
+
+              missing=""
+              printf '%s\n' "$fm" | grep -q "^name:" || missing="${missing}name: "
+              printf '%s\n' "$fm" | grep -q "^description:" || missing="${missing}description: "
+
+              # Scoped to the `metadata:` block and stopped at the next
+              # top-level key, so a `version:` under a following `source:` list
+              # cannot stand in for it; the `^  version:` anchor is exact, so a
+              # deeper-nested `    version:` cannot either. No line budget, so a
+              # long `metadata:` block does not hide the key.
+              ver="$(printf '%s\n' "$fm" | awk '
+                /^metadata:/ { inm = 1; next }
+                inm && /^[A-Za-z]/ { exit }
+                inm && /^  version:/ {
+                  v = $0
+                  sub(/^  version:[[:blank:]]*/, "", v)
+                  sub(/[[:blank:]]+#.*$/, "", v)
+                  sub(/[[:blank:]]+$/, "", v)
+                  print "found:" v
+                  exit
+                }
+              ')"
+              [[ -n "$ver" ]] || missing="${missing}metadata.version "
+
+              if [[ -n "$missing" ]]; then
+                echo "ERROR: $f is missing required frontmatter fields (${missing})"
+                exit 1
+              fi
+
+              raw="${ver#found:}"
+              v="$raw"
+              case "$v" in
+                \"*\") v="${v#\"}"; v="${v%\"}" ;;
+                \'*\') v="${v#\'}"; v="${v%\'}" ;;
+              esac
+              if [[ ! "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                echo "ERROR: $f has a malformed frontmatter metadata.version (${raw:-<empty>}) -- expected a three-part semver, e.g. \"1.0.0\""
+                exit 1
               fi
             done
+          # arg0 for `bash -c`. WITHOUT it pre-commit's first filename lands in
+          # $0 and is dropped from "$@" -- so a single-file commit, the normal
+          # case, ran the loop zero times and reported Passed having checked
+          # nothing. Do not remove; tests/test-skill-frontmatter.sh pins it.
+          - skill-frontmatter
 
       - id: skill-size-check
         stages: ['pre-commit']
@@ -284,6 +346,21 @@ repos:
         # records for Vale warnings. Costs nothing on a clean file: the script
         # prints only findings.
 
+      - id: check-rtk-prefix
+        stages: ['pre-commit']
+        name: ADR-0023 rtk prefix on executable git commands
+        description: Enforce ADR-0023 clause 1 -- an executable, instructed git command in a shell code fence or a dispatch-table Run cell is written `rtk git`. Clauses 2 and 3 are not machine-decidable; a deliberately bare command opts out with the literal string ADR-0023 on its own line
+        entry: scripts/check-rtk-prefix.sh
+        language: script
+        files: '^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$'
+        # README.md is excluded on purpose, not by oversight. A skill-directory
+        # README is consumer-facing prose that no agent ever loads, and the
+        # `git clone` lines in the seven tests/README.md files are setup
+        # instructions for a third party who has no rtk installed. Prefixing
+        # those would be actively wrong -- see ADR-0023's consumer section.
+        exclude: '(^|/)README\.md$'
+        pass_filenames: true
+
       - id: vale-audit-prefilter-skill
         stages: ['pre-commit']
         name: Vale audit prefilter (SKILL.md)
diff --git a/LESSONS.md b/LESSONS.md
index 7a01d6c..0175e8b 100644
--- a/LESSONS.md
+++ b/LESSONS.md
@@ -60,29 +60,21 @@ write-eval's process requires presenting the full test plan and waiting for user
 
 The write-skill authoring standard required 8 body sections including Role and When/When not. These were assumed to be agentskills.io requirements. Checking the actual spec revealed the body has no format restrictions at all — recommended sections are step-by-step instructions, examples, and edge cases. Role and When/When not were added by convention without verifying the standard. Fix: before encoding any requirement as part of an authoring standard, check the upstream spec directly. The agentskills.io spec also confirmed that negative triggers belong in the description field — not in a separate body section — which eliminates a persistent duplication pattern across all skills.
 
-## 2026-05-18 — Provenance fields in frontmatter are loaded on every skill scan
-
-Fields like `source:`, `references:`, `version:`, `updated:`, and `when:` in SKILL.md frontmatter are loaded at agent startup alongside `name` and `description` for every installed skill. None of these are used for routing or runtime execution — they are audit and upgrade-cycle records. Loading them at startup violates progressive disclosure and wastes tokens proportional to the number of installed skills. Fix: move all non-routing frontmatter to a separate `META.md` file in the skill directory. Frontmatter keeps only `name`, `description`, `metadata.category`, and `allowed-tools` (when applicable) — the four fields the spec actually uses for routing and discovery.
-
 ## 2026-05-18 — Copy-fill is more deterministic than generate for structured skill artifacts
 
-When a skill produces a structured artifact like SKILL.md, the natural approach is to generate it from internalized rules in the Process section. But this means section structure is only as reliable as the agent's instruction-following under token pressure. Copy-fill (copy the template to the target path, then fill in content) separates structure from content: the template mechanically enforces section order and presence, freeing the Process section to focus only on sequencing constraints (what order to decide things) rather than also policing structure. Side benefit: the template is a human-usable artifact that can be adopted independently of the skill. Fix applied in write-skill refactor: SKILL-TEMPLATE.md and META-TEMPLATE.md are the authoritative structure sources; the Process section no longer contains a body structure constraint — the template handles it.
+When a skill produces a structured artifact like SKILL.md, the natural approach is to generate it from internalized rules in the Process section. But this means section structure is only as reliable as the agent's instruction-following under token pressure. Copy-fill (copy the template to the target path, then fill in content) separates structure from content: the template mechanically enforces section order and presence, freeing the Process section to focus only on sequencing constraints (what order to decide things) rather than also policing structure. Side benefit: the template is a human-usable artifact that can be adopted independently of the skill. Fix applied in write-skill refactor: SKILL-TEMPLATE.md is the authoritative structure source; the Process section no longer contains a body structure constraint — the template handles it.
 
 ## 2026-05-17 — HITL gap: agent delegates confirmation to permission system
 
 The agent-level HITL rule ("require explicit confirmation before irreversible shared-state operations") is being bypassed: the agent calls the tool and lets the permission dialog catch it. This means the rule is not firing in agent reasoning — it's the permission system acting as a safety net. If a user selects "don't ask again," the net disappears. Fix: the HITL rule needs to be framed as "do not call the tool" rather than "ask before proceeding" — the agent must ask first, then act only after explicit confirmation.
 
-## 2026-05-26 — META-TEMPLATE uses YAML comments; META.md output retains them
-
-META-TEMPLATE.md uses YAML `#` comments to explain fields inline. SKILL-TEMPLATE.md uses HTML comments inside XML tags, which the agent strips on fill. The structural difference means SKILL.md output is clean but META.md output retains the explanatory `#` lines — an inconsistency. Fix (deferred): restructure META-TEMPLATE.md so all explanatory guidance is prose above the code block (markdown, never copied into the output YAML), and the code block itself uses `<placeholder>` syntax with no `#` comment lines. This makes META.md fill behaviour deterministic for the same reason SKILL.md fill is: `<...>` markers are unambiguously replaceable; prose above the block is not part of the template. Do not apply until the human/copy-fill tradeoff is resolved — see 2026-05-26 session discussion.
-
 ## 2026-05-26 — Overlap checks must scan the deployed directory, not just the source repo
 
 `write-a-skill` existed only in `~/.agents/skills/` (installed from a pre-refactor source) and was invisible during a repo-level scan of `.agents/skills/`. Governance reviews and overlap checks that only look at the source repo will miss skills added by install.sh from other sources or prior runs. Fix: overlap checks must scan the deployed `~/.agents/skills/` directory, not just the repo's `.agents/skills/`.
 
-## 2026-05-26 — `model:` field belongs in SKILL.md frontmatter, not META.md
+## 2026-05-26 — `model:` field belongs in SKILL.md frontmatter, not a sidecar file
 
-Claude Code supports `model:` as a provider extension in SKILL.md frontmatter — it overrides the session model for the skill's turn and reverts after. Attempting to put it in META.md was wrong: META.md is provenance/audit metadata, not runtime config. The boundary: if a field affects agent behaviour at invocation time, it belongs in SKILL.md frontmatter; if it serves upgrade reviews and audit trails, it belongs in META.md.
+Claude Code supports `model:` as a provider extension in SKILL.md frontmatter — it overrides the session model for the skill's turn and reverts after. Attempting to move it out to a provenance sidecar was wrong: a sidecar is audit metadata, not runtime config. The boundary: if a field affects agent behaviour at invocation time, it belongs in SKILL.md frontmatter.
 
 ## 2026-05-26 — Research agents present synthesis as spec fact
 
@@ -126,7 +118,7 @@ Two forks independently fixed `references/sources.md` with different approaches
 
 ## 2026-06-28 — Implementation agents must invoke /skill-author, not write skill files directly
 
-When briefing an agent to implement a new skill, the instinct is to tell it to write the SKILL.md and supporting files directly. This bypasses Step 5 of the skill-author process (provenance), which requires reading all research `sources.md` files and recording every `extracted` slug in META.md. The `validate-provenance.sh` script catches the gap — but only after the commit, requiring a fix round. This pattern recurred twice in one session (plugin-author and marketplace-author initial implementation, then again in the first round of fix agents). Fix: briefs for implementation agents must explicitly say "invoke `/skill-author` (read and follow `plugins/kyberforge/.apm/skills/skill-author/SKILL.md`)" — not "write the skill files." Invoking the skill is the only reliable way to ensure all process gates, including provenance, run.
+When briefing an agent to implement a new skill, the instinct is to tell it to write the SKILL.md and supporting files directly. This bypasses Step 5 of the skill-author process (provenance), which requires reading all research `sources.md` files and recording every `extracted` slug in the skill's own `references/sources.md`. The `validate-provenance.sh` script catches the gap — but only after the commit, requiring a fix round. This pattern recurred twice in one session (plugin-author and marketplace-author initial implementation, then again in the first round of fix agents). Fix: briefs for implementation agents must explicitly say "invoke `/skill-author` (read and follow `plugins/kyberforge/.apm/skills/skill-author/SKILL.md`)" — not "write the skill files." Invoking the skill is the only reliable way to ensure all process gates, including provenance, run.
 
 ## 2026-07-05 — Repo root is a bare checkout; work happens in worktrees only
 
diff --git a/apm.lock.yaml b/apm.lock.yaml
index ca28793..4056018 100644
--- a/apm.lock.yaml
+++ b/apm.lock.yaml
@@ -1,42 +1,51 @@
 lockfile_version: '1'
-generated_at: '2026-08-30T11:38:46.419301+00:00'
+generated_at: '2026-09-01T14:55:26.980675+00:00'
 apm_version: 0.28.0
 dependencies:
 - repo_url: Defame1297/holocron
   name: bin
   host: git.dev.rkdr.net
-  resolved_commit: 0e91a3ae66d1b0439b9c0ef4b6e88ca6f2659473
-  version: 1.1.5
+  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  version: 1.1.6
   virtual_path: plugins/bin
   is_virtual: true
   package_type: marketplace_plugin
   deployed_files:
   - .claude/skills/caveman
+  - .claude/skills/caveman/README.md
   - .claude/skills/caveman/SKILL.md
   - .claude/skills/diagnose
+  - .claude/skills/diagnose/README.md
   - .claude/skills/diagnose/SKILL.md
-  - .claude/skills/diagnose/scripts/hitl-loop.template.sh
+  - .claude/skills/diagnose/assets/hitl-loop.template.sh
+  - .claude/skills/diagnose/references/feedback-loops.md
+  - .claude/skills/diagnose/references/regression-seams.md
   - .claude/skills/grill-me
+  - .claude/skills/grill-me/README.md
   - .claude/skills/grill-me/SKILL.md
   - .claude/skills/grill-with-docs
   - .claude/skills/grill-with-docs/ADR-FORMAT.md
   - .claude/skills/grill-with-docs/CONTEXT-FORMAT.md
+  - .claude/skills/grill-with-docs/README.md
   - .claude/skills/grill-with-docs/SKILL.md
   - .claude/skills/improve-codebase-architecture
   - .claude/skills/improve-codebase-architecture/DEEPENING.md
   - .claude/skills/improve-codebase-architecture/INTERFACE-DESIGN.md
   - .claude/skills/improve-codebase-architecture/LANGUAGE.md
+  - .claude/skills/improve-codebase-architecture/README.md
   - .claude/skills/improve-codebase-architecture/SKILL.md
   - .claude/skills/prototype
-  - .claude/skills/prototype/LOGIC.md
+  - .claude/skills/prototype/README.md
   - .claude/skills/prototype/SKILL.md
-  - .claude/skills/prototype/UI.md
+  - .claude/skills/prototype/references/logic.md
+  - .claude/skills/prototype/references/ui.md
   - .claude/skills/research
-  - .claude/skills/research/META.md
+  - .claude/skills/research/README.md
   - .claude/skills/research/SKILL.md
   - .claude/skills/research/references/file-format.md
   - .claude/skills/research/references/topics.md
   - .claude/skills/tdd
+  - .claude/skills/tdd/README.md
   - .claude/skills/tdd/SKILL.md
   - .claude/skills/tdd/deep-modules.md
   - .claude/skills/tdd/interface-design.md
@@ -46,49 +55,64 @@ dependencies:
   - .claude/skills/triage
   - .claude/skills/triage/AGENT-BRIEF.md
   - .claude/skills/triage/OUT-OF-SCOPE.md
+  - .claude/skills/triage/README.md
   - .claude/skills/triage/SKILL.md
   - .claude/skills/write-docs
+  - .claude/skills/write-docs/README.md
   - .claude/skills/write-docs/SKILL.md
   - .claude/skills/zoom-out
+  - .claude/skills/zoom-out/README.md
   - .claude/skills/zoom-out/SKILL.md
   deployed_file_hashes:
-    .claude/skills/caveman/SKILL.md: sha256:b4bb6fe3bf3da222993ca0aee5e7c6f5368b182dd30ce1172e8f8e3280eb7052
-    .claude/skills/diagnose/SKILL.md: sha256:28886402bbfa0470248086eab9106a103b964b76ae9496e63ff0c8a6761b6d13
-    .claude/skills/diagnose/scripts/hitl-loop.template.sh: sha256:b2932630950e5210075bcd6f850e5accf30c101c5367b29eac3a29b4dd8084c8
-    .claude/skills/grill-me/SKILL.md: sha256:74147eb6010a65957efef2b9e0f0b3ff935c1def7fc117697151b1d0f3610556
+    .claude/skills/caveman/README.md: sha256:f512fff0ddf11ae216c6806d4c2ad31e130de6ed360c89a39787c2ff6f4a2c62
+    .claude/skills/caveman/SKILL.md: sha256:817ed2655c2188c5c0b1e1dc5f4e762e699ad7fcd2a056e4ef73d5f6601dd1f8
+    .claude/skills/diagnose/README.md: sha256:ac59366a09f74bce57d45ebe06e8afb7d12166351a4756a7b89f71ab9e0fc450
+    .claude/skills/diagnose/SKILL.md: sha256:0844ba2bbede408be2e54a20cacd2e280c275c11ba45173381659a76f0c54cad
+    .claude/skills/diagnose/assets/hitl-loop.template.sh: sha256:b2932630950e5210075bcd6f850e5accf30c101c5367b29eac3a29b4dd8084c8
+    .claude/skills/diagnose/references/feedback-loops.md: sha256:5ed81b331fcf7dfc229b92be7250fd786064f8363dbf55bf6b6e5e9b5f5e1daf
+    .claude/skills/diagnose/references/regression-seams.md: sha256:fdb24c383628d239e54424f72258860612d6fe8a1fc5d0057ab5073628cc71f4
+    .claude/skills/grill-me/README.md: sha256:4acbda2175bf003f1106a6912cf2cfb8d3d2623f391b1be6f417beb084a65b05
+    .claude/skills/grill-me/SKILL.md: sha256:0af060d6813ed59547be14c7dfd544d5b626c852f7ec0f7213c27c7ec0ae76c1
     .claude/skills/grill-with-docs/ADR-FORMAT.md: sha256:f1f36cd3f8d3b6474ddd5855da4e233bfc4ae1a1c5024909ccf11871819a41b2
     .claude/skills/grill-with-docs/CONTEXT-FORMAT.md: sha256:8f6baaa3b1c91644bd7c600196b1aee781d5f525c7c345db8cdfbfb368329a05
-    .claude/skills/grill-with-docs/SKILL.md: sha256:c7176600a8bffc9f359102cb041b6686387618b8e1434ba484dd708d45df6d5e
+    .claude/skills/grill-with-docs/README.md: sha256:c94a826df0f85f17957b9fa2fe73d52ab1ff29d7685658b994721378eeea811e
+    .claude/skills/grill-with-docs/SKILL.md: sha256:26d06ea58adae5fa6ca8b406cc4a8d13ec3c9780bfb283c29ef0a8f8845f26f9
     .claude/skills/improve-codebase-architecture/DEEPENING.md: sha256:9577485f4fc32c0267639a9151bb41c8af0f8f6086e4bf8b84d5b236e30604e9
     .claude/skills/improve-codebase-architecture/INTERFACE-DESIGN.md: sha256:678c3e34f1339015053212b3316bf0b676c70aa251050a0613667d4e755fb35e
     .claude/skills/improve-codebase-architecture/LANGUAGE.md: sha256:6feca2140439c54a774749e8367f18350899ff69c777144ed2248cd4407949fa
-    .claude/skills/improve-codebase-architecture/SKILL.md: sha256:318b3df6a557f3a9216e6c32813d543301fa51954ea79c87edb95e1297213584
-    .claude/skills/prototype/LOGIC.md: sha256:da91dc92195c00d5dc33863b8c1a030998025a0f8583ebf2babd770825b7f70c
-    .claude/skills/prototype/SKILL.md: sha256:913df144c79658394b7ccc984858103a27553eeff9a8bf93dc51486603259d0f
-    .claude/skills/prototype/UI.md: sha256:d76d565149ee50456c5ddc5e29c27fec8737637874fe5c37d970db085a200b27
-    .claude/skills/research/META.md: sha256:81a31d9ba20988b07bd4e141f0a7369d4dda302772d62809cc8b223ca1fbb84f
-    .claude/skills/research/SKILL.md: sha256:9ca6b3b8c9c1d04f93a6ef55149d0eecc9ffa82a28db9fb3f9b588c661b1b747
+    .claude/skills/improve-codebase-architecture/README.md: sha256:813332e95450c7e3e4c892f5edf777236d213fca40f3d1ff30ac7a644f2ea258
+    .claude/skills/improve-codebase-architecture/SKILL.md: sha256:4e54cc00ec301027f640ac5dd1877b0d9ec94c16e784da0cdab25e220167e53d
+    .claude/skills/prototype/README.md: sha256:4f09d8742b017da6da3aa87d55a26937dda9ad2a3dcc0e45df62e26d6be10983
+    .claude/skills/prototype/SKILL.md: sha256:873d3c3bf9e46af5e61598a9030ac0304b58f900f48f102e7322c825d5fe435a
+    .claude/skills/prototype/references/logic.md: sha256:05c193ce98ee01ed3d7558891efa97c8f6a3b61605f24d18f9d405aef7d1b58d
+    .claude/skills/prototype/references/ui.md: sha256:bff1746d1f0c5ef42d8c2fac33637249a78a6c0c92cfdf906da933e2e1104ec6
+    .claude/skills/research/README.md: sha256:b5fe17aea6a398ceaeebcab9cb2c31ff8fcc806d5793a257916dc16b6ecb9933
+    .claude/skills/research/SKILL.md: sha256:245cec403e83b8c7fbc0f17e684858d49f06d35a3bcbb5f967f81c4efe5bdafc
     .claude/skills/research/references/file-format.md: sha256:29d5583beaa531d26895c54def112039730490c312401648a6bdb7dd5278fb3c
     .claude/skills/research/references/topics.md: sha256:757abb7b6be44c3d3c0dd1f4818a344e08877810d36bf8be60ea7189cba8d12f
-    .claude/skills/tdd/SKILL.md: sha256:af059705061156fd4845ddbb736fe92b564118ac5f03551e09ef9e8f6d970638
+    .claude/skills/tdd/README.md: sha256:ee7c9de4eb494f8a0e4e67153a5b44b560f7e53cc35f5ebdfbeb6dfa5bd1ed16
+    .claude/skills/tdd/SKILL.md: sha256:46bc2a4c55b15e96fdd002167f37b43245e64fcbecb61daed11eac6e0d026da8
     .claude/skills/tdd/deep-modules.md: sha256:f2123700bf953db1740625686c75bdd145efd486357c47c6818c869fee657a32
     .claude/skills/tdd/interface-design.md: sha256:764c5ff0e3fa6b4ab7095eb65ccc7201e090baf19fa16051dfdb72c06d27417d
     .claude/skills/tdd/mocking.md: sha256:3ceb807fdf4a47d6a93d4d9a891e5ba6d362a6247bd08adc451feebfc17361ef
     .claude/skills/tdd/refactoring.md: sha256:54fced22dd1911b7094c3fe7979b7c1a40d40be307482c4adf7dc0588f27d6cc
     .claude/skills/tdd/tests.md: sha256:e12182f5c4c6a844b7c6ab4b8d2623b642aaaae5460fe58ed087efd4f3d5fb8a
-    .claude/skills/triage/AGENT-BRIEF.md: sha256:1c71c747aa97d938f75ec7a4b8fe87451763b38a3ce6348acf2b222e5819b2e5
+    .claude/skills/triage/AGENT-BRIEF.md: sha256:e34b7e9359b8b2b95b4d9795864f2a8ef5ef4f60b3632ddcb5563937110c71e0
     .claude/skills/triage/OUT-OF-SCOPE.md: sha256:8ed8cf27833444060c81b3961a83c0e3d8e6cf2fcb2ddf6f8b07c6655cbb0d85
-    .claude/skills/triage/SKILL.md: sha256:b819f0285e4e5814ac6472d0217f07dc9f23d2fdae3ebb0dd31d98360d8ac029
-    .claude/skills/write-docs/SKILL.md: sha256:0d06d0f6836a67532497ea61bd5a1294a8d80f529bf1ffb5c4b1fdc72e9cb51a
+    .claude/skills/triage/README.md: sha256:9144c8d3262ad42f09d430e4cad17c16310919d68a91c17ac36f1285f6b4110b
+    .claude/skills/triage/SKILL.md: sha256:42042bf7c3e6392d1ff0a0536fe0692fa710d6818e2501db77c7f22fa6e423cb
+    .claude/skills/write-docs/README.md: sha256:6d6310785603c1f4653be2ae9ffb37008cbe22eee49aed02ac8076ab20f95bcc
+    .claude/skills/write-docs/SKILL.md: sha256:25af5dc9e67a0755bc7a2cb99a1008156ba1fd17b283bdb5cc82dfccdb834421
+    .claude/skills/zoom-out/README.md: sha256:5c80fbcf7fc6ee5117872b146aacd630a3d2f2d86693e06aef2e3c8eea9115cf
     .claude/skills/zoom-out/SKILL.md: sha256:2a6894c7f9b1c9c55f451c625a834c4f377e217b623a85280e55db5fe9cacf48
-  content_hash: sha256:d7cca4972651b241a5450679289fdb6f0e3a37aef9dff0498cb4b3340b048781
+  content_hash: sha256:7c568135b260c8fed6d369afeefddfa57f9979590291447007811941d87bb6b4
   declared_license: MIT
   exec_status: gated_pending_approval
 - repo_url: Defame1297/holocron
   name: core
   host: git.dev.rkdr.net
-  resolved_commit: 0e91a3ae66d1b0439b9c0ef4b6e88ca6f2659473
-  version: 1.1.1
+  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  version: 1.1.2
   virtual_path: plugins/core
   is_virtual: true
   package_type: marketplace_plugin
@@ -109,33 +133,35 @@ dependencies:
   - .claude/skills/provider-adapter-author
   - .claude/skills/provider-adapter-author/README.md
   - .claude/skills/provider-adapter-author/SKILL.md
+  - .claude/skills/provider-adapter-author/references/provider-matrix.md
   - .claude/skills/provider-adapter-author/references/sources.md
   - .claude/skills/provider-adapter-author/scripts/README.md
   - .claude/skills/provider-adapter-author/scripts/validate-adapter.sh
   deployed_file_hashes:
-    .claude/skills/agentsmd-audit/README.md: sha256:5d487aadb0424eb162f19454488e3b923180163cf1a543bb977b6969ae7a6849
-    .claude/skills/agentsmd-audit/SKILL.md: sha256:f4e1d3f1fa79ebd4c2c874dfb2fe1b86834c9ae708ab3f0a3fa07be39e90b552
+    .claude/skills/agentsmd-audit/README.md: sha256:b177cae5eca7326850986b502bd5bf3c2c5949fddc124c70a6a98e8c4d3dc7a8
+    .claude/skills/agentsmd-audit/SKILL.md: sha256:f231a143f71a89a4ccbbf6d1579ea45c071b4f251a4b97e07c70d001ab7ba0f5
     .claude/skills/agentsmd-audit/references/sources.md: sha256:ce13d263414c4c8ea96a33a9d3e0d5535c3100fb1e54a26d2bfe218fc7cd5974
     .claude/skills/agentsmd-audit/scripts/README.md: sha256:40a7e90e0823a6caaa0276e8d13a3c1bdc7afc533912166aad3454b979824d6a
     .claude/skills/agentsmd-audit/scripts/validate-drift.sh: sha256:941e521498fa77b483529a73afc13d1d1630876d9035bd3bd020ac3bc3e5a18a
     .claude/skills/agentsmd-audit/scripts/validate-secrets.sh: sha256:2b53d9d7d0891da4d83ddfec759dcdd7429468360dbc238c0b7e8af816054241
     .claude/skills/agentsmd-audit/scripts/validate-structure.sh: sha256:21507848d60b341165880294feb3a2f80dec55b1814b24e94647988da1fdfdd7
     .claude/skills/agentsmd-author/README.md: sha256:096adbfc44e87da5dd8a8ad0e5eebc0cf4b9d515ab7d7fde4ec80ff3515bfbc7
-    .claude/skills/agentsmd-author/SKILL.md: sha256:c32b9fe1cc7966d21d1ec504396d492afa53eb6369bd3b2678aed4ba92f331f8
+    .claude/skills/agentsmd-author/SKILL.md: sha256:cf9a33c658cbe153391072872cefe403762b37c9ddc74d7c6f64ac6e08dd0f8b
     .claude/skills/agentsmd-author/references/content-guide.md: sha256:1b10c956254c949492c2993991c5fd86417db8b64aefbc45695087bb9c021e36
     .claude/skills/agentsmd-author/references/sources.md: sha256:aecbe65ba9526f694534989cbb516c65a55f75553195753566abccd6841359fe
-    .claude/skills/provider-adapter-author/README.md: sha256:9aa132d5ffa7f249fa4c8f0e90f8505c1f1d0dcdd681e7930e5b0236407038b5
-    .claude/skills/provider-adapter-author/SKILL.md: sha256:7d2d9c9555373fdac86683c517fcccca1d090347c9c1d13f91942763219d2053
-    .claude/skills/provider-adapter-author/references/sources.md: sha256:45dfe2ff95744d7a00fa5b75be216562ff84047f21588ef244e89bdc2e5ae1bb
-    .claude/skills/provider-adapter-author/scripts/README.md: sha256:196aa7752b2df4710b397e1927f68b0b966caa8a3b1006122ef6e184882af01b
-    .claude/skills/provider-adapter-author/scripts/validate-adapter.sh: sha256:519c8ab3d33884821a6090ec5ba0322ec1594f9c1ca388b44279133a1e0fa9be
-  content_hash: sha256:df3239f8ebc54ecbf4d91325bfd056cbd8919f3b20f85721906c9de8776c4927
+    .claude/skills/provider-adapter-author/README.md: sha256:ad6d674667fb810823a2b2115a9d6740b1dbde06af23e6315c6b4fbd44097823
+    .claude/skills/provider-adapter-author/SKILL.md: sha256:7e22858832bf95cce89cc5d3a3044bb0b811deed3c3974351bce040629cec59e
+    .claude/skills/provider-adapter-author/references/provider-matrix.md: sha256:30d712d76530dda0a82d600c710e43fa856537ba17391fb8fc8b4304766b706c
+    .claude/skills/provider-adapter-author/references/sources.md: sha256:5cf7ded132beeed77b2069602015852bf18757fe9cd203c3e9c3e9064f8185bf
+    .claude/skills/provider-adapter-author/scripts/README.md: sha256:79095c5be4c3abc937053f1a0977fb6cf737111061fde561973c81f8e2192529
+    .claude/skills/provider-adapter-author/scripts/validate-adapter.sh: sha256:aff693f69b987fe74a5d4c60368118dae7595c087d0de9691f5905e62ae3e1c9
+  content_hash: sha256:93afd146bf812ab846c81dc3e90cfe9f60a5bef057de6a95442673589e9d63af
   declared_license: MIT
 - repo_url: Defame1297/holocron
   name: git
   host: git.dev.rkdr.net
-  resolved_commit: 0e91a3ae66d1b0439b9c0ef4b6e88ca6f2659473
-  version: 1.3.5
+  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  version: 1.3.6
   virtual_path: plugins/git
   is_virtual: true
   package_type: marketplace_plugin
@@ -144,35 +170,50 @@ dependencies:
   - .claude/skills/git-branches
   - .claude/skills/git-branches/README.md
   - .claude/skills/git-branches/SKILL.md
+  - .claude/skills/git-branches/references/branch-operations.md
+  - .claude/skills/git-branches/references/branch-patterns.md
+  - .claude/skills/git-branches/references/comparing-branches.md
+  - .claude/skills/git-branches/references/merging.md
+  - .claude/skills/git-branches/references/orchestrator-contract.md
   - .claude/skills/git-branches/references/sources.md
   - .claude/skills/git-commits
   - .claude/skills/git-commits/README.md
   - .claude/skills/git-commits/SKILL.md
+  - .claude/skills/git-commits/references/cherry-pick.md
   - .claude/skills/git-commits/references/commit-template.md
   - .claude/skills/git-commits/references/conventional-commits-spec.md
+  - .claude/skills/git-commits/references/create-commit.md
+  - .claude/skills/git-commits/references/rewrite-history.md
   - .claude/skills/git-commits/references/sources.md
   - .claude/skills/git-history
   - .claude/skills/git-history/README.md
   - .claude/skills/git-history/SKILL.md
   - .claude/skills/git-history/references/README.md
+  - .claude/skills/git-history/references/bisect.md
   - .claude/skills/git-history/references/git-log-format.md
   - .claude/skills/git-history/references/sources.md
   - .claude/skills/git-remotes
   - .claude/skills/git-remotes/README.md
   - .claude/skills/git-remotes/SKILL.md
   - .claude/skills/git-remotes/references/README.md
-  - .claude/skills/git-remotes/references/remotes.md
+  - .claude/skills/git-remotes/references/fetch.md
+  - .claude/skills/git-remotes/references/pull.md
+  - .claude/skills/git-remotes/references/push.md
+  - .claude/skills/git-remotes/references/remote-config.md
   - .claude/skills/git-remotes/references/sources.md
   - .claude/skills/git-submodules
   - .claude/skills/git-submodules/README.md
   - .claude/skills/git-submodules/SKILL.md
   - .claude/skills/git-submodules/references/README.md
+  - .claude/skills/git-submodules/references/removal.md
+  - .claude/skills/git-submodules/references/setup-and-update.md
   - .claude/skills/git-submodules/references/sources.md
-  - .claude/skills/git-submodules/references/submodules.md
+  - .claude/skills/git-submodules/references/urls-and-config.md
   - .claude/skills/git-workflow
   - .claude/skills/git-workflow/README.md
   - .claude/skills/git-workflow/SKILL.md
   - .claude/skills/git-workflow/references/README.md
+  - .claude/skills/git-workflow/references/hard-rules.md
   - .claude/skills/git-workflow/references/sources.md
   - .claude/skills/git-worktrees
   - .claude/skills/git-worktrees/README.md
@@ -184,65 +225,90 @@ dependencies:
   - .claude/skills/pc-author/README.md
   - .claude/skills/pc-author/SKILL.md
   - .claude/skills/pc-author/references/README.md
+  - .claude/skills/pc-author/references/create-config.md
   - .claude/skills/pc-author/references/hooks-by-language.md
+  - .claude/skills/pc-author/references/modify-config.md
   - .claude/skills/pc-author/references/sources.md
   - .claude/skills/pc-run
   - .claude/skills/pc-run/README.md
   - .claude/skills/pc-run/SKILL.md
   - .claude/skills/pc-run/references/README.md
+  - .claude/skills/pc-run/references/autoupdate.md
+  - .claude/skills/pc-run/references/clean.md
   - .claude/skills/pc-run/references/failure-patterns.md
+  - .claude/skills/pc-run/references/install.md
   - .claude/skills/pc-run/references/sources.md
   deployed_file_hashes:
-    .claude/agents/git-orchestrate.md: sha256:95a48c8e62cbb5d8f5bb2aa80c253d2f8b3a3988cf6202c10ae4feae1266d64d
-    .claude/skills/git-branches/README.md: sha256:1d59fc21bcaad298a81e5b1c13cf2a396b13ad59a09eeb63f95165f9216755d3
-    .claude/skills/git-branches/SKILL.md: sha256:29d19cee09cd3be3d26db86a228aca9d41833c53945e53e5b26e4339f5c35f0c
-    .claude/skills/git-branches/references/sources.md: sha256:ee1c982caf67183acc51226bb5078b3409bb6965b720568f10d67e5f976ccb72
-    .claude/skills/git-commits/README.md: sha256:c686fd6dd54c608889168cfeaf62e659d66e681194a95aaf5f84859513fda800
-    .claude/skills/git-commits/SKILL.md: sha256:99826526958edffc2a897cc9622e3b2cf11c1bd9995c4a338a23758e62aad9de
-    .claude/skills/git-commits/references/commit-template.md: sha256:456d80208901106270687906c90bc35eb64595800c05b7b9340fe96cc1cf6a57
-    .claude/skills/git-commits/references/conventional-commits-spec.md: sha256:b131b5a2edb9a5acd6bdcb72107099a26bbc172b9a5eb845da4daa2176e962f9
-    .claude/skills/git-commits/references/sources.md: sha256:7ef0293a96884c8935e3384cfb1c3c2c274d0aa0771ba8ac275e68f568d433f5
-    .claude/skills/git-history/README.md: sha256:b285b5b8d771dd2f3482db8b2bd79835ebb6273bffbd8d01bca17d683baac6fa
-    .claude/skills/git-history/SKILL.md: sha256:d44ca7f6026624da21f9d31f1bb7a03524d83f30f2e83b54b0f72e9dc1524dfc
-    .claude/skills/git-history/references/README.md: sha256:96ef45f979c692acc9a8f745570d506efe8ed8a57015de02dc699bd77018c463
-    .claude/skills/git-history/references/git-log-format.md: sha256:e3a0711d7d2a7053bbd1bcd70832c65dd3348266c0fb330fd80a0b8f7c8f858b
-    .claude/skills/git-history/references/sources.md: sha256:4a9c9c2ff80193ad4c751ab4baf4c9c42db038a7ea5156733e3253c335912f5b
-    .claude/skills/git-remotes/README.md: sha256:7f51c47e1671de9f0a63a8836b16caa68727105b62a4240716e457ed8d401f97
-    .claude/skills/git-remotes/SKILL.md: sha256:801a81a26117ee38130d9171f9b16c6ae7a281ec3aa3535fee30578eb29c7908
-    .claude/skills/git-remotes/references/README.md: sha256:d590a7f2eb078710f44893b4866e821c840f48b7360f0779420d73331a3de597
-    .claude/skills/git-remotes/references/remotes.md: sha256:80229bbd6d9e03e85e5ff49018181fb71003187f2c5e019869807e4e94aa4a46
-    .claude/skills/git-remotes/references/sources.md: sha256:33e966aba6946cd78d2b9e325670e5292ccdf73d90fcdfca70afb30ee70c1f2d
-    .claude/skills/git-submodules/README.md: sha256:1510e9691d5107c436bda3497066950bfd2e9c9612cdf8ebd40f5ec73780ddea
-    .claude/skills/git-submodules/SKILL.md: sha256:3b4525c5e7145d30f4a945bf5f2429cca270f00e88ed85ff79c6d5fa89fa05ca
-    .claude/skills/git-submodules/references/README.md: sha256:ef5453d5e87fd62568d8c1c55fccfc41f6522316976a8f2cde7aa90c1f857809
-    .claude/skills/git-submodules/references/sources.md: sha256:1786dcf90dd21988379a5ee4f243b50a158d87bc059d4903bf54ef268811c5e7
-    .claude/skills/git-submodules/references/submodules.md: sha256:ffab8cef061118a83ef480c5e8077c0e1ac2fa7e5e1fae333cfff9bfd362003f
-    .claude/skills/git-workflow/README.md: sha256:00844e92a521b46273e1c9ee334440c868348c1795ae86eb7fd95fb86dbbfbed
-    .claude/skills/git-workflow/SKILL.md: sha256:87a3f39fab4db85ce8d2b23d01d1e8b2180bf0a73eb18183eae2d7e28c2cc42b
-    .claude/skills/git-workflow/references/README.md: sha256:f6aa9351e7d87421f64573a0b1db5b400b0c2c2686097625070e5f1113d72426
-    .claude/skills/git-workflow/references/sources.md: sha256:186c6fec31bcefe10bf4409d8ef9b6fdfff6185b431f30c66712d0669df0be55
-    .claude/skills/git-worktrees/README.md: sha256:084c936cf0aa2fc808e5fcf8acaec148d93d8ac03a99a6f3d06137adcc14585c
-    .claude/skills/git-worktrees/SKILL.md: sha256:2ea1122b4f8bc864a85248bde6983a930ad3f91b60286a761cb0de361b25183f
-    .claude/skills/git-worktrees/references/README.md: sha256:ea2f3249fe0d0af24fa91f4d050f2aead9fc84841333530bce0ddfc7378d56c5
-    .claude/skills/git-worktrees/references/sources.md: sha256:5b7fe81f56eb03360a4719f2a988674f43891f7a2bfc14756d68398088767e36
-    .claude/skills/git-worktrees/references/worktrees.md: sha256:38999d4d07d85c6142495c3765d56a0b5fdf861487a9347317f6b054a7d3dbc8
-    .claude/skills/pc-author/README.md: sha256:2e21bd50002bd2622ebb31793fa4aece14f5233889c3a054fe99f1974f19bb40
-    .claude/skills/pc-author/SKILL.md: sha256:577b9bd06615182ce3b0123640d989c3b74ab05bda8103a63a41e1f5a1abb2ec
-    .claude/skills/pc-author/references/README.md: sha256:c409caf0e08af23f2ec056b649cee0bba22b55c1fbe4b8f1189ce0bbb9b5d5c4
-    .claude/skills/pc-author/references/hooks-by-language.md: sha256:2c4ade2ac32e7a9c539d7e08b7d55739e8d87c634860bb58e8764067293bb35d
-    .claude/skills/pc-author/references/sources.md: sha256:e1cff11955490e4948fec81d8172b0adc5a37829aa0ffe1791c0f6313ed34a4e
-    .claude/skills/pc-run/README.md: sha256:2e2ebd5220c3251a40afa6c06243ba12fb0aa03dc60fb76db74b22c44914f353
-    .claude/skills/pc-run/SKILL.md: sha256:7a0890f7447a04f464ca8a30e5a967ec4421e9ef41298d469f8f2a6ba03be0a2
-    .claude/skills/pc-run/references/README.md: sha256:ad42b9013dbd44b8c4515c15317c5e9e6b235bc656ad5a03e037eb4bc6f8782c
-    .claude/skills/pc-run/references/failure-patterns.md: sha256:59d913c001483c3770d269fdf5e83cf1d7578e0ae879928a1404bf93bb395994
-    .claude/skills/pc-run/references/sources.md: sha256:7ca8b7106e7ee5c2c7d1fbd3dc9e0d2a89c18eba79145cbab55bc8e39eef9087
-  content_hash: sha256:8c47bd35572c331f1a1b61a8be159d9690a1bf286958a85826fde01939e3007b
+    .claude/agents/git-orchestrate.md: sha256:8b1b6826bad87b816ea78fc6bdb5aa9c750d542c6266fc3ee3225336450de16f
+    .claude/skills/git-branches/README.md: sha256:72ff2e422f39c306fa53eb65c73761f48405cdbd42a3eb98d48c304318c9aa3f
+    .claude/skills/git-branches/SKILL.md: sha256:3a0bcc9a0fce6d0789466a798161743d54d4251b7a4256b87a7cd9d3c0f5b458
+    .claude/skills/git-branches/references/branch-operations.md: sha256:c682142f969e943bae3a05cef24ce9661a4b36861da3b115cf07d762ebed4933
+    .claude/skills/git-branches/references/branch-patterns.md: sha256:1fdc2cc86634f45d48a3fc4326eec81e1331cef0f8406639f2a712ead2eb5f7b
+    .claude/skills/git-branches/references/comparing-branches.md: sha256:38f22b0324981a0ad60d29b336e0824b63b1108863fb3e9870f1d93e32f09d82
+    .claude/skills/git-branches/references/merging.md: sha256:d144c237e7a8a1e709444af9e16c4d7804ba9f53fcae2326249d98885c48716e
+    .claude/skills/git-branches/references/orchestrator-contract.md: sha256:d4f5c6517acbe784133c174c076e57348921a3fc5aa12b11bb6cf13b30e087b9
+    .claude/skills/git-branches/references/sources.md: sha256:9043d5c90381900dcf7ad6b55b4a73ffee62e3ca6d23f1f89708de635e37534a
+    .claude/skills/git-commits/README.md: sha256:f4d2b60926e50a45dbf5621dbd62fb1239a4f3da1163402f7e1a82f0a8a8b568
+    .claude/skills/git-commits/SKILL.md: sha256:1658a63bc3209993580982c0aa7cbd2656a1d2b3519f2c421c65bf929c65ccfd
+    .claude/skills/git-commits/references/cherry-pick.md: sha256:1d8a89adbdaa37b4fdf8f2aed6b78e6767df5b46f97f083a0bd71288dfb7e1d9
+    .claude/skills/git-commits/references/commit-template.md: sha256:50869213d35b563f2b03d2d3782067842a239d378badab55de3cac5492227f09
+    .claude/skills/git-commits/references/conventional-commits-spec.md: sha256:105175ba8244cd52096fde3746b4b671a82ba0337c7894dbc68a7d6a37646bc6
+    .claude/skills/git-commits/references/create-commit.md: sha256:ac07f0c608b5388d6780b4ab353fb76974d8672423a2f3b6d80c69e8dbdbab4f
+    .claude/skills/git-commits/references/rewrite-history.md: sha256:99fb88d022bbae4d1c1b84642d590439fe3142881821a99ed856aaeca43b699c
+    .claude/skills/git-commits/references/sources.md: sha256:215814371e0a83e7231989cfaf095b6ac9fceda124ad17f0490e7ee615764523
+    .claude/skills/git-history/README.md: sha256:6219a74783b28e6005c0a69ad92f9a179c9bda3b911bb1790d15d690d3c5de6e
+    .claude/skills/git-history/SKILL.md: sha256:dc117941d49c152e3d7e14f6e0595c308ab24378a24ff472a3f4ed98c003eb6f
+    .claude/skills/git-history/references/README.md: sha256:218187f9372a4027f6189420384dece791af74353adc9ea5b143e37c9ca3df5f
+    .claude/skills/git-history/references/bisect.md: sha256:75606d95ff592085b4bf35d09361ebbfcb8f3ba195a3f7d89aff187b99789a3b
+    .claude/skills/git-history/references/git-log-format.md: sha256:b17f36967c32b761a423bb14b900451208daa3be2dc6cba8709a6b60ad9b90fd
+    .claude/skills/git-history/references/sources.md: sha256:5a0d78e0f3f301dda18e5198dfd5552e90a7250ae14113a8c2d86de68beb3ad8
+    .claude/skills/git-remotes/README.md: sha256:945896f6861c77259de0b5318b36c206f54e8b6ba70848d2b65847b64f3b142d
+    .claude/skills/git-remotes/SKILL.md: sha256:88661a769ebb3d3b2bc64b58f11b2ff1c991ab6bc85e6f59c46e9472fe018598
+    .claude/skills/git-remotes/references/README.md: sha256:530122741ff0638ca80500b1b376c284238589ec95d5f33437c840aa197e18b9
+    .claude/skills/git-remotes/references/fetch.md: sha256:150c68ef952fafb02f12f1506bfabc5d1fe3b7fc1fcd5df0379943597f808b3a
+    .claude/skills/git-remotes/references/pull.md: sha256:c06eda4c8090fb07d4b788f8fe2b6efdb0b0ab8c27eaafe8b077745997a22962
+    .claude/skills/git-remotes/references/push.md: sha256:880e630792494ce4fab52e7965d548df7bfeaf2a8ba0a4ee775a1299810002b3
+    .claude/skills/git-remotes/references/remote-config.md: sha256:779458aefcc932b90567b119b677789c2010e12eb38c5ad52f1be2e822c55019
+    .claude/skills/git-remotes/references/sources.md: sha256:ab4bbb3234eca2f2e71700d83d148dba44b741b7f0515ffe051380a43a0f7c84
+    .claude/skills/git-submodules/README.md: sha256:8589e78051a811055b382790252f13a00bd0008ebc220cf023efb05d0d12bd77
+    .claude/skills/git-submodules/SKILL.md: sha256:ef16cfa16b916423e1d5855587403788b4034166318525adcd5dc1ea23cb0bcf
+    .claude/skills/git-submodules/references/README.md: sha256:217eeefcb78dc9f48e351e9bed4776c54220564f09888b137c1adbe5d5342971
+    .claude/skills/git-submodules/references/removal.md: sha256:604d76043ca8644e9425d46593be3267ba3f54e36cfbd454570ef5a9ac962ea8
+    .claude/skills/git-submodules/references/setup-and-update.md: sha256:7f03634a15736deac462cd21335f8bda7d2662f36d91a7127ad6b7105361021e
+    .claude/skills/git-submodules/references/sources.md: sha256:17187d35af6f6f2dc6515f661f291525cdc7383c731d0547e12521f744c2e604
+    .claude/skills/git-submodules/references/urls-and-config.md: sha256:b1269515cf549d52fcf122cc5cdb6fbb56bc4ea974e77d36eef063aa86c7cbec
+    .claude/skills/git-workflow/README.md: sha256:cc96c23118e821a2e9ab1f6370484ea5cc97f3a0fd285c1b7f3782f0de62117c
+    .claude/skills/git-workflow/SKILL.md: sha256:06c737da977e4a624a1100fdc502d2e250692cd9f870a7bc3eefac5835c511ef
+    .claude/skills/git-workflow/references/README.md: sha256:27f978e69d5ffbcdd99c28ff42361da7824e7466b6a34cbf7c4b0feceb16f1ae
+    .claude/skills/git-workflow/references/hard-rules.md: sha256:7c7a6888527a3925333e0d44129de819d8c5e5161ae1de8551b2f1536d3b2ff2
+    .claude/skills/git-workflow/references/sources.md: sha256:e8078edd12bdbe0c81a7796f330ae2a06d78129ff20038c6bf98a8e638860786
+    .claude/skills/git-worktrees/README.md: sha256:eeec5c51f9e0353b9cfcfd3b7309ac23d0fb3a1fdacb9006d6d2fc1c0ef099dc
+    .claude/skills/git-worktrees/SKILL.md: sha256:4758187c798ddb90ebc3e18e76021159aaa857bc3cdd7f8b211a2d6f616db6bd
+    .claude/skills/git-worktrees/references/README.md: sha256:0778b6c81f7e77c84476fd966195b19f7b1c4553d35f5ffa016f72405c943c29
+    .claude/skills/git-worktrees/references/sources.md: sha256:f4264a817836959685bfc286209d997295bb964524ba4e17027c39f25c3bccfd
+    .claude/skills/git-worktrees/references/worktrees.md: sha256:655fc3e9848e58a4c996efdd2fa1a90f43cec22a455ddb678959f347d2bc4ef0
+    .claude/skills/pc-author/README.md: sha256:f363d981e55aa3aafdacb6242ce971c0afbea36c7f2d9ce0dce88dab9c476aeb
+    .claude/skills/pc-author/SKILL.md: sha256:a7a9a34a5efa4a0ec9f73cd2bc626d08dd0c2130f9ffc219e7bdd230eab717ff
+    .claude/skills/pc-author/references/README.md: sha256:8fc13224aa64f5931a4f3e06198f67ed621066a69384b95c61ad91d08e86e602
+    .claude/skills/pc-author/references/create-config.md: sha256:6f52e367de858739fe87e67c1f7c6fbc21c79650ad14289441d2d13884deaee2
+    .claude/skills/pc-author/references/hooks-by-language.md: sha256:9d585293c8801dd41a0f1842e5ac495be4552fc188c564bb074cb9244a189e19
+    .claude/skills/pc-author/references/modify-config.md: sha256:7f1c90805e0467e857c67ae20fbb5968136c1e4c703076f2b2cd599990a71216
+    .claude/skills/pc-author/references/sources.md: sha256:5546cccd0bf7e725e97de29c96da128a8e39ef1a23102ecd668018c74c30a4cb
+    .claude/skills/pc-run/README.md: sha256:dab1352741c11f8892720f352d38fdf7e501a416d9219d604476185aa3dc0e69
+    .claude/skills/pc-run/SKILL.md: sha256:3f8b75868ff9b8d7b79136c4b02c46cc2719dfb778c1bd2bb8115a2d76e6f95d
+    .claude/skills/pc-run/references/README.md: sha256:913f47285687f72716b95cb33a2036327fb4335c4d935aa5cfc2bc043b639773
+    .claude/skills/pc-run/references/autoupdate.md: sha256:e0c3c53f8dfb2f1cccaaa38e7902f5b7196a128c41cdd7dfc4e95a5da6fecd9a
+    .claude/skills/pc-run/references/clean.md: sha256:49a66a985c5adfabc876da4e0a2355fa8c22cbcbfbd7548e4b154b094080d87a
+    .claude/skills/pc-run/references/failure-patterns.md: sha256:c4ebaec91cbbfdb15cce5601b0e86e8556345ec34de9846e0f66c628be06836a
+    .claude/skills/pc-run/references/install.md: sha256:71ec08d58b8797b09574a827ea06d2c9656e3394d40534860fdaf333f5c19070
+    .claude/skills/pc-run/references/sources.md: sha256:f23b3f50045bcff9644019c629451ffc90fe9fabf8dbfd3011c16ef011e48aab
+  content_hash: sha256:0210ee4fb9b5b2eaf2695a52dc8681d267245a6e89fa547021bb9292c721982a
   declared_license: MIT
 - repo_url: Defame1297/holocron
   name: gitea
   host: git.dev.rkdr.net
-  resolved_commit: 0e91a3ae66d1b0439b9c0ef4b6e88ca6f2659473
-  version: 1.3.6
+  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  version: 1.3.7
   virtual_path: plugins/gitea
   is_virtual: true
   package_type: marketplace_plugin
@@ -257,8 +323,9 @@ dependencies:
   - .claude/skills/gitea-files
   - .claude/skills/gitea-files/README.md
   - .claude/skills/gitea-files/SKILL.md
-  - .claude/skills/gitea-files/references/examples.md
+  - .claude/skills/gitea-files/references/reading.md
   - .claude/skills/gitea-files/references/sources.md
+  - .claude/skills/gitea-files/references/writing.md
   - .claude/skills/gitea-issues
   - .claude/skills/gitea-issues/README.md
   - .claude/skills/gitea-issues/SKILL.md
@@ -289,51 +356,58 @@ dependencies:
   - .claude/skills/gitea-workflow
   - .claude/skills/gitea-workflow/README.md
   - .claude/skills/gitea-workflow/SKILL.md
+  - .claude/skills/gitea-workflow/references/number-resolution.md
+  - .claude/skills/gitea-workflow/references/skill-index.md
   - .claude/skills/gitea-workflow/references/sources.md
+  - .claude/skills/gitea-workflow/references/status-checkin.md
   deployed_file_hashes:
-    .claude/agents/gitea-orchestrate.md: sha256:c281972b9c738e35528f9478ee76dc326d2f113312dacc7fd87991f0cd8cc825
-    .claude/skills/gitea-branches/README.md: sha256:ce7bff9d60a3edd4655af9b4f3bb51520ffc2ff2a90f98f55e29a1b72dc5e3ee
-    .claude/skills/gitea-branches/SKILL.md: sha256:0d8a1ac2e450d60c123ae1538dc8cca49b270da410d2e031cf250cdded2bf839
-    .claude/skills/gitea-branches/references/branches.md: sha256:f045fb181d2fc1c948a2e026c335453273931f3a8d710a45b05826547ffe89e2
-    .claude/skills/gitea-branches/references/commits.md: sha256:ca70a1c32ff6abf296a027c27c678f1574eddfdc069d7ed4ae621524dcd9adc0
-    .claude/skills/gitea-branches/references/sources.md: sha256:1bfad24252356c6005935ccc10a87871709d4b41e6b2d69abe9ac7ab188f4bcd
-    .claude/skills/gitea-files/README.md: sha256:f9d721b7ed8eae43b5eab04324dbc96fa91964accc77ea74d1b889475592256f
-    .claude/skills/gitea-files/SKILL.md: sha256:9362d82068257d0aee113fd55f2acf4d53e8d20f638453946b76384a8c49a9b7
-    .claude/skills/gitea-files/references/examples.md: sha256:26209f202dd0ec12c73bb62984f9fe42c843e2819dab89752fdf478444a5d79f
-    .claude/skills/gitea-files/references/sources.md: sha256:71981b2987c56589e469f2305afbf7d404e605c8db1a6d50c1576d50eb9eea9c
-    .claude/skills/gitea-issues/README.md: sha256:2f5844cf2fde1a62844eb26ac19f915f50fe8fdc5bfde982be018ed2d0e15c30
-    .claude/skills/gitea-issues/SKILL.md: sha256:9084c5f37d23ebcc6de5940ad8fcc1c699aa7d4693623bf029a031b21412e7d6
-    .claude/skills/gitea-issues/references/enrichments.md: sha256:024872fe787688f7ff51c856264bd3405208543fcbccd113cce464135dbc9f90
-    .claude/skills/gitea-issues/references/issues.md: sha256:5c8103944f316f7681ee2b3d5ebbc55dc73a2f5a25616325c87af03b93944a04
-    .claude/skills/gitea-issues/references/search.md: sha256:dec2a98a9d781122d235b8a3fa6cd9efdcc08be0a2b71eb29f90a6e14338c0af
-    .claude/skills/gitea-issues/references/sources.md: sha256:86d5c500e103d5eea31595ab04fb79d9e908215d83d2f0edec1e0e73995d2e96
-    .claude/skills/gitea-labels-milestones/README.md: sha256:185dd654d9d775fe0b0464a0dbdf724b06f6375fa6d7c7e200ee826fdcc9b4b5
-    .claude/skills/gitea-labels-milestones/SKILL.md: sha256:ce07c4c8827747b13b3d9ea9d20f8318ace0803f2bd42804e717ed9201c54254
-    .claude/skills/gitea-labels-milestones/references/label-inference.md: sha256:da141129c74d22a441303b910b68d5bb758435361efbd8d2669f46920d699361
-    .claude/skills/gitea-labels-milestones/references/labels.md: sha256:be8ff5ce4dbfb31dd2bdcc425a769dca94887c5c8acd47c78e1e21ccfc24dcba
-    .claude/skills/gitea-labels-milestones/references/milestones.md: sha256:ff1f1b0c8ecb6967c940d1ca8bebf2a2c7995414936f8ac7f5ff23d1dc01ac3f
-    .claude/skills/gitea-labels-milestones/references/sources.md: sha256:a1a1d3381dfb0dc8f331be0b3ab49f28e94b992fb4809ca09be91ce33047dd1e
-    .claude/skills/gitea-prs/README.md: sha256:31b6ad46379feee8ac7d837030f93ec04be20b7d11021b295dc6d27b4340a05b
-    .claude/skills/gitea-prs/SKILL.md: sha256:bf70832f3d97064c9816d680390da84c256a971d7804317e1814b4ee6a622b4d
+    .claude/agents/gitea-orchestrate.md: sha256:57075f127535b201cc6e153d5817ab57d5f9c80dc22c7759092ecb0f0028c0c7
+    .claude/skills/gitea-branches/README.md: sha256:2f9a0f16351c8b2d6dbb71724d372bb9c267b345b12948ecf840fe4f21faf650
+    .claude/skills/gitea-branches/SKILL.md: sha256:1ac80735b5bccf47b7faaba7d077e6c48c9c43970fc9307104b8986efab90934
+    .claude/skills/gitea-branches/references/branches.md: sha256:cfc3323175ff56d155b57a65194dfa32459a5a1a4f1b266bb62e05449e39a27b
+    .claude/skills/gitea-branches/references/commits.md: sha256:7ded733117e3bf8c1a5bba54786197ad72aa9f743d27afafd8c36242ab7b0ce3
+    .claude/skills/gitea-branches/references/sources.md: sha256:f206f9ac91146771539cbf288e73d1202d22f05414d9d1806d0dcf5c7ad02152
+    .claude/skills/gitea-files/README.md: sha256:2b9bfafdab57af61f3330fdb37070c3d301ee73c6631fde9cb36cdf28e88c466
+    .claude/skills/gitea-files/SKILL.md: sha256:808612acc0c28fde06cdecefa1d0d413129c7110059041616bc642ea596068c3
+    .claude/skills/gitea-files/references/reading.md: sha256:93a5d8dd909ffdbf2bac09fbe7d819bd8fe26979808c5f5bf8ca5dcce435c752
+    .claude/skills/gitea-files/references/sources.md: sha256:4fbd03f275fb72899fc4489737f13074dfb61704965bd2bd52a372deff426fbb
+    .claude/skills/gitea-files/references/writing.md: sha256:3a5b0b5043fef2c55a0b009a6bf7998a45c3e5770f8b7ac11abd4a1e7b6b351e
+    .claude/skills/gitea-issues/README.md: sha256:b2781529ea793022765dd4aa96faf5d3dcdaeb088c710b14201a4e73bb1cc580
+    .claude/skills/gitea-issues/SKILL.md: sha256:2b776f204579142e27885a9d6f4456076bf2262d785016c46a973afef44797b6
+    .claude/skills/gitea-issues/references/enrichments.md: sha256:1daa0758116e818f12f89fa43b031d9cd2518f73de95bc54d94d5536667b68e9
+    .claude/skills/gitea-issues/references/issues.md: sha256:7a1c4c42413df84645fbea70b29b2dcd732f52bfee259b2e28506dc101eed9f5
+    .claude/skills/gitea-issues/references/search.md: sha256:651a4493b166a498932bd0902d16efde273c49c6fc597bfb0e1b1c0296f7a742
+    .claude/skills/gitea-issues/references/sources.md: sha256:d6d358029298537db4d13dea84ee274006bce3e7f99b1aaed963d8703cba2250
+    .claude/skills/gitea-labels-milestones/README.md: sha256:4606f16d1639f0a2fe46fcb341a54b673b0bbaeef12c197e2022bdf57b479c37
+    .claude/skills/gitea-labels-milestones/SKILL.md: sha256:52aec1a75050b46e3c386eb20454c7a9bddf9bde9a38ab3331a9b06d2e0f5302
+    .claude/skills/gitea-labels-milestones/references/label-inference.md: sha256:9aa51cc751f692932b5eecee698eba6eaa3e9f13e423e0fd3b13ffecaf26fc0e
+    .claude/skills/gitea-labels-milestones/references/labels.md: sha256:365730208ccbdf0f8fe3b2b49c1539208811029e3c343edcbe39b674a46a0527
+    .claude/skills/gitea-labels-milestones/references/milestones.md: sha256:0b26f006cfb154d13b2a2fbf356b74f6339e7ab9c34041d50ade676f6c2d17d8
+    .claude/skills/gitea-labels-milestones/references/sources.md: sha256:b0a1c8cb678e21cf284e4efa5b75a2414c76a8e3898c449e8b60504d1d465bd5
+    .claude/skills/gitea-prs/README.md: sha256:c8c11f5e3cfa7768fe3dfabf935564e5b08d1f7f6629d1dc2149c28b3b8e8ec0
+    .claude/skills/gitea-prs/SKILL.md: sha256:ec4b0c38a70cdcaf374ff92a706fcac151dc7b8e358dac36bd202ee3444ea799
     .claude/skills/gitea-prs/references/merging.md: sha256:5f8b55b1a729f122ee265fb5da69369fc27434a13dd02fc112801f945d2c9d19
-    .claude/skills/gitea-prs/references/pull-requests.md: sha256:d6cefd0cf270f8d844536311e67bfa45cd07f024aa0a649de1938af306ae7109
-    .claude/skills/gitea-prs/references/reviews.md: sha256:1089cf45a75a562bbb29de6538848c4f4bd627d5a7e36bf9b2ab6496f45f962b
-    .claude/skills/gitea-prs/references/sources.md: sha256:ac48a3018443b56acb5c3d55d6c04e62103f5bac71b8185e2bd085fb7e165431
-    .claude/skills/gitea-releases/README.md: sha256:102625066c34c7b5a16e25b7506a87f876e9b123b334f5ffba73ab1523a57ed7
-    .claude/skills/gitea-releases/SKILL.md: sha256:793a6936c0d56acb4b4aba1d72e1fc91690273df0aafe447e54cb53df00319c1
-    .claude/skills/gitea-releases/references/call-signatures.md: sha256:a523dba171d67a7e7899b7d8ecfe9220f250da2c184b0f2806e5d22647b1ffb0
-    .claude/skills/gitea-releases/references/conventions.md: sha256:1c8102ed489422706babea4e43e12dc7684b7dacd210fa29b3793bffa9cd9f64
-    .claude/skills/gitea-releases/references/sources.md: sha256:37a14495c461120a5bab0013531c9e83e7d9b670e78129a9439a81b48a64cce4
-    .claude/skills/gitea-workflow/README.md: sha256:338f79d0b3c25741848fce841a5094ef27cbc7e4a6228404557b2d9594df68fa
-    .claude/skills/gitea-workflow/SKILL.md: sha256:a8266ceb335c56eb68cc09b3f81690c52c4dada9f25b48c3a46ac46b0ad3b761
-    .claude/skills/gitea-workflow/references/sources.md: sha256:171d3a5a36cb9d637302516501a1e9fc7a4bd058968dc9244412c335aa2de68b
-  content_hash: sha256:16d5b4462c3f4a506c1c74172d4d67bf0dacc4218676de4e8dfe551b2f31a3f8
+    .claude/skills/gitea-prs/references/pull-requests.md: sha256:6f4b9de079ebe248282243a2920016bfb172d4115ad712feb1757bb57d5eec3e
+    .claude/skills/gitea-prs/references/reviews.md: sha256:97cef439e20595ab90cfa0105cff3ef39a53989172a9c0603374d16498f426b5
+    .claude/skills/gitea-prs/references/sources.md: sha256:e2c2792013550f99281f517310bd76d2e5d56751ace6da117ce602048d5342c5
+    .claude/skills/gitea-releases/README.md: sha256:e5d2dd0748990c1d99f2065c97c275bb14eb4fb447c94e76c332bc5952fadb99
+    .claude/skills/gitea-releases/SKILL.md: sha256:f3b9e867abf0fe3be88dc34242b18d96bd0f361252d7472ecacdd310689d36e0
+    .claude/skills/gitea-releases/references/call-signatures.md: sha256:1f7b40c390a5d032f8a00609194d8ce2107ac06d420b56d316837a6ec7dda982
+    .claude/skills/gitea-releases/references/conventions.md: sha256:2a5613796701d0e27eaec1f71a1dc12f5fd5c2861ea001689d057da8c830cfba
+    .claude/skills/gitea-releases/references/sources.md: sha256:30c43a93f4d7ea05ef3d013a68f8656317ef6cef6773ce9944d35b24a93bdc80
+    .claude/skills/gitea-workflow/README.md: sha256:508d49159db9b70bc4e1c8f0a440ec4c88b9941b4a83a60e1c2e9e286c0d0621
+    .claude/skills/gitea-workflow/SKILL.md: sha256:93b64305f9232feae4c39aff33ebf8ca0ea9599b24cab0d838553868dd9a699e
+    .claude/skills/gitea-workflow/references/number-resolution.md: sha256:0242430246fd572e4e0c3715d557e425cd7d3260bba76f56856255b340184c3f
+    .claude/skills/gitea-workflow/references/skill-index.md: sha256:b53d8148ea8cf6e4cabd15cab39f60b98167d930f590ca0fdcb5f2f3969edc5e
+    .claude/skills/gitea-workflow/references/sources.md: sha256:21305440e8060adbdf5af2b946d2e173ad35f8326dd9e24cd1f769fefde92f7f
+    .claude/skills/gitea-workflow/references/status-checkin.md: sha256:c6da98ecbe1d2919222bfb856cf10c3fb9971423e1eb6590a15f6fc7550f102d
+  content_hash: sha256:f306f493e32600c8d1bc2884125e1e455cdc5d4322300f5c3a17c855f81e001f
   declared_license: MIT
 - repo_url: Defame1297/holocron
   name: kyberforge
   host: git.dev.rkdr.net
-  resolved_commit: 0e91a3ae66d1b0439b9c0ef4b6e88ca6f2659473
-  version: 1.6.0
+  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  version: 1.6.1
   virtual_path: plugins/kyberforge
   is_virtual: true
   package_type: marketplace_plugin
@@ -354,6 +428,7 @@ dependencies:
   - .claude/skills/agent-audit/references/body-and-delegation.md
   - .claude/skills/agent-audit/references/description-quality.md
   - .claude/skills/agent-audit/references/field-inventory.md
+  - .claude/skills/agent-audit/references/finding-criteria.md
   - .claude/skills/agent-audit/references/scope-plugin-apm.md
   - .claude/skills/agent-audit/references/scope-project-user.md
   - .claude/skills/agent-audit/references/sources.md
@@ -396,7 +471,10 @@ dependencies:
   - .claude/skills/forge
   - .claude/skills/forge/README.md
   - .claude/skills/forge/SKILL.md
+  - .claude/skills/forge/references/apm-routes.md
+  - .claude/skills/forge/references/author-routes.md
   - .claude/skills/forge/references/sources.md
+  - .claude/skills/forge/references/version-bump.md
   - .claude/skills/skill-audit
   - .claude/skills/skill-audit/README.md
   - .claude/skills/skill-audit/SKILL.md
@@ -409,6 +487,7 @@ dependencies:
   - .claude/skills/skill-audit/references/body-discipline.md
   - .claude/skills/skill-audit/references/description-quality.md
   - .claude/skills/skill-audit/references/file-structure.md
+  - .claude/skills/skill-audit/references/finding-criteria.md
   - .claude/skills/skill-audit/references/formatting-and-scripts.md
   - .claude/skills/skill-audit/references/patterns.md
   - .claude/skills/skill-audit/references/sources.md
@@ -435,10 +514,10 @@ dependencies:
   - .claude/skills/skill-author/references/sources.md
   - .claude/skills/skill-author/scripts/new-skill.sh
   deployed_file_hashes:
-    .claude/agents/apm-orchestrate.md: sha256:fbb78f7c8c58b018639e7a39f2f1b3ce2adcd6bed277b3c8f8cd70893698ec73
+    .claude/agents/apm-orchestrate.md: sha256:7c4b7efb58ecdd26fea835613d0f7f909706607cac4f002a0df2db2a3a0ee477
     .claude/hooks/kyberforge/.apm/hooks/check-apm-current.sh: sha256:96f44d63b5f4906ac1add5c32b718176ec10c8514615151d7303d9845c607b46
-    .claude/skills/agent-audit/README.md: sha256:fafdb84bf258f6d606c97b785c7c378b5de805f0aa8a10d3cedefedb000e4230
-    .claude/skills/agent-audit/SKILL.md: sha256:a126a2a7b1b8c9f6b39272584e2f84577aeeb8c81707be6f151b3acbe35ecf51
+    .claude/skills/agent-audit/README.md: sha256:c2f1fca5e0c8c713904d82888691efa605670dc08a03aed5c8233a7f26cf7d53
+    .claude/skills/agent-audit/SKILL.md: sha256:1fa16e4cb540283d2da0d17585df821963a72dc0a0235f134205c54805d95f03
     .claude/skills/agent-audit/assets/vale/.vale.ini: sha256:d643677585c603edcc8816b15d9c85c81b677ded02247b521ba8b88ae5bfdf57
     .claude/skills/agent-audit/assets/vale/styles/Kyberforge/CompositionNote.yml: sha256:e0a52fb9ff65aee9d21d1f7b61bef0f71d14b8edd9af1d70246715bbb8844ccf
     .claude/skills/agent-audit/assets/vale/styles/Kyberforge/DescriptionOpener.yml: sha256:60984e0af965137a151a07875f388c94ea2da93d4ee4f2b92811bd14105527f2
@@ -446,18 +525,19 @@ dependencies:
     .claude/skills/agent-audit/assets/vale/styles/Kyberforge/SentenceOpenerThereIs.yml: sha256:5dade0238d96730d24bb6e8dba003c3d94694bd9969687f461fe1fada3ca4629
     .claude/skills/agent-audit/assets/vale/styles/Kyberforge/VagueWording.yml: sha256:d4bf14d0bb2dcbe3a89b66b72a9c9c19d175060b5c4c978da3d67010f1a25083
     .claude/skills/agent-audit/assets/vale/styles/KyberforgeCopilot/ProactivePhrase.yml: sha256:ba4f91479f66f9f03c74f791cbc6130b24bbc31a25f3897b424f72d02473b9b4
-    .claude/skills/agent-audit/references/README.md: sha256:f6d777f7d3844d1be847f86f67b08c2db37b2d122e0bf1af92ef057bbfdd1004
-    .claude/skills/agent-audit/references/body-and-delegation.md: sha256:788664bb75364354773bd9efd4a0f84a231009d3a8b080e2561fefff2aa95b69
-    .claude/skills/agent-audit/references/description-quality.md: sha256:15eea332149203ac18c6b3eee98f0078e8a764cdb91b3158590f45204cb3322a
-    .claude/skills/agent-audit/references/field-inventory.md: sha256:e9abd738c08890994441d215eba96f894e00992cb7bb5ce850796186050aa1ae
+    .claude/skills/agent-audit/references/README.md: sha256:9d2acf43aa4e8b2b71c99224d1ea8c7c2ff4d27d7c6982175bf1a52ceffd7be8
+    .claude/skills/agent-audit/references/body-and-delegation.md: sha256:e559a185e3de779ce599ba6ccbad316df43f158a9f002bbc88828eeba748066a
+    .claude/skills/agent-audit/references/description-quality.md: sha256:89572997ca01df1c526759fe5d324c3ebbbee314172849d82caef16c4992a4d3
+    .claude/skills/agent-audit/references/field-inventory.md: sha256:24feb0d25dd85c4fbd4558fbca78bd66974a8fc5be2d5c952c7a8ed7168f7d65
+    .claude/skills/agent-audit/references/finding-criteria.md: sha256:c18934428215154daf5543f4e8e40ca55c9833125e8b29feca513f99376c5663
     .claude/skills/agent-audit/references/scope-plugin-apm.md: sha256:af32acf33aec0cd0a98022ee6796265066c693662e8874a8e4d7e03ce1657c88
     .claude/skills/agent-audit/references/scope-project-user.md: sha256:9ea0d4014d78a6b02c760e42fb6cb72b3441ae6c93991fdeca666857bad05056
-    .claude/skills/agent-audit/references/sources.md: sha256:235de49e805d83ba19f8ecdc90da2f7d3b02c5f1c2fc54179d6bdd5bc398743e
-    .claude/skills/agent-audit/references/validation-scripts.md: sha256:7eb48ec40175d6cce2b3b9602c0d9e60d62bacca1df7cc120c138ea1ce328666
+    .claude/skills/agent-audit/references/sources.md: sha256:86f93524eae02c06be01e9feb3b751805b4f6a7da824e242693d588496c9e490
+    .claude/skills/agent-audit/references/validation-scripts.md: sha256:99c6d23a1d45184f1b2265dae31f66392defa094522d1f199187d172cbf306ea
     .claude/skills/agent-audit/scripts/README.md: sha256:ee427eed6a562a6e86898c69c35508c518d5b3c633ae803e587fbab37514f2b2
     .claude/skills/agent-audit/scripts/vale-wrap.sh: sha256:c17673b3b0de1c1a49fcb73e2b695835a45014ec1c300a77a3ba7b3c7ce4c995
-    .claude/skills/agent-audit/scripts/validate-provenance.sh: sha256:0e1d2b3bb1abb9f302ed84a618246ebaa7d5f7fda727b290d323e70dcc26a323
-    .claude/skills/agent-audit/scripts/validate.sh: sha256:50c6d3875fd44901fba3fcb69256f616be19521ee8209b7132778c1d4a693a3f
+    .claude/skills/agent-audit/scripts/validate-provenance.sh: sha256:197a9bef1a58fa2457a4ae0b802c7b362911e26cec0a5f0194840c95500057a4
+    .claude/skills/agent-audit/scripts/validate.sh: sha256:aa21b99ebc6bcd845066113d74e39d86c8c2858067edfe855d03cbf42531150b
     .claude/skills/agent-author/README.md: sha256:b2d14a3c8fc3ddc3935d0bd1765192b333b944baaf9bfa9a350bef0985890265
     .claude/skills/agent-author/SKILL.md: sha256:8fe96e4744378cd33876cf87a08a20af001898e89f0f27087044e1b87eac61f2
     .claude/skills/agent-author/assets/README.md: sha256:730b2321b5f16dcc63fc5dc842618c116afc75217ae925057dafc490e7d57644
@@ -465,7 +545,7 @@ dependencies:
     .claude/skills/agent-author/assets/templates/claude-code.md: sha256:ea0bac6e8cd91c767c6114cbcf1ecd124d03abff06ba81696dac5115499c395a
     .claude/skills/agent-author/assets/templates/copilot.agent.md.template: sha256:ee8b7585c808c5ff4b715be74d9e4f8c5c17d13cd603a8727cd8ca1793d14760
     .claude/skills/agent-author/references/README.md: sha256:aca156b02a3f0b9fddde3cefdb24370e17cc5886dcd78adcb382699a5cc0bbaf
-    .claude/skills/agent-author/references/contract.md: sha256:a96f0ef021a6629120e5af7c98fa483d31de92cea37f98b51528a28dee38e16a
+    .claude/skills/agent-author/references/contract.md: sha256:d862636a23c6d64026982727588db1582499b72c774ca429578a57321fa89e19
     .claude/skills/agent-author/references/create.md: sha256:e4a1b95970ec44d551a4b0598f2fe01463db13a6b118981d8cd03dfc7e24f451
     .claude/skills/agent-author/references/deployment-modes.md: sha256:5675f8dcd1523269d5c65be5b0e06ff4d822b158050e2fdd72b54f605485ab1f
     .claude/skills/agent-author/references/improve.md: sha256:f260e91f28bbd62093b53f4efc05821eff00d086f834ddb083b70dd77ddffcaa
@@ -475,38 +555,42 @@ dependencies:
     .claude/skills/agent-author/references/sources.md: sha256:cac8baf85a6d958ed2f0f882446dc123d14082d5ca412c8edee12c6cd1b6fdc3
     .claude/skills/agent-author/scripts/README.md: sha256:e8ea2f3391ca297afeda03911768000617a71df0cf9d673bbb260ee5bbfed7c2
     .claude/skills/agent-author/scripts/new-agent.sh: sha256:1c631f5178c6c0c397d7ceefb606892dd7e330cd1b22a03c1e4d11e85fbdb7de
-    .claude/skills/apm-install/README.md: sha256:d7bd79ee27997fffb5765c03358a700d8c00266ea120f6d067d74300d6c26eb0
-    .claude/skills/apm-install/SKILL.md: sha256:4c0db5454bcbf895a89e7405eeefb4521a2b23f2ff28aa96c82c59708d8819ee
+    .claude/skills/apm-install/README.md: sha256:f48ca12116d20584fd4582d3ba44a9f02cddab2ae2f12c41abfc3455b4640203
+    .claude/skills/apm-install/SKILL.md: sha256:ee0877665f2fd9ff4e764b7957ebb9b6f6006ffabc254cba8c2ecfeaf9848278
     .claude/skills/apm-install/references/sources.md: sha256:b80245ff8ae179d458572cb9b03621d00bf7e2f052f0cd71b88112c0ea8a91ce
-    .claude/skills/apm-workflow/README.md: sha256:40e85d2c2a7487b54c7797fb135b979b8df14b524928da8c7502723a0fc8d36a
-    .claude/skills/apm-workflow/SKILL.md: sha256:60c2c3351b74cc8b3cb468e1cb353815214e7913ab118c30c9172f4c7f264844
-    .claude/skills/apm-workflow/references/audit.md: sha256:a336da288330a9f9d09b79fabeefbfc70f7ca81e9d86ef335c70a4eba3186141
-    .claude/skills/apm-workflow/references/compile.md: sha256:f0b7b99e56937290ed6c1db52e542283670e369a2cc55f8a3c5dbc48d4252f7a
-    .claude/skills/apm-workflow/references/configure.md: sha256:c92d7c23c6bcb4ce0b56cce43fe399c085d698fcf58243f416bc84f0e058d7a0
-    .claude/skills/apm-workflow/references/install.md: sha256:1615e31460f8cc820fca162175b8689ade1324604aa1c8f204cbc8924d74b5ee
-    .claude/skills/apm-workflow/references/marketplace.md: sha256:0f2fdd21d8080f3b34ddee8abd52431903aeb67878842de99198a868dc43ef67
+    .claude/skills/apm-workflow/README.md: sha256:b9e422212c93b188ad0992e2cacb3ef475467b1e1c33981cf26946ce6f11de5a
+    .claude/skills/apm-workflow/SKILL.md: sha256:ac5738fc899ae259977df7b6c20695f18f1b1929e65909fce5311639f0a307d4
+    .claude/skills/apm-workflow/references/audit.md: sha256:9b3fe128cbe133c8f2880a968b4cd6e875cc0eb79ef6738a9bfdabdf28446fe2
+    .claude/skills/apm-workflow/references/compile.md: sha256:26bbdffce73dce9b1b5589b24aec521c7a4d842c94e5a555031144afda4ce437
+    .claude/skills/apm-workflow/references/configure.md: sha256:0b053dad39543679c72d8267667b49c9823f6bfeca781f0caf4e26d7380be1fe
+    .claude/skills/apm-workflow/references/install.md: sha256:e729386bee5e2b67ce16b4c6c85446ce7b47d3122b68c148a571bd00a8550ad5
+    .claude/skills/apm-workflow/references/marketplace.md: sha256:d170ae4853d6f0f369667044e6e124ba8bc3d9235a268240ac45d58973481dfc
     .claude/skills/apm-workflow/references/sources.md: sha256:4ae44a9e82e8ec3bd4b1a61f32adbd3f3ff5fab21db3b4162765b2c0553e49fd
-    .claude/skills/forge/README.md: sha256:2151b952f4438cd9212edd97de90eec06f027f01121b3badb9d32dc9c45320c4
-    .claude/skills/forge/SKILL.md: sha256:4de4c629cb4aec4c6cac5347163a86fe123299f131510dc43857597ded6ae497
-    .claude/skills/forge/references/sources.md: sha256:a7f614c0ab37aa403545e191722bca012836162dcab30ff8ac984cbb25ad68cd
-    .claude/skills/skill-audit/README.md: sha256:78bfcfb16bbeef814b83f37a4a5185886003f9442a6d0e7e94be56f54d18d7a5
-    .claude/skills/skill-audit/SKILL.md: sha256:57a9336d409c883dc9a78aa92a9f0075fac6f8e4aac6ee8fdab705055ef85162
+    .claude/skills/forge/README.md: sha256:e7bc187af3072cb554ffeac5a90e24e87b3e086ba7c8fc104b7b542237070dcc
+    .claude/skills/forge/SKILL.md: sha256:a87b5c375c42142eedc2452b2b9b48033a18fb649e94a458f22cfbd4b0accfe4
+    .claude/skills/forge/references/apm-routes.md: sha256:b7d74d12ff34648be968db3e9db66c1be2efa420cad0eceea20374aa100659aa
+    .claude/skills/forge/references/author-routes.md: sha256:3f60ba054d4823adeccd8a83ad06b39860bd599df94056aa94c3d9e4293e0c1f
+    .claude/skills/forge/references/sources.md: sha256:08f5c6857fef904e48cc9e8cf159673c2f70c6d27e851175b8ce929b1de08243
+    .claude/skills/forge/references/version-bump.md: sha256:8046a8a2a2b019800101cc215e8ee87bdcf42cd6240ea1b484537a06baf27bef
+    .claude/skills/skill-audit/README.md: sha256:fe6002082a5da01579dd2693a3c4cc2ab557d5c63110c818b312fbccb98d0534
+    .claude/skills/skill-audit/SKILL.md: sha256:492d0895374b31f6b65068fd388f0161b47ddffdafc99a571cec4ae1faa0f798
     .claude/skills/skill-audit/assets/vale/.vale.ini: sha256:0d1108b17a941b514dd9a62a7382d1febdd543118750246c81fba406440a9f9f
     .claude/skills/skill-audit/assets/vale/styles/Kyberforge/CompositionNote.yml: sha256:e0a52fb9ff65aee9d21d1f7b61bef0f71d14b8edd9af1d70246715bbb8844ccf
     .claude/skills/skill-audit/assets/vale/styles/Kyberforge/DescriptionOpener.yml: sha256:60984e0af965137a151a07875f388c94ea2da93d4ee4f2b92811bd14105527f2
     .claude/skills/skill-audit/assets/vale/styles/Kyberforge/PaddingPhrase.yml: sha256:67b738f5c393a717bdf249fcd946eb7b0d258215bf2240d2be6902711b46d8e9
     .claude/skills/skill-audit/assets/vale/styles/Kyberforge/SentenceOpenerThereIs.yml: sha256:5dade0238d96730d24bb6e8dba003c3d94694bd9969687f461fe1fada3ca4629
     .claude/skills/skill-audit/assets/vale/styles/Kyberforge/VagueWording.yml: sha256:d4bf14d0bb2dcbe3a89b66b72a9c9c19d175060b5c4c978da3d67010f1a25083
-    .claude/skills/skill-audit/references/body-discipline.md: sha256:f8a27d7266f4453781712f0bead151580158581a445a641613203a67a1c337d7
-    .claude/skills/skill-audit/references/description-quality.md: sha256:2d37eccb4889cade6cbad0deaaed6d1f5fe4c3276c5438c244b2f87ae27bf432
-    .claude/skills/skill-audit/references/file-structure.md: sha256:b24638bd639ef048da171f6dc711e345749cde3c70ec6ba1b7fcbd696b921841
-    .claude/skills/skill-audit/references/formatting-and-scripts.md: sha256:5c319866b2f22ba07789dae7b0813132f67196c508e8da23971307c2a9e57095
-    .claude/skills/skill-audit/references/patterns.md: sha256:4a942ab30b95dc0cbf0fbe7da3b91157f166bce80cbd17bcf60dc365ea9237af
-    .claude/skills/skill-audit/references/sources.md: sha256:1db16ea23884ac2db799b42d1284daaab4b24eb94f184a95fb67ddc280385934
-    .claude/skills/skill-audit/references/validation-scripts.md: sha256:44f3b82413b57f2b5671637bb449a4c01b6d5fcd9059245aaa38e45108adf480
+    .claude/skills/skill-audit/references/body-discipline.md: sha256:0029e78e0024c50e8e9d3a57f4ae38c34775468193635fdf37bf806b6228c813
+    .claude/skills/skill-audit/references/description-quality.md: sha256:bddde053e051cc3e66db46dfbf2f8b422618ecf2f918e3ad5deb2d9dc2433e03
+    .claude/skills/skill-audit/references/file-structure.md: sha256:3b9d9281eab8dfbbcd403d1a2f253e768d13b258ace4d109d263639f26deff06
+    .claude/skills/skill-audit/references/finding-criteria.md: sha256:1e613db280a183f8d44e1bcd76c49b910d14695b27157887f876726efd8824f1
+    .claude/skills/skill-audit/references/formatting-and-scripts.md: sha256:34a9b3e66b0f1852634a286891c0a9c00cb17bc49ddaa0b039c86f48f12bc282
+    .claude/skills/skill-audit/references/patterns.md: sha256:411c0e9f00731c9c5258bb3fcebc74c1208ad8b51740e2fe41810cf72f7951fd
+    .claude/skills/skill-audit/references/sources.md: sha256:d3bd14466fede4b62f6ac3d2b40712befcb028ed005c192beddeea31da752d8a
+    .claude/skills/skill-audit/references/validation-scripts.md: sha256:e1436269c2e5f8ed15abd65bcbed0619c5b84618f327ec90a28634980376dcef
     .claude/skills/skill-audit/scripts/vale-wrap.sh: sha256:c17673b3b0de1c1a49fcb73e2b695835a45014ec1c300a77a3ba7b3c7ce4c995
-    .claude/skills/skill-audit/scripts/validate-provenance.sh: sha256:015376c5ad1f6bb6b53549537317a55e3ac06cd4e347451dba85879a3928ccbe
-    .claude/skills/skill-audit/scripts/validate.sh: sha256:7ce27df82e4160c6296db6c8314865f022da5c4334151857570a86167c8d4e11
+    .claude/skills/skill-audit/scripts/validate-provenance.sh: sha256:47bd47b710652358ebc687adf370516f1aa25b228d2dace9b49e5bc725eb6f2b
+    .claude/skills/skill-audit/scripts/validate.sh: sha256:1eaae273885f6a68b29086eca60ca72adb83a33d3391037b9461105d7fe9bf01
     .claude/skills/skill-author/README.md: sha256:d22035d302818e103486e447bd92d2da4c9b73da60f30157941710f32f400b89
     .claude/skills/skill-author/SKILL.md: sha256:615a936580f44dd8e523496aadf88df6d512ac58369190b90407e8fca86e8345
     .claude/skills/skill-author/assets/templates/README.md: sha256:f7e91356f4c85862f96a9f46a7a7ae8b5dc715c8174add5cf070166a8bae0658
@@ -516,22 +600,22 @@ dependencies:
     .claude/skills/skill-author/assets/templates/references/sources.md: sha256:fe126720ba890b98e829f2626e3f5a361a0c2ce47eda97bd3f7dc1812ddd62b7
     .claude/skills/skill-author/assets/templates/scripts/README.md: sha256:ee427eed6a562a6e86898c69c35508c518d5b3c633ae803e587fbab37514f2b2
     .claude/skills/skill-author/assets/templates/tests/README.md: sha256:5d331de121105ca79b544b9d3779a316a64cee46fa8d51ba0ea789ab5c233442
-    .claude/skills/skill-author/references/contract.md: sha256:d350721118a2bd57094fa9151f11b48a663a1c8a04e50fba71ff2baf64b7282f
+    .claude/skills/skill-author/references/contract.md: sha256:8b4b1f4f05d5ee5398a332cc2ee48d59f0a09105dd84049f59ca040bda6f65dc
     .claude/skills/skill-author/references/create.md: sha256:0837a77ad6da7ae9894134d15eebd57950b8505e8bd2b32ee69f281d65a6abcb
     .claude/skills/skill-author/references/deployment-modes.md: sha256:ffe2d928f2b5ec90c509f4d4cc5bd33c71899852cb5cc5a31fe1513b707fb759
     .claude/skills/skill-author/references/improve.md: sha256:abe029587ce475fed165d8fcfa46ea1abe83f90727d093f8121a9a7a7daa5a3d
-    .claude/skills/skill-author/references/retrofit.md: sha256:6c8336caa717f2abd38cb1f9c776479c0e908f7dbf577021d3689b375287dc77
+    .claude/skills/skill-author/references/retrofit.md: sha256:414cf356bc7a23bc7af1f2b918159458bd59f3a35f48f00762718baa9f935918
     .claude/skills/skill-author/references/scripts.md: sha256:fe71da1fb3d947846ad1a37348f90866b0c4f7dbd81331cfe3300981656f6cc2
     .claude/skills/skill-author/references/sources.md: sha256:652f7ce26c0d68a3ed11db09206bff20ba230ca8ff1fe71ae45b6f4505979327
     .claude/skills/skill-author/scripts/new-skill.sh: sha256:c788b56f73ed4fd03edb179159361fe16e3afbf528a9895e9251909c5aa40a7f
-  content_hash: sha256:32185a11d3d859e5235de2c43065920ba8950c1684e6aec46f0f7170ff4a111e
+  content_hash: sha256:b04348085f13973504abd5107afa95bc45e7249ec523a5ee135bd9f62c6c4d1a
   declared_license: MIT
   exec_status: deployed
 - repo_url: Defame1297/holocron
   name: lint
   host: git.dev.rkdr.net
-  resolved_commit: 0e91a3ae66d1b0439b9c0ef4b6e88ca6f2659473
-  version: 1.1.6
+  resolved_commit: 598a7c326a4bbfa4a39007eb95d944c4150686e8
+  version: 1.1.7
   virtual_path: plugins/lint
   is_virtual: true
   package_type: marketplace_plugin
@@ -549,15 +633,15 @@ dependencies:
   - .claude/skills/vale-run/references/troubleshooting.md
   deployed_file_hashes:
     .claude/agents/lint-runner.md: sha256:efeee4fb01c27b9177239f059851cf1b736ca50a12793b94d5d65d30ab98bcd4
-    .claude/skills/vale-config/README.md: sha256:faf6bca23cea74be7ecf47a31b0499af2f6ce791bbc82eb67069e1e67eeed07c
-    .claude/skills/vale-config/SKILL.md: sha256:1674f1256b654779268c42f764fa0c4f09011ce8ea62eb0e01fd8f118495519b
-    .claude/skills/vale-config/references/configuration-reference.md: sha256:1c2dbee6315178b00e624c002a6ae8d9d20f03f2c7ff1c3fba4eebe38fb39a7f
-    .claude/skills/vale-config/references/sources.md: sha256:2efa451c3cc6bdc1103cfe56712a3ea35acef9a76fe4c6f71e8cacabd92dc860
-    .claude/skills/vale-run/README.md: sha256:1a850c89cf7de288dc72b96cae6fec24a3ccdc237f0ce785f59cca56c7762198
-    .claude/skills/vale-run/SKILL.md: sha256:16c42c97de14ef20296b9dfce46b0e2f9be6ad68751c35975251cecff80f79d9
-    .claude/skills/vale-run/references/sources.md: sha256:1f46b727e5f3db09d6c8c01c8a615bad60ce2c5b3a01226e1a3fd3b933330bc7
-    .claude/skills/vale-run/references/troubleshooting.md: sha256:b4c2bc67b413b102d9fe1cd7e5a248b19aba3dc3b60b4429e777977cf8021cd5
-  content_hash: sha256:f7915119bf5d349bb4dd26b7999278770dd2e0b38e4b4db57c0819a15cbf97a3
+    .claude/skills/vale-config/README.md: sha256:d4326ddeab98d7fe24bcc7116ca059e4da8f6bc15981fef856803e3a0fef398d
+    .claude/skills/vale-config/SKILL.md: sha256:2e2500f871b39b9168e45b8e8fb731c964637202b59368c193c20d96da8cd84b
+    .claude/skills/vale-config/references/configuration-reference.md: sha256:1c4e22183d55809e79add7e3af353f5caaef903133b9c3f5088cc37f5230e47b
+    .claude/skills/vale-config/references/sources.md: sha256:71c73879827bdcd86019bb1faba20bb4bf02ccf610e939412110079efcd9a8ab
+    .claude/skills/vale-run/README.md: sha256:f25930095a9f9bba09ba3ff53b53606a40b2e5fddeb63cf071ed18c0b4076dcb
+    .claude/skills/vale-run/SKILL.md: sha256:d5b5e87e51f145e3c4b9e91d23070bbb938ba19b07af30e92400f353ad7fd50a
+    .claude/skills/vale-run/references/sources.md: sha256:c902480e6ba35926c58b2ce9233434340a5e4ec4f09cd112135c3f58f91b98c5
+    .claude/skills/vale-run/references/troubleshooting.md: sha256:3609993547c96c43b3b0f313e9f3c0611214cf14aad8420c2a168dc26c055115
+  content_hash: sha256:a0e760b6efb4214a677c3b0f74d3167c3b6a7dcf4146a480986cd3ff7a76bb05
   declared_license: MIT
 deployments:
 - kind: project-relative
@@ -568,7 +652,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:fbb78f7c8c58b018639e7a39f2f1b3ce2adcd6bed277b3c8f8cd70893698ec73
+  content_hash: sha256:7c4b7efb58ecdd26fea835613d0f7f909706607cac4f002a0df2db2a3a0ee477
 - kind: project-relative
   target: claude
   value: .claude/agents/git-orchestrate.md
@@ -577,7 +661,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:95a48c8e62cbb5d8f5bb2aa80c253d2f8b3a3988cf6202c10ae4feae1266d64d
+  content_hash: sha256:8b1b6826bad87b816ea78fc6bdb5aa9c750d542c6266fc3ee3225336450de16f
 - kind: project-relative
   target: claude
   value: .claude/agents/gitea-orchestrate.md
@@ -586,7 +670,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:c281972b9c738e35528f9478ee76dc326d2f113312dacc7fd87991f0cd8cc825
+  content_hash: sha256:57075f127535b201cc6e153d5817ab57d5f9c80dc22c7759092ecb0f0028c0c7
 - kind: project-relative
   target: claude
   value: .claude/agents/lint-runner.md
@@ -622,7 +706,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:fafdb84bf258f6d606c97b785c7c378b5de805f0aa8a10d3cedefedb000e4230
+  content_hash: sha256:c2f1fca5e0c8c713904d82888691efa605670dc08a03aed5c8233a7f26cf7d53
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/SKILL.md
@@ -631,7 +715,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:a126a2a7b1b8c9f6b39272584e2f84577aeeb8c81707be6f151b3acbe35ecf51
+  content_hash: sha256:1fa16e4cb540283d2da0d17585df821963a72dc0a0235f134205c54805d95f03
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/assets/vale/.vale.ini
@@ -703,7 +787,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:f6d777f7d3844d1be847f86f67b08c2db37b2d122e0bf1af92ef057bbfdd1004
+  content_hash: sha256:9d2acf43aa4e8b2b71c99224d1ea8c7c2ff4d27d7c6982175bf1a52ceffd7be8
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/references/body-and-delegation.md
@@ -712,7 +796,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:788664bb75364354773bd9efd4a0f84a231009d3a8b080e2561fefff2aa95b69
+  content_hash: sha256:e559a185e3de779ce599ba6ccbad316df43f158a9f002bbc88828eeba748066a
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/references/description-quality.md
@@ -721,7 +805,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:15eea332149203ac18c6b3eee98f0078e8a764cdb91b3158590f45204cb3322a
+  content_hash: sha256:89572997ca01df1c526759fe5d324c3ebbbee314172849d82caef16c4992a4d3
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/references/field-inventory.md
@@ -730,7 +814,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:e9abd738c08890994441d215eba96f894e00992cb7bb5ce850796186050aa1ae
+  content_hash: sha256:24feb0d25dd85c4fbd4558fbca78bd66974a8fc5be2d5c952c7a8ed7168f7d65
+- kind: project-relative
+  target: claude
+  value: .claude/skills/agent-audit/references/finding-criteria.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  content_hash: sha256:c18934428215154daf5543f4e8e40ca55c9833125e8b29feca513f99376c5663
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/references/scope-plugin-apm.md
@@ -757,7 +850,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:235de49e805d83ba19f8ecdc90da2f7d3b02c5f1c2fc54179d6bdd5bc398743e
+  content_hash: sha256:86f93524eae02c06be01e9feb3b751805b4f6a7da824e242693d588496c9e490
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/references/validation-scripts.md
@@ -766,7 +859,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:7eb48ec40175d6cce2b3b9602c0d9e60d62bacca1df7cc120c138ea1ce328666
+  content_hash: sha256:99c6d23a1d45184f1b2265dae31f66392defa094522d1f199187d172cbf306ea
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/scripts/README.md
@@ -793,7 +886,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:0e1d2b3bb1abb9f302ed84a618246ebaa7d5f7fda727b290d323e70dcc26a323
+  content_hash: sha256:197a9bef1a58fa2457a4ae0b802c7b362911e26cec0a5f0194840c95500057a4
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-audit/scripts/validate.sh
@@ -802,7 +895,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:50c6d3875fd44901fba3fcb69256f616be19521ee8209b7132778c1d4a693a3f
+  content_hash: sha256:aa21b99ebc6bcd845066113d74e39d86c8c2858067edfe855d03cbf42531150b
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-author
@@ -883,7 +976,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:a96f0ef021a6629120e5af7c98fa483d31de92cea37f98b51528a28dee38e16a
+  content_hash: sha256:d862636a23c6d64026982727588db1582499b72c774ca429578a57321fa89e19
 - kind: project-relative
   target: claude
   value: .claude/skills/agent-author/references/create.md
@@ -982,7 +1075,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:5d487aadb0424eb162f19454488e3b923180163cf1a543bb977b6969ae7a6849
+  content_hash: sha256:b177cae5eca7326850986b502bd5bf3c2c5949fddc124c70a6a98e8c4d3dc7a8
 - kind: project-relative
   target: claude
   value: .claude/skills/agentsmd-audit/SKILL.md
@@ -991,7 +1084,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:f4e1d3f1fa79ebd4c2c874dfb2fe1b86834c9ae708ab3f0a3fa07be39e90b552
+  content_hash: sha256:f231a143f71a89a4ccbbf6d1579ea45c071b4f251a4b97e07c70d001ab7ba0f5
 - kind: project-relative
   target: claude
   value: .claude/skills/agentsmd-audit/references/sources.md
@@ -1063,7 +1156,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:c32b9fe1cc7966d21d1ec504396d492afa53eb6369bd3b2678aed4ba92f331f8
+  content_hash: sha256:cf9a33c658cbe153391072872cefe403762b37c9ddc74d7c6f64ac6e08dd0f8b
 - kind: project-relative
   target: claude
   value: .claude/skills/agentsmd-author/references/content-guide.md
@@ -1099,7 +1192,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:d7bd79ee27997fffb5765c03358a700d8c00266ea120f6d067d74300d6c26eb0
+  content_hash: sha256:f48ca12116d20584fd4582d3ba44a9f02cddab2ae2f12c41abfc3455b4640203
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-install/SKILL.md
@@ -1108,7 +1201,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:4c0db5454bcbf895a89e7405eeefb4521a2b23f2ff28aa96c82c59708d8819ee
+  content_hash: sha256:ee0877665f2fd9ff4e764b7957ebb9b6f6006ffabc254cba8c2ecfeaf9848278
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-install/references/sources.md
@@ -1135,7 +1228,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:40e85d2c2a7487b54c7797fb135b979b8df14b524928da8c7502723a0fc8d36a
+  content_hash: sha256:b9e422212c93b188ad0992e2cacb3ef475467b1e1c33981cf26946ce6f11de5a
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/SKILL.md
@@ -1144,7 +1237,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:60c2c3351b74cc8b3cb468e1cb353815214e7913ab118c30c9172f4c7f264844
+  content_hash: sha256:ac5738fc899ae259977df7b6c20695f18f1b1929e65909fce5311639f0a307d4
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/references/audit.md
@@ -1153,7 +1246,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:a336da288330a9f9d09b79fabeefbfc70f7ca81e9d86ef335c70a4eba3186141
+  content_hash: sha256:9b3fe128cbe133c8f2880a968b4cd6e875cc0eb79ef6738a9bfdabdf28446fe2
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/references/compile.md
@@ -1162,7 +1255,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:f0b7b99e56937290ed6c1db52e542283670e369a2cc55f8a3c5dbc48d4252f7a
+  content_hash: sha256:26bbdffce73dce9b1b5589b24aec521c7a4d842c94e5a555031144afda4ce437
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/references/configure.md
@@ -1171,7 +1264,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:c92d7c23c6bcb4ce0b56cce43fe399c085d698fcf58243f416bc84f0e058d7a0
+  content_hash: sha256:0b053dad39543679c72d8267667b49c9823f6bfeca781f0caf4e26d7380be1fe
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/references/install.md
@@ -1180,7 +1273,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:1615e31460f8cc820fca162175b8689ade1324604aa1c8f204cbc8924d74b5ee
+  content_hash: sha256:e729386bee5e2b67ce16b4c6c85446ce7b47d3122b68c148a571bd00a8550ad5
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/references/marketplace.md
@@ -1189,7 +1282,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:0f2fdd21d8080f3b34ddee8abd52431903aeb67878842de99198a868dc43ef67
+  content_hash: sha256:d170ae4853d6f0f369667044e6e124ba8bc3d9235a268240ac45d58973481dfc
 - kind: project-relative
   target: claude
   value: .claude/skills/apm-workflow/references/sources.md
@@ -1208,6 +1301,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: null
+- kind: project-relative
+  target: claude
+  value: .claude/skills/caveman/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:f512fff0ddf11ae216c6806d4c2ad31e130de6ed360c89a39787c2ff6f4a2c62
 - kind: project-relative
   target: claude
   value: .claude/skills/caveman/SKILL.md
@@ -1216,7 +1318,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:b4bb6fe3bf3da222993ca0aee5e7c6f5368b182dd30ce1172e8f8e3280eb7052
+  content_hash: sha256:817ed2655c2188c5c0b1e1dc5f4e762e699ad7fcd2a056e4ef73d5f6601dd1f8
 - kind: project-relative
   target: claude
   value: .claude/skills/diagnose
@@ -1226,6 +1328,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: null
+- kind: project-relative
+  target: claude
+  value: .claude/skills/diagnose/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:ac59366a09f74bce57d45ebe06e8afb7d12166351a4756a7b89f71ab9e0fc450
 - kind: project-relative
   target: claude
   value: .claude/skills/diagnose/SKILL.md
@@ -1234,16 +1345,34 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:28886402bbfa0470248086eab9106a103b964b76ae9496e63ff0c8a6761b6d13
+  content_hash: sha256:0844ba2bbede408be2e54a20cacd2e280c275c11ba45173381659a76f0c54cad
 - kind: project-relative
   target: claude
-  value: .claude/skills/diagnose/scripts/hitl-loop.template.sh
+  value: .claude/skills/diagnose/assets/hitl-loop.template.sh
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: sha256:b2932630950e5210075bcd6f850e5accf30c101c5367b29eac3a29b4dd8084c8
+- kind: project-relative
+  target: claude
+  value: .claude/skills/diagnose/references/feedback-loops.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:5ed81b331fcf7dfc229b92be7250fd786064f8363dbf55bf6b6e5e9b5f5e1daf
+- kind: project-relative
+  target: claude
+  value: .claude/skills/diagnose/references/regression-seams.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:fdb24c383628d239e54424f72258860612d6fe8a1fc5d0057ab5073628cc71f4
 - kind: project-relative
   target: claude
   value: .claude/skills/forge
@@ -1261,7 +1390,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:2151b952f4438cd9212edd97de90eec06f027f01121b3badb9d32dc9c45320c4
+  content_hash: sha256:e7bc187af3072cb554ffeac5a90e24e87b3e086ba7c8fc104b7b542237070dcc
 - kind: project-relative
   target: claude
   value: .claude/skills/forge/SKILL.md
@@ -1270,7 +1399,25 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:4de4c629cb4aec4c6cac5347163a86fe123299f131510dc43857597ded6ae497
+  content_hash: sha256:a87b5c375c42142eedc2452b2b9b48033a18fb649e94a458f22cfbd4b0accfe4
+- kind: project-relative
+  target: claude
+  value: .claude/skills/forge/references/apm-routes.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  content_hash: sha256:b7d74d12ff34648be968db3e9db66c1be2efa420cad0eceea20374aa100659aa
+- kind: project-relative
+  target: claude
+  value: .claude/skills/forge/references/author-routes.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  content_hash: sha256:3f60ba054d4823adeccd8a83ad06b39860bd599df94056aa94c3d9e4293e0c1f
 - kind: project-relative
   target: claude
   value: .claude/skills/forge/references/sources.md
@@ -1279,7 +1426,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:a7f614c0ab37aa403545e191722bca012836162dcab30ff8ac984cbb25ad68cd
+  content_hash: sha256:08f5c6857fef904e48cc9e8cf159673c2f70c6d27e851175b8ce929b1de08243
+- kind: project-relative
+  target: claude
+  value: .claude/skills/forge/references/version-bump.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  content_hash: sha256:8046a8a2a2b019800101cc215e8ee87bdcf42cd6240ea1b484537a06baf27bef
 - kind: project-relative
   target: claude
   value: .claude/skills/git-branches
@@ -1297,7 +1453,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:1d59fc21bcaad298a81e5b1c13cf2a396b13ad59a09eeb63f95165f9216755d3
+  content_hash: sha256:72ff2e422f39c306fa53eb65c73761f48405cdbd42a3eb98d48c304318c9aa3f
 - kind: project-relative
   target: claude
   value: .claude/skills/git-branches/SKILL.md
@@ -1306,7 +1462,52 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:29d19cee09cd3be3d26db86a228aca9d41833c53945e53e5b26e4339f5c35f0c
+  content_hash: sha256:3a0bcc9a0fce6d0789466a798161743d54d4251b7a4256b87a7cd9d3c0f5b458
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-branches/references/branch-operations.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:c682142f969e943bae3a05cef24ce9661a4b36861da3b115cf07d762ebed4933
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-branches/references/branch-patterns.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:1fdc2cc86634f45d48a3fc4326eec81e1331cef0f8406639f2a712ead2eb5f7b
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-branches/references/comparing-branches.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:38f22b0324981a0ad60d29b336e0824b63b1108863fb3e9870f1d93e32f09d82
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-branches/references/merging.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:d144c237e7a8a1e709444af9e16c4d7804ba9f53fcae2326249d98885c48716e
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-branches/references/orchestrator-contract.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:d4f5c6517acbe784133c174c076e57348921a3fc5aa12b11bb6cf13b30e087b9
 - kind: project-relative
   target: claude
   value: .claude/skills/git-branches/references/sources.md
@@ -1315,7 +1516,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:ee1c982caf67183acc51226bb5078b3409bb6965b720568f10d67e5f976ccb72
+  content_hash: sha256:9043d5c90381900dcf7ad6b55b4a73ffee62e3ca6d23f1f89708de635e37534a
 - kind: project-relative
   target: claude
   value: .claude/skills/git-commits
@@ -1333,7 +1534,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:c686fd6dd54c608889168cfeaf62e659d66e681194a95aaf5f84859513fda800
+  content_hash: sha256:f4d2b60926e50a45dbf5621dbd62fb1239a4f3da1163402f7e1a82f0a8a8b568
 - kind: project-relative
   target: claude
   value: .claude/skills/git-commits/SKILL.md
@@ -1342,7 +1543,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:99826526958edffc2a897cc9622e3b2cf11c1bd9995c4a338a23758e62aad9de
+  content_hash: sha256:1658a63bc3209993580982c0aa7cbd2656a1d2b3519f2c421c65bf929c65ccfd
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-commits/references/cherry-pick.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:1d8a89adbdaa37b4fdf8f2aed6b78e6767df5b46f97f083a0bd71288dfb7e1d9
 - kind: project-relative
   target: claude
   value: .claude/skills/git-commits/references/commit-template.md
@@ -1351,7 +1561,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:456d80208901106270687906c90bc35eb64595800c05b7b9340fe96cc1cf6a57
+  content_hash: sha256:50869213d35b563f2b03d2d3782067842a239d378badab55de3cac5492227f09
 - kind: project-relative
   target: claude
   value: .claude/skills/git-commits/references/conventional-commits-spec.md
@@ -1360,7 +1570,25 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:b131b5a2edb9a5acd6bdcb72107099a26bbc172b9a5eb845da4daa2176e962f9
+  content_hash: sha256:105175ba8244cd52096fde3746b4b671a82ba0337c7894dbc68a7d6a37646bc6
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-commits/references/create-commit.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:ac07f0c608b5388d6780b4ab353fb76974d8672423a2f3b6d80c69e8dbdbab4f
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-commits/references/rewrite-history.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:99fb88d022bbae4d1c1b84642d590439fe3142881821a99ed856aaeca43b699c
 - kind: project-relative
   target: claude
   value: .claude/skills/git-commits/references/sources.md
@@ -1369,7 +1597,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:7ef0293a96884c8935e3384cfb1c3c2c274d0aa0771ba8ac275e68f568d433f5
+  content_hash: sha256:215814371e0a83e7231989cfaf095b6ac9fceda124ad17f0490e7ee615764523
 - kind: project-relative
   target: claude
   value: .claude/skills/git-history
@@ -1387,7 +1615,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:b285b5b8d771dd2f3482db8b2bd79835ebb6273bffbd8d01bca17d683baac6fa
+  content_hash: sha256:6219a74783b28e6005c0a69ad92f9a179c9bda3b911bb1790d15d690d3c5de6e
 - kind: project-relative
   target: claude
   value: .claude/skills/git-history/SKILL.md
@@ -1396,7 +1624,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:d44ca7f6026624da21f9d31f1bb7a03524d83f30f2e83b54b0f72e9dc1524dfc
+  content_hash: sha256:dc117941d49c152e3d7e14f6e0595c308ab24378a24ff472a3f4ed98c003eb6f
 - kind: project-relative
   target: claude
   value: .claude/skills/git-history/references/README.md
@@ -1405,7 +1633,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:96ef45f979c692acc9a8f745570d506efe8ed8a57015de02dc699bd77018c463
+  content_hash: sha256:218187f9372a4027f6189420384dece791af74353adc9ea5b143e37c9ca3df5f
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-history/references/bisect.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:75606d95ff592085b4bf35d09361ebbfcb8f3ba195a3f7d89aff187b99789a3b
 - kind: project-relative
   target: claude
   value: .claude/skills/git-history/references/git-log-format.md
@@ -1414,7 +1651,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:e3a0711d7d2a7053bbd1bcd70832c65dd3348266c0fb330fd80a0b8f7c8f858b
+  content_hash: sha256:b17f36967c32b761a423bb14b900451208daa3be2dc6cba8709a6b60ad9b90fd
 - kind: project-relative
   target: claude
   value: .claude/skills/git-history/references/sources.md
@@ -1423,7 +1660,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:4a9c9c2ff80193ad4c751ab4baf4c9c42db038a7ea5156733e3253c335912f5b
+  content_hash: sha256:5a0d78e0f3f301dda18e5198dfd5552e90a7250ae14113a8c2d86de68beb3ad8
 - kind: project-relative
   target: claude
   value: .claude/skills/git-remotes
@@ -1441,7 +1678,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:7f51c47e1671de9f0a63a8836b16caa68727105b62a4240716e457ed8d401f97
+  content_hash: sha256:945896f6861c77259de0b5318b36c206f54e8b6ba70848d2b65847b64f3b142d
 - kind: project-relative
   target: claude
   value: .claude/skills/git-remotes/SKILL.md
@@ -1450,7 +1687,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:801a81a26117ee38130d9171f9b16c6ae7a281ec3aa3535fee30578eb29c7908
+  content_hash: sha256:88661a769ebb3d3b2bc64b58f11b2ff1c991ab6bc85e6f59c46e9472fe018598
 - kind: project-relative
   target: claude
   value: .claude/skills/git-remotes/references/README.md
@@ -1459,16 +1696,43 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:d590a7f2eb078710f44893b4866e821c840f48b7360f0779420d73331a3de597
+  content_hash: sha256:530122741ff0638ca80500b1b376c284238589ec95d5f33437c840aa197e18b9
 - kind: project-relative
   target: claude
-  value: .claude/skills/git-remotes/references/remotes.md
+  value: .claude/skills/git-remotes/references/fetch.md
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:80229bbd6d9e03e85e5ff49018181fb71003187f2c5e019869807e4e94aa4a46
+  content_hash: sha256:150c68ef952fafb02f12f1506bfabc5d1fe3b7fc1fcd5df0379943597f808b3a
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-remotes/references/pull.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:c06eda4c8090fb07d4b788f8fe2b6efdb0b0ab8c27eaafe8b077745997a22962
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-remotes/references/push.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:880e630792494ce4fab52e7965d548df7bfeaf2a8ba0a4ee775a1299810002b3
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-remotes/references/remote-config.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:779458aefcc932b90567b119b677789c2010e12eb38c5ad52f1be2e822c55019
 - kind: project-relative
   target: claude
   value: .claude/skills/git-remotes/references/sources.md
@@ -1477,7 +1741,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:33e966aba6946cd78d2b9e325670e5292ccdf73d90fcdfca70afb30ee70c1f2d
+  content_hash: sha256:ab4bbb3234eca2f2e71700d83d148dba44b741b7f0515ffe051380a43a0f7c84
 - kind: project-relative
   target: claude
   value: .claude/skills/git-submodules
@@ -1495,7 +1759,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:1510e9691d5107c436bda3497066950bfd2e9c9612cdf8ebd40f5ec73780ddea
+  content_hash: sha256:8589e78051a811055b382790252f13a00bd0008ebc220cf023efb05d0d12bd77
 - kind: project-relative
   target: claude
   value: .claude/skills/git-submodules/SKILL.md
@@ -1504,7 +1768,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:3b4525c5e7145d30f4a945bf5f2429cca270f00e88ed85ff79c6d5fa89fa05ca
+  content_hash: sha256:ef16cfa16b916423e1d5855587403788b4034166318525adcd5dc1ea23cb0bcf
 - kind: project-relative
   target: claude
   value: .claude/skills/git-submodules/references/README.md
@@ -1513,7 +1777,25 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:ef5453d5e87fd62568d8c1c55fccfc41f6522316976a8f2cde7aa90c1f857809
+  content_hash: sha256:217eeefcb78dc9f48e351e9bed4776c54220564f09888b137c1adbe5d5342971
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-submodules/references/removal.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:604d76043ca8644e9425d46593be3267ba3f54e36cfbd454570ef5a9ac962ea8
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-submodules/references/setup-and-update.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:7f03634a15736deac462cd21335f8bda7d2662f36d91a7127ad6b7105361021e
 - kind: project-relative
   target: claude
   value: .claude/skills/git-submodules/references/sources.md
@@ -1522,16 +1804,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:1786dcf90dd21988379a5ee4f243b50a158d87bc059d4903bf54ef268811c5e7
+  content_hash: sha256:17187d35af6f6f2dc6515f661f291525cdc7383c731d0547e12521f744c2e604
 - kind: project-relative
   target: claude
-  value: .claude/skills/git-submodules/references/submodules.md
+  value: .claude/skills/git-submodules/references/urls-and-config.md
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:ffab8cef061118a83ef480c5e8077c0e1ac2fa7e5e1fae333cfff9bfd362003f
+  content_hash: sha256:b1269515cf549d52fcf122cc5cdb6fbb56bc4ea974e77d36eef063aa86c7cbec
 - kind: project-relative
   target: claude
   value: .claude/skills/git-workflow
@@ -1549,7 +1831,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:00844e92a521b46273e1c9ee334440c868348c1795ae86eb7fd95fb86dbbfbed
+  content_hash: sha256:cc96c23118e821a2e9ab1f6370484ea5cc97f3a0fd285c1b7f3782f0de62117c
 - kind: project-relative
   target: claude
   value: .claude/skills/git-workflow/SKILL.md
@@ -1558,7 +1840,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:87a3f39fab4db85ce8d2b23d01d1e8b2180bf0a73eb18183eae2d7e28c2cc42b
+  content_hash: sha256:06c737da977e4a624a1100fdc502d2e250692cd9f870a7bc3eefac5835c511ef
 - kind: project-relative
   target: claude
   value: .claude/skills/git-workflow/references/README.md
@@ -1567,7 +1849,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:f6aa9351e7d87421f64573a0b1db5b400b0c2c2686097625070e5f1113d72426
+  content_hash: sha256:27f978e69d5ffbcdd99c28ff42361da7824e7466b6a34cbf7c4b0feceb16f1ae
+- kind: project-relative
+  target: claude
+  value: .claude/skills/git-workflow/references/hard-rules.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:7c7a6888527a3925333e0d44129de819d8c5e5161ae1de8551b2f1536d3b2ff2
 - kind: project-relative
   target: claude
   value: .claude/skills/git-workflow/references/sources.md
@@ -1576,7 +1867,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:186c6fec31bcefe10bf4409d8ef9b6fdfff6185b431f30c66712d0669df0be55
+  content_hash: sha256:e8078edd12bdbe0c81a7796f330ae2a06d78129ff20038c6bf98a8e638860786
 - kind: project-relative
   target: claude
   value: .claude/skills/git-worktrees
@@ -1594,7 +1885,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:084c936cf0aa2fc808e5fcf8acaec148d93d8ac03a99a6f3d06137adcc14585c
+  content_hash: sha256:eeec5c51f9e0353b9cfcfd3b7309ac23d0fb3a1fdacb9006d6d2fc1c0ef099dc
 - kind: project-relative
   target: claude
   value: .claude/skills/git-worktrees/SKILL.md
@@ -1603,7 +1894,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:2ea1122b4f8bc864a85248bde6983a930ad3f91b60286a761cb0de361b25183f
+  content_hash: sha256:4758187c798ddb90ebc3e18e76021159aaa857bc3cdd7f8b211a2d6f616db6bd
 - kind: project-relative
   target: claude
   value: .claude/skills/git-worktrees/references/README.md
@@ -1612,7 +1903,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:ea2f3249fe0d0af24fa91f4d050f2aead9fc84841333530bce0ddfc7378d56c5
+  content_hash: sha256:0778b6c81f7e77c84476fd966195b19f7b1c4553d35f5ffa016f72405c943c29
 - kind: project-relative
   target: claude
   value: .claude/skills/git-worktrees/references/sources.md
@@ -1621,7 +1912,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:5b7fe81f56eb03360a4719f2a988674f43891f7a2bfc14756d68398088767e36
+  content_hash: sha256:f4264a817836959685bfc286209d997295bb964524ba4e17027c39f25c3bccfd
 - kind: project-relative
   target: claude
   value: .claude/skills/git-worktrees/references/worktrees.md
@@ -1630,7 +1921,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:38999d4d07d85c6142495c3765d56a0b5fdf861487a9347317f6b054a7d3dbc8
+  content_hash: sha256:655fc3e9848e58a4c996efdd2fa1a90f43cec22a455ddb678959f347d2bc4ef0
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-branches
@@ -1648,7 +1939,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:ce7bff9d60a3edd4655af9b4f3bb51520ffc2ff2a90f98f55e29a1b72dc5e3ee
+  content_hash: sha256:2f9a0f16351c8b2d6dbb71724d372bb9c267b345b12948ecf840fe4f21faf650
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-branches/SKILL.md
@@ -1657,7 +1948,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:0d8a1ac2e450d60c123ae1538dc8cca49b270da410d2e031cf250cdded2bf839
+  content_hash: sha256:1ac80735b5bccf47b7faaba7d077e6c48c9c43970fc9307104b8986efab90934
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-branches/references/branches.md
@@ -1666,7 +1957,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:f045fb181d2fc1c948a2e026c335453273931f3a8d710a45b05826547ffe89e2
+  content_hash: sha256:cfc3323175ff56d155b57a65194dfa32459a5a1a4f1b266bb62e05449e39a27b
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-branches/references/commits.md
@@ -1675,7 +1966,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:ca70a1c32ff6abf296a027c27c678f1574eddfdc069d7ed4ae621524dcd9adc0
+  content_hash: sha256:7ded733117e3bf8c1a5bba54786197ad72aa9f743d27afafd8c36242ab7b0ce3
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-branches/references/sources.md
@@ -1684,7 +1975,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:1bfad24252356c6005935ccc10a87871709d4b41e6b2d69abe9ac7ab188f4bcd
+  content_hash: sha256:f206f9ac91146771539cbf288e73d1202d22f05414d9d1806d0dcf5c7ad02152
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-files
@@ -1702,7 +1993,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:f9d721b7ed8eae43b5eab04324dbc96fa91964accc77ea74d1b889475592256f
+  content_hash: sha256:2b9bfafdab57af61f3330fdb37070c3d301ee73c6631fde9cb36cdf28e88c466
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-files/SKILL.md
@@ -1711,16 +2002,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:9362d82068257d0aee113fd55f2acf4d53e8d20f638453946b76384a8c49a9b7
+  content_hash: sha256:808612acc0c28fde06cdecefa1d0d413129c7110059041616bc642ea596068c3
 - kind: project-relative
   target: claude
-  value: .claude/skills/gitea-files/references/examples.md
+  value: .claude/skills/gitea-files/references/reading.md
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:26209f202dd0ec12c73bb62984f9fe42c843e2819dab89752fdf478444a5d79f
+  content_hash: sha256:93a5d8dd909ffdbf2bac09fbe7d819bd8fe26979808c5f5bf8ca5dcce435c752
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-files/references/sources.md
@@ -1729,7 +2020,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:71981b2987c56589e469f2305afbf7d404e605c8db1a6d50c1576d50eb9eea9c
+  content_hash: sha256:4fbd03f275fb72899fc4489737f13074dfb61704965bd2bd52a372deff426fbb
+- kind: project-relative
+  target: claude
+  value: .claude/skills/gitea-files/references/writing.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  content_hash: sha256:3a5b0b5043fef2c55a0b009a6bf7998a45c3e5770f8b7ac11abd4a1e7b6b351e
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-issues
@@ -1747,7 +2047,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:2f5844cf2fde1a62844eb26ac19f915f50fe8fdc5bfde982be018ed2d0e15c30
+  content_hash: sha256:b2781529ea793022765dd4aa96faf5d3dcdaeb088c710b14201a4e73bb1cc580
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-issues/SKILL.md
@@ -1756,7 +2056,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:9084c5f37d23ebcc6de5940ad8fcc1c699aa7d4693623bf029a031b21412e7d6
+  content_hash: sha256:2b776f204579142e27885a9d6f4456076bf2262d785016c46a973afef44797b6
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-issues/references/enrichments.md
@@ -1765,7 +2065,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:024872fe787688f7ff51c856264bd3405208543fcbccd113cce464135dbc9f90
+  content_hash: sha256:1daa0758116e818f12f89fa43b031d9cd2518f73de95bc54d94d5536667b68e9
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-issues/references/issues.md
@@ -1774,7 +2074,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:5c8103944f316f7681ee2b3d5ebbc55dc73a2f5a25616325c87af03b93944a04
+  content_hash: sha256:7a1c4c42413df84645fbea70b29b2dcd732f52bfee259b2e28506dc101eed9f5
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-issues/references/search.md
@@ -1783,7 +2083,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:dec2a98a9d781122d235b8a3fa6cd9efdcc08be0a2b71eb29f90a6e14338c0af
+  content_hash: sha256:651a4493b166a498932bd0902d16efde273c49c6fc597bfb0e1b1c0296f7a742
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-issues/references/sources.md
@@ -1792,7 +2092,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:86d5c500e103d5eea31595ab04fb79d9e908215d83d2f0edec1e0e73995d2e96
+  content_hash: sha256:d6d358029298537db4d13dea84ee274006bce3e7f99b1aaed963d8703cba2250
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-labels-milestones
@@ -1810,7 +2110,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:185dd654d9d775fe0b0464a0dbdf724b06f6375fa6d7c7e200ee826fdcc9b4b5
+  content_hash: sha256:4606f16d1639f0a2fe46fcb341a54b673b0bbaeef12c197e2022bdf57b479c37
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-labels-milestones/SKILL.md
@@ -1819,7 +2119,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:ce07c4c8827747b13b3d9ea9d20f8318ace0803f2bd42804e717ed9201c54254
+  content_hash: sha256:52aec1a75050b46e3c386eb20454c7a9bddf9bde9a38ab3331a9b06d2e0f5302
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-labels-milestones/references/label-inference.md
@@ -1828,7 +2128,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:da141129c74d22a441303b910b68d5bb758435361efbd8d2669f46920d699361
+  content_hash: sha256:9aa51cc751f692932b5eecee698eba6eaa3e9f13e423e0fd3b13ffecaf26fc0e
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-labels-milestones/references/labels.md
@@ -1837,7 +2137,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:be8ff5ce4dbfb31dd2bdcc425a769dca94887c5c8acd47c78e1e21ccfc24dcba
+  content_hash: sha256:365730208ccbdf0f8fe3b2b49c1539208811029e3c343edcbe39b674a46a0527
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-labels-milestones/references/milestones.md
@@ -1846,7 +2146,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:ff1f1b0c8ecb6967c940d1ca8bebf2a2c7995414936f8ac7f5ff23d1dc01ac3f
+  content_hash: sha256:0b26f006cfb154d13b2a2fbf356b74f6339e7ab9c34041d50ade676f6c2d17d8
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-labels-milestones/references/sources.md
@@ -1855,7 +2155,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:a1a1d3381dfb0dc8f331be0b3ab49f28e94b992fb4809ca09be91ce33047dd1e
+  content_hash: sha256:b0a1c8cb678e21cf284e4efa5b75a2414c76a8e3898c449e8b60504d1d465bd5
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-prs
@@ -1873,7 +2173,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:31b6ad46379feee8ac7d837030f93ec04be20b7d11021b295dc6d27b4340a05b
+  content_hash: sha256:c8c11f5e3cfa7768fe3dfabf935564e5b08d1f7f6629d1dc2149c28b3b8e8ec0
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-prs/SKILL.md
@@ -1882,7 +2182,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:bf70832f3d97064c9816d680390da84c256a971d7804317e1814b4ee6a622b4d
+  content_hash: sha256:ec4b0c38a70cdcaf374ff92a706fcac151dc7b8e358dac36bd202ee3444ea799
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-prs/references/merging.md
@@ -1900,7 +2200,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:d6cefd0cf270f8d844536311e67bfa45cd07f024aa0a649de1938af306ae7109
+  content_hash: sha256:6f4b9de079ebe248282243a2920016bfb172d4115ad712feb1757bb57d5eec3e
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-prs/references/reviews.md
@@ -1909,7 +2209,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:1089cf45a75a562bbb29de6538848c4f4bd627d5a7e36bf9b2ab6496f45f962b
+  content_hash: sha256:97cef439e20595ab90cfa0105cff3ef39a53989172a9c0603374d16498f426b5
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-prs/references/sources.md
@@ -1918,7 +2218,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:ac48a3018443b56acb5c3d55d6c04e62103f5bac71b8185e2bd085fb7e165431
+  content_hash: sha256:e2c2792013550f99281f517310bd76d2e5d56751ace6da117ce602048d5342c5
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-releases
@@ -1936,7 +2236,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:102625066c34c7b5a16e25b7506a87f876e9b123b334f5ffba73ab1523a57ed7
+  content_hash: sha256:e5d2dd0748990c1d99f2065c97c275bb14eb4fb447c94e76c332bc5952fadb99
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-releases/SKILL.md
@@ -1945,7 +2245,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:793a6936c0d56acb4b4aba1d72e1fc91690273df0aafe447e54cb53df00319c1
+  content_hash: sha256:f3b9e867abf0fe3be88dc34242b18d96bd0f361252d7472ecacdd310689d36e0
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-releases/references/call-signatures.md
@@ -1954,7 +2254,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:a523dba171d67a7e7899b7d8ecfe9220f250da2c184b0f2806e5d22647b1ffb0
+  content_hash: sha256:1f7b40c390a5d032f8a00609194d8ce2107ac06d420b56d316837a6ec7dda982
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-releases/references/conventions.md
@@ -1963,7 +2263,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:1c8102ed489422706babea4e43e12dc7684b7dacd210fa29b3793bffa9cd9f64
+  content_hash: sha256:2a5613796701d0e27eaec1f71a1dc12f5fd5c2861ea001689d057da8c830cfba
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-releases/references/sources.md
@@ -1972,7 +2272,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:37a14495c461120a5bab0013531c9e83e7d9b670e78129a9439a81b48a64cce4
+  content_hash: sha256:30c43a93f4d7ea05ef3d013a68f8656317ef6cef6773ce9944d35b24a93bdc80
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-workflow
@@ -1990,7 +2290,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:338f79d0b3c25741848fce841a5094ef27cbc7e4a6228404557b2d9594df68fa
+  content_hash: sha256:508d49159db9b70bc4e1c8f0a440ec4c88b9941b4a83a60e1c2e9e286c0d0621
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-workflow/SKILL.md
@@ -1999,7 +2299,25 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:a8266ceb335c56eb68cc09b3f81690c52c4dada9f25b48c3a46ac46b0ad3b761
+  content_hash: sha256:93b64305f9232feae4c39aff33ebf8ca0ea9599b24cab0d838553868dd9a699e
+- kind: project-relative
+  target: claude
+  value: .claude/skills/gitea-workflow/references/number-resolution.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  content_hash: sha256:0242430246fd572e4e0c3715d557e425cd7d3260bba76f56856255b340184c3f
+- kind: project-relative
+  target: claude
+  value: .claude/skills/gitea-workflow/references/skill-index.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  content_hash: sha256:b53d8148ea8cf6e4cabd15cab39f60b98167d930f590ca0fdcb5f2f3969edc5e
 - kind: project-relative
   target: claude
   value: .claude/skills/gitea-workflow/references/sources.md
@@ -2008,7 +2326,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
-  content_hash: sha256:171d3a5a36cb9d637302516501a1e9fc7a4bd058968dc9244412c335aa2de68b
+  content_hash: sha256:21305440e8060adbdf5af2b946d2e173ad35f8326dd9e24cd1f769fefde92f7f
+- kind: project-relative
+  target: claude
+  value: .claude/skills/gitea-workflow/references/status-checkin.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/gitea
+  content_hash: sha256:c6da98ecbe1d2919222bfb856cf10c3fb9971423e1eb6590a15f6fc7550f102d
 - kind: project-relative
   target: claude
   value: .claude/skills/grill-me
@@ -2018,6 +2345,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: null
+- kind: project-relative
+  target: claude
+  value: .claude/skills/grill-me/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:4acbda2175bf003f1106a6912cf2cfb8d3d2623f391b1be6f417beb084a65b05
 - kind: project-relative
   target: claude
   value: .claude/skills/grill-me/SKILL.md
@@ -2026,7 +2362,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:74147eb6010a65957efef2b9e0f0b3ff935c1def7fc117697151b1d0f3610556
+  content_hash: sha256:0af060d6813ed59547be14c7dfd544d5b626c852f7ec0f7213c27c7ec0ae76c1
 - kind: project-relative
   target: claude
   value: .claude/skills/grill-with-docs
@@ -2054,6 +2390,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: sha256:8f6baaa3b1c91644bd7c600196b1aee781d5f525c7c345db8cdfbfb368329a05
+- kind: project-relative
+  target: claude
+  value: .claude/skills/grill-with-docs/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:c94a826df0f85f17957b9fa2fe73d52ab1ff29d7685658b994721378eeea811e
 - kind: project-relative
   target: claude
   value: .claude/skills/grill-with-docs/SKILL.md
@@ -2062,7 +2407,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:c7176600a8bffc9f359102cb041b6686387618b8e1434ba484dd708d45df6d5e
+  content_hash: sha256:26d06ea58adae5fa6ca8b406cc4a8d13ec3c9780bfb283c29ef0a8f8845f26f9
 - kind: project-relative
   target: claude
   value: .claude/skills/improve-codebase-architecture
@@ -2099,6 +2444,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: sha256:6feca2140439c54a774749e8367f18350899ff69c777144ed2248cd4407949fa
+- kind: project-relative
+  target: claude
+  value: .claude/skills/improve-codebase-architecture/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:813332e95450c7e3e4c892f5edf777236d213fca40f3d1ff30ac7a644f2ea258
 - kind: project-relative
   target: claude
   value: .claude/skills/improve-codebase-architecture/SKILL.md
@@ -2107,7 +2461,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:318b3df6a557f3a9216e6c32813d543301fa51954ea79c87edb95e1297213584
+  content_hash: sha256:4e54cc00ec301027f640ac5dd1877b0d9ec94c16e784da0cdab25e220167e53d
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-author
@@ -2125,7 +2479,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:2e21bd50002bd2622ebb31793fa4aece14f5233889c3a054fe99f1974f19bb40
+  content_hash: sha256:f363d981e55aa3aafdacb6242ce971c0afbea36c7f2d9ce0dce88dab9c476aeb
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-author/SKILL.md
@@ -2134,7 +2488,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:577b9bd06615182ce3b0123640d989c3b74ab05bda8103a63a41e1f5a1abb2ec
+  content_hash: sha256:a7a9a34a5efa4a0ec9f73cd2bc626d08dd0c2130f9ffc219e7bdd230eab717ff
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-author/references/README.md
@@ -2143,7 +2497,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:c409caf0e08af23f2ec056b649cee0bba22b55c1fbe4b8f1189ce0bbb9b5d5c4
+  content_hash: sha256:8fc13224aa64f5931a4f3e06198f67ed621066a69384b95c61ad91d08e86e602
+- kind: project-relative
+  target: claude
+  value: .claude/skills/pc-author/references/create-config.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:6f52e367de858739fe87e67c1f7c6fbc21c79650ad14289441d2d13884deaee2
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-author/references/hooks-by-language.md
@@ -2152,7 +2515,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:2c4ade2ac32e7a9c539d7e08b7d55739e8d87c634860bb58e8764067293bb35d
+  content_hash: sha256:9d585293c8801dd41a0f1842e5ac495be4552fc188c564bb074cb9244a189e19
+- kind: project-relative
+  target: claude
+  value: .claude/skills/pc-author/references/modify-config.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:7f1c90805e0467e857c67ae20fbb5968136c1e4c703076f2b2cd599990a71216
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-author/references/sources.md
@@ -2161,7 +2533,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:e1cff11955490e4948fec81d8172b0adc5a37829aa0ffe1791c0f6313ed34a4e
+  content_hash: sha256:5546cccd0bf7e725e97de29c96da128a8e39ef1a23102ecd668018c74c30a4cb
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-run
@@ -2179,7 +2551,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:2e2ebd5220c3251a40afa6c06243ba12fb0aa03dc60fb76db74b22c44914f353
+  content_hash: sha256:dab1352741c11f8892720f352d38fdf7e501a416d9219d604476185aa3dc0e69
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-run/SKILL.md
@@ -2188,7 +2560,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:7a0890f7447a04f464ca8a30e5a967ec4421e9ef41298d469f8f2a6ba03be0a2
+  content_hash: sha256:3f8b75868ff9b8d7b79136c4b02c46cc2719dfb778c1bd2bb8115a2d76e6f95d
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-run/references/README.md
@@ -2197,7 +2569,25 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:ad42b9013dbd44b8c4515c15317c5e9e6b235bc656ad5a03e037eb4bc6f8782c
+  content_hash: sha256:913f47285687f72716b95cb33a2036327fb4335c4d935aa5cfc2bc043b639773
+- kind: project-relative
+  target: claude
+  value: .claude/skills/pc-run/references/autoupdate.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:e0c3c53f8dfb2f1cccaaa38e7902f5b7196a128c41cdd7dfc4e95a5da6fecd9a
+- kind: project-relative
+  target: claude
+  value: .claude/skills/pc-run/references/clean.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:49a66a985c5adfabc876da4e0a2355fa8c22cbcbfbd7548e4b154b094080d87a
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-run/references/failure-patterns.md
@@ -2206,7 +2596,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:59d913c001483c3770d269fdf5e83cf1d7578e0ae879928a1404bf93bb395994
+  content_hash: sha256:c4ebaec91cbbfdb15cce5601b0e86e8556345ec34de9846e0f66c628be06836a
+- kind: project-relative
+  target: claude
+  value: .claude/skills/pc-run/references/install.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
+  content_hash: sha256:71ec08d58b8797b09574a827ea06d2c9656e3394d40534860fdaf333f5c19070
 - kind: project-relative
   target: claude
   value: .claude/skills/pc-run/references/sources.md
@@ -2215,7 +2614,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/git
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/git
-  content_hash: sha256:7ca8b7106e7ee5c2c7d1fbd3dc9e0d2a89c18eba79145cbab55bc8e39eef9087
+  content_hash: sha256:f23b3f50045bcff9644019c629451ffc90fe9fabf8dbfd3011c16ef011e48aab
 - kind: project-relative
   target: claude
   value: .claude/skills/prototype
@@ -2227,13 +2626,13 @@ deployments:
   content_hash: null
 - kind: project-relative
   target: claude
-  value: .claude/skills/prototype/LOGIC.md
+  value: .claude/skills/prototype/README.md
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:da91dc92195c00d5dc33863b8c1a030998025a0f8583ebf2babd770825b7f70c
+  content_hash: sha256:4f09d8742b017da6da3aa87d55a26937dda9ad2a3dcc0e45df62e26d6be10983
 - kind: project-relative
   target: claude
   value: .claude/skills/prototype/SKILL.md
@@ -2242,16 +2641,25 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:913df144c79658394b7ccc984858103a27553eeff9a8bf93dc51486603259d0f
+  content_hash: sha256:873d3c3bf9e46af5e61598a9030ac0304b58f900f48f102e7322c825d5fe435a
 - kind: project-relative
   target: claude
-  value: .claude/skills/prototype/UI.md
+  value: .claude/skills/prototype/references/logic.md
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:d76d565149ee50456c5ddc5e29c27fec8737637874fe5c37d970db085a200b27
+  content_hash: sha256:05c193ce98ee01ed3d7558891efa97c8f6a3b61605f24d18f9d405aef7d1b58d
+- kind: project-relative
+  target: claude
+  value: .claude/skills/prototype/references/ui.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:bff1746d1f0c5ef42d8c2fac33637249a78a6c0c92cfdf906da933e2e1104ec6
 - kind: project-relative
   target: claude
   value: .claude/skills/provider-adapter-author
@@ -2269,7 +2677,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:9aa132d5ffa7f249fa4c8f0e90f8505c1f1d0dcdd681e7930e5b0236407038b5
+  content_hash: sha256:ad6d674667fb810823a2b2115a9d6740b1dbde06af23e6315c6b4fbd44097823
 - kind: project-relative
   target: claude
   value: .claude/skills/provider-adapter-author/SKILL.md
@@ -2278,7 +2686,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:7d2d9c9555373fdac86683c517fcccca1d090347c9c1d13f91942763219d2053
+  content_hash: sha256:7e22858832bf95cce89cc5d3a3044bb0b811deed3c3974351bce040629cec59e
+- kind: project-relative
+  target: claude
+  value: .claude/skills/provider-adapter-author/references/provider-matrix.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/core
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
+  content_hash: sha256:30d712d76530dda0a82d600c710e43fa856537ba17391fb8fc8b4304766b706c
 - kind: project-relative
   target: claude
   value: .claude/skills/provider-adapter-author/references/sources.md
@@ -2287,7 +2704,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:45dfe2ff95744d7a00fa5b75be216562ff84047f21588ef244e89bdc2e5ae1bb
+  content_hash: sha256:5cf7ded132beeed77b2069602015852bf18757fe9cd203c3e9c3e9064f8185bf
 - kind: project-relative
   target: claude
   value: .claude/skills/provider-adapter-author/scripts/README.md
@@ -2296,7 +2713,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:196aa7752b2df4710b397e1927f68b0b966caa8a3b1006122ef6e184882af01b
+  content_hash: sha256:79095c5be4c3abc937053f1a0977fb6cf737111061fde561973c81f8e2192529
 - kind: project-relative
   target: claude
   value: .claude/skills/provider-adapter-author/scripts/validate-adapter.sh
@@ -2305,7 +2722,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/core
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/core
-  content_hash: sha256:519c8ab3d33884821a6090ec5ba0322ec1594f9c1ca388b44279133a1e0fa9be
+  content_hash: sha256:aff693f69b987fe74a5d4c60368118dae7595c087d0de9691f5905e62ae3e1c9
 - kind: project-relative
   target: claude
   value: .claude/skills/research
@@ -2317,13 +2734,13 @@ deployments:
   content_hash: null
 - kind: project-relative
   target: claude
-  value: .claude/skills/research/META.md
+  value: .claude/skills/research/README.md
   runtime: null
   scope: project
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:81a31d9ba20988b07bd4e141f0a7369d4dda302772d62809cc8b223ca1fbb84f
+  content_hash: sha256:b5fe17aea6a398ceaeebcab9cb2c31ff8fcc806d5793a257916dc16b6ecb9933
 - kind: project-relative
   target: claude
   value: .claude/skills/research/SKILL.md
@@ -2332,7 +2749,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:9ca6b3b8c9c1d04f93a6ef55149d0eecc9ffa82a28db9fb3f9b588c661b1b747
+  content_hash: sha256:245cec403e83b8c7fbc0f17e684858d49f06d35a3bcbb5f967f81c4efe5bdafc
 - kind: project-relative
   target: claude
   value: .claude/skills/research/references/file-format.md
@@ -2368,7 +2785,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:78bfcfb16bbeef814b83f37a4a5185886003f9442a6d0e7e94be56f54d18d7a5
+  content_hash: sha256:fe6002082a5da01579dd2693a3c4cc2ab557d5c63110c818b312fbccb98d0534
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/SKILL.md
@@ -2377,7 +2794,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:57a9336d409c883dc9a78aa92a9f0075fac6f8e4aac6ee8fdab705055ef85162
+  content_hash: sha256:492d0895374b31f6b65068fd388f0161b47ddffdafc99a571cec4ae1faa0f798
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/assets/vale/.vale.ini
@@ -2440,7 +2857,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:f8a27d7266f4453781712f0bead151580158581a445a641613203a67a1c337d7
+  content_hash: sha256:0029e78e0024c50e8e9d3a57f4ae38c34775468193635fdf37bf806b6228c813
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/references/description-quality.md
@@ -2449,7 +2866,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:2d37eccb4889cade6cbad0deaaed6d1f5fe4c3276c5438c244b2f87ae27bf432
+  content_hash: sha256:bddde053e051cc3e66db46dfbf2f8b422618ecf2f918e3ad5deb2d9dc2433e03
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/references/file-structure.md
@@ -2458,7 +2875,16 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:b24638bd639ef048da171f6dc711e345749cde3c70ec6ba1b7fcbd696b921841
+  content_hash: sha256:3b9d9281eab8dfbbcd403d1a2f253e768d13b258ace4d109d263639f26deff06
+- kind: project-relative
+  target: claude
+  value: .claude/skills/skill-audit/references/finding-criteria.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
+  content_hash: sha256:1e613db280a183f8d44e1bcd76c49b910d14695b27157887f876726efd8824f1
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/references/formatting-and-scripts.md
@@ -2467,7 +2893,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:5c319866b2f22ba07789dae7b0813132f67196c508e8da23971307c2a9e57095
+  content_hash: sha256:34a9b3e66b0f1852634a286891c0a9c00cb17bc49ddaa0b039c86f48f12bc282
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/references/patterns.md
@@ -2476,7 +2902,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:4a942ab30b95dc0cbf0fbe7da3b91157f166bce80cbd17bcf60dc365ea9237af
+  content_hash: sha256:411c0e9f00731c9c5258bb3fcebc74c1208ad8b51740e2fe41810cf72f7951fd
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/references/sources.md
@@ -2485,7 +2911,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:1db16ea23884ac2db799b42d1284daaab4b24eb94f184a95fb67ddc280385934
+  content_hash: sha256:d3bd14466fede4b62f6ac3d2b40712befcb028ed005c192beddeea31da752d8a
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/references/validation-scripts.md
@@ -2494,7 +2920,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:44f3b82413b57f2b5671637bb449a4c01b6d5fcd9059245aaa38e45108adf480
+  content_hash: sha256:e1436269c2e5f8ed15abd65bcbed0619c5b84618f327ec90a28634980376dcef
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/scripts/vale-wrap.sh
@@ -2512,7 +2938,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:015376c5ad1f6bb6b53549537317a55e3ac06cd4e347451dba85879a3928ccbe
+  content_hash: sha256:47bd47b710652358ebc687adf370516f1aa25b228d2dace9b49e5bc725eb6f2b
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-audit/scripts/validate.sh
@@ -2521,7 +2947,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:7ce27df82e4160c6296db6c8314865f022da5c4334151857570a86167c8d4e11
+  content_hash: sha256:1eaae273885f6a68b29086eca60ca72adb83a33d3391037b9461105d7fe9bf01
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-author
@@ -2620,7 +3046,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:d350721118a2bd57094fa9151f11b48a663a1c8a04e50fba71ff2baf64b7282f
+  content_hash: sha256:8b4b1f4f05d5ee5398a332cc2ee48d59f0a09105dd84049f59ca040bda6f65dc
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-author/references/create.md
@@ -2656,7 +3082,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/kyberforge
-  content_hash: sha256:6c8336caa717f2abd38cb1f9c776479c0e908f7dbf577021d3689b375287dc77
+  content_hash: sha256:414cf356bc7a23bc7af1f2b918159458bd59f3a35f48f00762718baa9f935918
 - kind: project-relative
   target: claude
   value: .claude/skills/skill-author/references/scripts.md
@@ -2693,6 +3119,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: null
+- kind: project-relative
+  target: claude
+  value: .claude/skills/tdd/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:ee7c9de4eb494f8a0e4e67153a5b44b560f7e53cc35f5ebdfbeb6dfa5bd1ed16
 - kind: project-relative
   target: claude
   value: .claude/skills/tdd/SKILL.md
@@ -2701,7 +3136,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:af059705061156fd4845ddbb736fe92b564118ac5f03551e09ef9e8f6d970638
+  content_hash: sha256:46bc2a4c55b15e96fdd002167f37b43245e64fcbecb61daed11eac6e0d026da8
 - kind: project-relative
   target: claude
   value: .claude/skills/tdd/deep-modules.md
@@ -2764,7 +3199,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:1c71c747aa97d938f75ec7a4b8fe87451763b38a3ce6348acf2b222e5819b2e5
+  content_hash: sha256:e34b7e9359b8b2b95b4d9795864f2a8ef5ef4f60b3632ddcb5563937110c71e0
 - kind: project-relative
   target: claude
   value: .claude/skills/triage/OUT-OF-SCOPE.md
@@ -2774,6 +3209,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: sha256:8ed8cf27833444060c81b3961a83c0e3d8e6cf2fcb2ddf6f8b07c6655cbb0d85
+- kind: project-relative
+  target: claude
+  value: .claude/skills/triage/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:9144c8d3262ad42f09d430e4cad17c16310919d68a91c17ac36f1285f6b4110b
 - kind: project-relative
   target: claude
   value: .claude/skills/triage/SKILL.md
@@ -2782,7 +3226,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:b819f0285e4e5814ac6472d0217f07dc9f23d2fdae3ebb0dd31d98360d8ac029
+  content_hash: sha256:42042bf7c3e6392d1ff0a0536fe0692fa710d6818e2501db77c7f22fa6e423cb
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-config
@@ -2800,7 +3244,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:faf6bca23cea74be7ecf47a31b0499af2f6ce791bbc82eb67069e1e67eeed07c
+  content_hash: sha256:d4326ddeab98d7fe24bcc7116ca059e4da8f6bc15981fef856803e3a0fef398d
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-config/SKILL.md
@@ -2809,7 +3253,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:1674f1256b654779268c42f764fa0c4f09011ce8ea62eb0e01fd8f118495519b
+  content_hash: sha256:2e2500f871b39b9168e45b8e8fb731c964637202b59368c193c20d96da8cd84b
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-config/references/configuration-reference.md
@@ -2818,7 +3262,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:1c2dbee6315178b00e624c002a6ae8d9d20f03f2c7ff1c3fba4eebe38fb39a7f
+  content_hash: sha256:1c4e22183d55809e79add7e3af353f5caaef903133b9c3f5088cc37f5230e47b
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-config/references/sources.md
@@ -2827,7 +3271,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:2efa451c3cc6bdc1103cfe56712a3ea35acef9a76fe4c6f71e8cacabd92dc860
+  content_hash: sha256:71c73879827bdcd86019bb1faba20bb4bf02ccf610e939412110079efcd9a8ab
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-run
@@ -2845,7 +3289,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:1a850c89cf7de288dc72b96cae6fec24a3ccdc237f0ce785f59cca56c7762198
+  content_hash: sha256:f25930095a9f9bba09ba3ff53b53606a40b2e5fddeb63cf071ed18c0b4076dcb
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-run/SKILL.md
@@ -2854,7 +3298,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:16c42c97de14ef20296b9dfce46b0e2f9be6ad68751c35975251cecff80f79d9
+  content_hash: sha256:d5b5e87e51f145e3c4b9e91d23070bbb938ba19b07af30e92400f353ad7fd50a
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-run/references/sources.md
@@ -2863,7 +3307,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:1f46b727e5f3db09d6c8c01c8a615bad60ce2c5b3a01226e1a3fd3b933330bc7
+  content_hash: sha256:c902480e6ba35926c58b2ce9233434340a5e4ec4f09cd112135c3f58f91b98c5
 - kind: project-relative
   target: claude
   value: .claude/skills/vale-run/references/troubleshooting.md
@@ -2872,7 +3316,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/lint
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/lint
-  content_hash: sha256:b4c2bc67b413b102d9fe1cd7e5a248b19aba3dc3b60b4429e777977cf8021cd5
+  content_hash: sha256:3609993547c96c43b3b0f313e9f3c0611214cf14aad8420c2a168dc26c055115
 - kind: project-relative
   target: claude
   value: .claude/skills/write-docs
@@ -2882,6 +3326,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: null
+- kind: project-relative
+  target: claude
+  value: .claude/skills/write-docs/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:6d6310785603c1f4653be2ae9ffb37008cbe22eee49aed02ac8076ab20f95bcc
 - kind: project-relative
   target: claude
   value: .claude/skills/write-docs/SKILL.md
@@ -2890,7 +3343,7 @@ deployments:
   owners:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
-  content_hash: sha256:0d06d0f6836a67532497ea61bd5a1294a8d80f529bf1ffb5c4b1fdc72e9cb51a
+  content_hash: sha256:25af5dc9e67a0755bc7a2cb99a1008156ba1fd17b283bdb5cc82dfccdb834421
 - kind: project-relative
   target: claude
   value: .claude/skills/zoom-out
@@ -2900,6 +3353,15 @@ deployments:
   - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
   content_hash: null
+- kind: project-relative
+  target: claude
+  value: .claude/skills/zoom-out/README.md
+  runtime: null
+  scope: project
+  owners:
+  - git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  active_owner: git.dev.rkdr.net/Defame1297/holocron/plugins/bin
+  content_hash: sha256:5c80fbcf7fc6ee5117872b146aacd630a3d2f2d86693e06aef2e3c8eea9115cf
 - kind: project-relative
   target: claude
   value: .claude/skills/zoom-out/SKILL.md
diff --git a/apm.yml b/apm.yml
index 4584124..b7fac37 100644
--- a/apm.yml
+++ b/apm.yml
@@ -42,7 +42,7 @@ dependencies:
 # after a kyberforge release, check this first.
 executables:
   allow:
-    kyberforge#1.6.1:
+    kyberforge#1.6.2:
       hooks: true
       bin: true
 
@@ -79,25 +79,25 @@ marketplace:
     - name: kyberforge
       description: Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
       source: ./plugins/kyberforge
-      version: 1.6.1
+      version: 1.6.2
       category: Developer Tools
 
     - name: bin
       description: Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.
       source: ./plugins/bin
-      version: 1.1.6
+      version: 1.1.7
       category: Utilities
 
     - name: git
       description: Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.
       source: ./plugins/git
-      version: 1.3.6
+      version: 1.3.7
       category: Version Control
 
     - name: gitea
       description: Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.
       source: ./plugins/gitea
-      version: 1.3.7
+      version: 1.3.8
       category: Version Control
 
     - name: core
diff --git a/docs/adr/0022-skill-metadata-version-is-mandatory.md b/docs/adr/0022-skill-metadata-version-is-mandatory.md
new file mode 100644
index 0000000..7885a9a
--- /dev/null
+++ b/docs/adr/0022-skill-metadata-version-is-mandatory.md
@@ -0,0 +1,78 @@
+# Every skill's `metadata.version` is mandatory, not a per-plugin option
+
+**Status: accepted (2026-09-07).**
+
+## Context
+
+`metadata.version` is optional SKILL.md frontmatter (`create.md`'s "Optional frontmatter" list:
+"uncomment and fill in, or remove entirely"). `skill-author`'s own bump logic was written
+conditionally — "with `metadata.version` present, bump the minor version on create... and the
+patch version on improve" — which only makes sense if presence is a real per-skill choice.
+
+Adoption never followed a rule; it followed the plugin. Of 39 skills, 12 carry a version:
+
+| Plugin | Has it | Total |
+|---|---|---|
+| `core` | 3 | 3 |
+| `gitea` | 6 | 7 |
+| `lint` | 2 | 2 |
+| `git` | 1 | 9 |
+| `bin` | 0 | 11 |
+| `kyberforge` | 0 | 7 |
+
+`core`, `gitea` and `lint` are consistent adopters (`gitea-files` the one gap); `bin` and
+`kyberforge` are consistent non-adopters; `git` has one outlier (`git-commits`, versioned for no
+plugin-specific reason found on inspection — no comment, no cross-reference, nothing distinguishing
+it from its eight siblings). Issue #127 raised this as an undocumented split: two house norms
+coexisting with no stated rule for which applies where, the same class of defect as an unstated
+`rtk`/bare-`git` convention (#113) found in the same audit pass.
+
+## Decision
+
+**Every skill's frontmatter carries `metadata.version`.** It is no longer optional, and no longer a
+per-plugin choice.
+
+- **The 27 skills that never carried one are seeded at `1.0.0`**, not `0.1.0`. `0.1.0` is
+  `skill-author`'s existing new-skill starting point, chosen for a skill with no revision history to
+  its name yet. These 27 have all been through the ADR-0020 retrofit and repeated audit passes
+  without ever tracking a version; crediting them with `0.1.0` would understate that, and there is
+  no real history to justify seeding higher than a first stable release. `1.0.0` marks "versioned as
+  of this retrofit," `0.1.0` keeps meaning "created and never yet revised."
+- **New skills still start at `0.1.0`.** `skill-author`'s create/improve bump convention is
+  unchanged; only the presence of the field stops being conditional.
+- **The one outlier in the other direction, `git-commits`, keeps its existing value** (`0.1.3`) —
+  it already had real tracked history under the old conditional rule, and this decision does not
+  reset skills that were already compliant.
+- **`bin/write-docs`'s top-level `version:` moves into `metadata:`, normalized to `1.0.0`.** It is
+  the one skill that carried a version outside the `metadata:` block, which is why the table above
+  counts `bin` as 0 — a top-level `version:` is not `metadata.version`, and nothing reads it. #127
+  raised it alongside the split because "does a skill carry a version" and "where does it live" are
+  the same question. Its value (`1.0`) is not semver and carries no more real history than the 27
+  unversioned skills, so it is relocated and reset to the same `1.0.0` seed rather than preserved
+  like `git-commits`'s tracked `0.1.3`.
+- **`skill-frontmatter`'s pre-commit hook gains the check.** It already fails a SKILL.md missing
+  `name:` or `description:`; a missing `metadata.version` is now the same class of failure, not a
+  style nit an audit might or might not catch.
+
+## Considered options
+
+**Leave it per-plugin, document the split.** This was the initial framing of #127 and is coherent —
+`core`/`gitea`/`lint` keep it, `bin`/`kyberforge` don't, two outliers get normalized to match their
+plugin. Rejected on reconsideration: a rule that says "some plugins track this and some don't" is
+strictly harder to state, audit and onboard against than "every skill does," for a field whose entire
+job is answering "did this change since I last read it" — a question with the same shape everywhere
+it's asked, not one that varies by plugin domain.
+
+**Drop the field corpus-wide.** Rejected: `skill-author` already depends on it to decide whether a
+create/improve pass owes a bump, so the 12 skills carrying it are not tracking dead weight — removing
+it discards real revision signal for no gain.
+
+## Consequences
+
+27 SKILL.md files gain `metadata.version: "1.0.0"`, and a 28th — `bin/write-docs` — reaches the same
+value by relocating its top-level `version: "1.0"` into `metadata:`. `skill-author`'s `create.md`
+moves the field from "Optional frontmatter" to the required list, citing this ADR. `skill-author`'s
+own SKILL.md drops the "with `metadata.version` present" conditional in its bump-rule line, since
+presence is no longer in question. `.pre-commit-config.yaml`'s `skill-frontmatter` hook is extended
+to require the field, closing the gap #113 and #118 both named in the same audit pass: a stated rule
+with nothing enforcing it drifts the same way an unstated one does.
diff --git a/docs/adr/0023-rtk-prefix-marks-executable-commands-only.md b/docs/adr/0023-rtk-prefix-marks-executable-commands-only.md
new file mode 100644
index 0000000..3fa666f
--- /dev/null
+++ b/docs/adr/0023-rtk-prefix-marks-executable-commands-only.md
@@ -0,0 +1,168 @@
+# The `rtk` prefix marks executable commands only, and is repo-wide
+
+**Status: accepted (2026-09-08).**
+
+## Context
+
+`CLAUDE.md` states the org convention as a golden rule: "Always prefix commands with `rtk`. If RTK
+has a dedicated filter, it uses it. If not, it passes through unchanged. This means RTK is always
+safe to use." Issue #113 observed that the rule had never been written down for skill *prose*, where
+a `git <subcommand>` mention can be either an instruction to execute or a reference to the concept,
+and that the corpus had drifted into carrying both spellings with no stated rule. PR #130 swept the
+`git` plugin and recorded a two-way split in `plugins/git/README.md`.
+
+Review found two defects in that sweep, and both are in the premise rather than the execution.
+
+**RTK is not output-transparent.** `rtk git --help` enumerates twelve filtered subcommands — `diff`,
+`log`, `status`, `show`, `add`, `commit`, `push`, `pull`, `branch`, `fetch`, `stash`, `worktree`.
+Everything else is a true passthrough. Inside that set the filter is not a formatting preference; it
+changes what the command *reports*. Measured against rtk 0.42.4:
+
+| Command | What rtk does to it |
+|---|---|
+| `worktree list --porcelain -z` | discards both flags; no NUL separators, no `locked`/`lock_reason` field at all |
+| `worktree list -v` | abbreviates `/root/…` to `~/…`, collapses column alignment |
+| `branch --list <name>` | emits a phantom `* ` line even on no match |
+| `diff --name-only` / `--name-status` | appends a blank line and a `Changes:` trailer |
+| `diff --word-diff[=color\|=porcelain]` | emits no `[-removed-] {+added+}` markers; substitutes a diffstat |
+| `log -L` | truncates each diff body line at ~72 characters with an ellipsis |
+| `stash pop` (on conflict) | prints only `FAILED: git stash pop`, swallowing `CONFLICT`, `Unmerged paths` and the retained-entry notice |
+| `stash list` (empty) | prints `No stashes` where git prints nothing |
+
+Every one of those falsified a skill that was written against the bare output. `git-worktrees`'s
+Step 2 required `locked` and `lock_reason` from a command whose rtk rendering has never carried
+them; `git-log-format.md` documented `[-removed-] {+added+}` markers beside a command that no longer
+produces them. The two-way split could not see any of this, because both halves of it are about what
+a *sentence* is doing and none of it is about what the *command* does.
+
+**The rule is not `git`-plugin-scoped.** `plugins/git/README.md` claimed the `gitea-*` skills
+"contain no `git`/`rtk` mentions at all". Five `gitea-*` SKILL.md files run `git remote get-url
+origin` in a fenced ```bash Step block — the README's own canonical example of "executable,
+instructed" — plus `git branch --show-current` in a reference file and three `git remote -v` in
+`gitea-orchestrate.agent.md`. A convention stated inside one plugin's README is invisible from the
+plugin next door, which is how those eight sites stayed bare through the sweep that existed to find
+them.
+
+## Decision
+
+**One rule, three clauses, repo-wide** — every `plugins/*/.apm/skills/**` and
+`plugins/*/.apm/agents/**` file, not the `git` plugin alone.
+
+1. **Executable and instructed → `rtk git`.** Anything telling the agent to run a command now: an
+   imperative step, a dispatch-table "Run" cell, a fenced code-block procedure.
+   `rtk git push -u origin <branch>`.
+2. **Illustrative or referential → bare `git`.** Naming a flag's behaviour, quoting a doc's own
+   heading, describing a command in the abstract, warning against an anti-pattern. "`git switch`
+   refuses rather than clobbering conflicting local edits."
+3. **Machine-parsed or interactive → bare `git`, and say why inline.** A command whose output the
+   skill parses, where rtk is in the filtered set above; or a command that hands control to an
+   interactive child process.
+
+Clause 3 is the new one and it looks arbitrary without the table in Context, which is why the
+measurements are recorded here rather than left in a PR thread. It is applied per subcommand and per
+flag, not per skill: `tag --list` stays prefixed because rtk passes it through byte-identically,
+while `branch --list` two words away goes bare because it does not. `git remote get-url origin`,
+`git remote -v`, `git branch --show-current`, `git log --oneline -1` and `git add -u` were all
+re-measured as byte-identical passthroughs and are therefore prefixed, parsing notwithstanding.
+
+Two consequences of that per-subcommand basis are worth stating, because both are load-bearing and
+neither is comfortable:
+
+- **rtk's filtered set is a moving target.** `git rebase` and `git mergetool` are passthroughs on
+  0.42.4 — verified under `script(1)`, both inherit a real TTY, contradicting an earlier report that
+  they did not. They stay bare anyway, on the interactive limb: a token filter has nothing to offer a
+  command that hands control to an editor, and the prefix would only buy exposure to whatever a later
+  rtk version decides to do with those subcommands. The same reasoning makes the *inner* call in
+  `` `rtk git remote add origin-push $(git config remote.origin.url)` `` bare while the outer stays
+  prefixed — `config` passes through cleanly today, but its stdout becomes a remote URL that is then
+  force-pushed to, and that is not a blast radius to lend to a future filter change.
+- **`branch --show-current` sits on the sharp edge.** It is in the filtered set, it is parsed, and it
+  is prefixed — on a measurement, in a subcommand whose sibling `--list` is exactly the defect clause
+  3 exists for. If rtk's `branch` filter is ever extended, that is the first site to break. It is
+  called out rather than hedged, because a rule whose exceptions are unrecorded is the state this ADR
+  is replacing.
+
+**A clause-3 site says so inline, in a few words.** "bare, not `rtk`: rtk prints a phantom `* ` line
+even on no match". Without it the next sweep re-prefixes the command, which is how #113 recurs.
+
+**The rule lives here, and `docs/spec/gates.md` carries the gate.** `plugins/git/README.md` is
+reduced to a pointer. It had also cited `git-workflow/references/hard-rules.md` as a place the rule
+was written down; that file contains no occurrence of "rtk", and the citation is removed rather than
+repaired.
+
+**Clause 1 is enforced by a `check-rtk-prefix` pre-commit hook; clauses 2 and 3 are not enforceable
+and are not gated.** The hook checks the two places a `git` mention is unambiguously an instruction —
+a line in a shell-tagged code fence, and the opening backticked span of a "Run" column cell — and a
+deliberately-bare command opts out with the literal string `ADR-0023` on its own line. Its coverage
+limits are recorded in `docs/spec/gates.md`, not smoothed over.
+
+## Considered options
+
+**Add `compatibility:` frontmatter to every skill.** These six plugins are installable by third
+parties, and a consumer who installs `git` from the marketplace has no `rtk` on their PATH. Every
+prefixed command in the corpus is a plain `git` invocation with a word in front of it, so the prefix
+is *droppable*: delete `rtk ` and the command is correct. A `compatibility:` line per skill would
+state that in a machine-readable field. Rejected on cost. It is 39 lines of frontmatter restating one
+sentence, it is preloaded into every agent's context every session under ADR-0020's budget — the
+field is not free the way a line in a doc is — and it has no consumer: nothing reads
+`compatibility:`, so the field would be a comment with a colon in it. The consumer situation is
+documented here and in `plugins/git/README.md` instead, which is where a human installing a plugin
+actually looks. The same two-line note is owed to the other five plugin READMEs and is not yet
+written.
+
+**Move rtk to the execution layer entirely.** Skills instruct bare `git` throughout; `CLAUDE.md`'s
+session rule handles prefixing at the point of execution. This is the strongest rejected option and
+it deserves the space: it closes the consumer gap and all eight output defects at once, because the
+executing agent knows what it is about to parse and the skill does not have to predict it. It also
+removes clause 3 entirely — there is nothing to except. Rejected because the prefix is lost wherever
+an agent copies a command literally, which is the common case for a fenced procedure block and the
+whole reason dispatch tables exist. The org convention's value is that the prefix is *already there*
+in the text the agent lifts; a rule that relies on the agent remembering to add it is the rule that
+produced the drift in the first place. Worth revisiting if rtk ever ships a shell shim, which would
+make the execution layer transparent and this trade different.
+
+**Keep the two-way split and fix the eight sites by hand.** Rejected: the split has no vocabulary for
+"this command is executable, instructed, and must still be bare", so the eight sites would be
+unexplained exceptions and the next sweep re-prefixes them. That is the failure this ADR exists to
+stop, not a smaller version of it.
+
+**Gate clauses 2 and 3 as well.** Rejected as undecidable. "Run `git switch <branch>`" and "`git
+switch` refuses rather than clobbering local edits" are the same token sequence; separating them is a
+judgement about what a sentence is doing. A gate that guessed would fire on correct content, and a
+gate that fires on correct content gets added to `SKIP`, which disarms clause 1 along with it.
+
+## The boundary the rule does not decide
+
+Two shapes in the corpus resisted the two-way split. The three-clause rule resolves one and does not
+resolve the other; both are recorded so an author meeting a third one knows which kind it is.
+
+**`git-worktrees/SKILL.md`'s tracking row carries both spellings in one Run cell** — `rtk git
+worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add
+<path> <branch>` expands to exactly this. **Resolved: the clauses apply per mention, not per row,
+per cell or per file.** The first is the instruction (clause 1), the second names what the first
+expands to (clause 2), and one table cell can hold one of each. The rule needed no change; the
+*gate* did, and it checks only a Run cell's opening span for exactly this reason.
+
+**`git-submodules/references/setup-and-update.md:80` has a git command inside a quoted argument to
+another command** — `rtk git submodule foreach 'git pull origin main || :'`. **Not resolved: all
+three clauses describe a command the reading agent executes, and the inner `git pull` is not one.**
+It is the literal text of an argument that `git submodule foreach` hands to a subshell running inside
+each submodule's own working tree, where the local convention does not reach. The file already gets
+this right and already justifies it in prose two lines below ("the git calls in it are the
+submodule's own — that is the one place a bare `git` is correct"). **An author meeting this shape
+should do the same: leave the inner command bare and justify it inline.** It is deliberately not
+promoted to a fourth clause on one instance. The gate does not decide it either — it happens to pass
+this line, because the segment containing the inner command begins with `rtk`, and that is an
+accident of the split rather than an understanding of quoting.
+
+## Consequences
+
+Eleven sites in `plugins/git/.apm/skills/**` revert to bare `git` under clause 3, each carrying a
+short inline reason. Eight sites across `plugins/gitea/.apm/skills/**` and
+`plugins/gitea/.apm/agents/gitea-orchestrate.agent.md` gain the prefix under clause 1, and one in
+`pc-run/SKILL.md` that the #130 sweep's grep missed because the backtick opens with `SKIP=` rather
+than `git `. `plugins/git/README.md`'s Conventions section becomes a pointer here, minus a paragraph
+that was false about the `gitea-*` skills and a citation to a file that does not carry the rule.
+A `check-rtk-prefix` pre-commit hook and `tests/test-check-rtk-prefix.sh` land with it; the test runs
+the gate against the pre-sweep corpus on `main` and asserts it fails there, because a gate that only
+passes on the fixed tree proves nothing about the drift it was written for.
diff --git a/docs/notes/factory-integration-decisions.md b/docs/notes/factory-integration-decisions.md
index d88852b..4a44458 100644
--- a/docs/notes/factory-integration-decisions.md
+++ b/docs/notes/factory-integration-decisions.md
@@ -53,8 +53,7 @@ All skills — new and rebuilt — must follow this standard:
 - `name:` — matches directory name
 - `description:` — trigger-tested before writing the body (explicit, implicit, negative cases)
 - `metadata: category:` — from the category table above
-
-`version:`, `updated:`, `when:`, `source:`, and `references:` are provenance/audit fields — they live in `META.md` alongside the SKILL.md (not in frontmatter). See `META-TEMPLATE.md` in `.agents/skills/write-skill/` for the META.md schema.
+- `metadata: version:` — mandatory for every skill (ADR-0022)
 
 **Body required sections:**
 - Constraints (highest-ROI element — prevents overengineering)
diff --git a/docs/notes/skill-implementation-workflow.md b/docs/notes/skill-implementation-workflow.md
index 4fc93d9..7ce7a2c 100644
--- a/docs/notes/skill-implementation-workflow.md
+++ b/docs/notes/skill-implementation-workflow.md
@@ -103,21 +103,21 @@ Do not write the SKILL.md until the human has confirmed every section. The synth
 **c. SKILL.md** (sub-agent)
 Once all sections are confirmed, spawn a write agent to produce the SKILL.md using `write-skill` (or hand-write for bootstrap skills). The agent receives: trigger description, per-section decisions from step b, upstream content to incorporate, authoring standard (see below).
 
-**c. META.md — `source:` and `references:` fields**
-Populate `META.md` after upstream review. Two distinct fields:
-- `source:` — upstream provenance tracking (repo slug, commit SHA, files adopted with inline comments, updated date). Present only if content was adopted. Absence = self-authored.
-- `references:` — general citations (research papers, documentation, standard specifications). Present only if the skill cites external research.
+**d. Provenance — source and reference records**
+Record provenance after upstream review. Two distinct kinds:
+- Upstream provenance (repo slug, commit SHA, files adopted with inline comments, updated date). Present only if content was adopted. Absence = self-authored.
+- General citations (research papers, documentation, standard specifications). Present only if the skill cites external research.
 
-Both fields live in `META.md` alongside the SKILL.md — not in frontmatter. See `META-TEMPLATE.md` in `.agents/skills/write-skill/` for the full schema.
+Both are recorded in the skill's own `references/sources.md`, keyed by the `source_keys:` its SKILL.md and reference files declare. `validate-provenance.sh` checks that chain.
 
-**d. eval.yaml** (sub-agent)
+**e. eval.yaml** (sub-agent)
 Invoke `write-eval` in two steps to preserve its confirmation gate:
 1. Sub-agent proposes test cases and returns the plan to the main conversation.
 2. Human confirms the plan; then sub-agent writes the file.
 
 Do not pass pre-designed test cases directly to a write agent — that collapses the plan-then-confirm gate into a single step, bypassing write-eval's own constraint. Co-located at `.agents/evals/<category>/<skill-name>/eval.yaml`. Must contain all five required test types (see Eval schema below).
 
-**e. HITL behavioral test**
+**f. HITL behavioral test**
 Human opens a fresh Claude session, invokes the skill with its trigger phrase, and verifies output. Do not batch more than 2–3 skills before running behavioral tests — output volume must stay within genuine human review capacity. An approval that cannot be meaningfully evaluated is not an approval.
 
 ### Step 6 — Session handoff
@@ -157,12 +157,11 @@ name: skill-name
 description: <trigger description — routing only; written and tested first; max 1024 chars>
 metadata:
   category: <design|factory|implement|test|review|deploy|operate|cross-cutting|iac>
+  version: <semver — mandatory for every skill; see ADR-0022>
 # allowed-tools: <add only when the skill has a narrow, well-defined tool surface; omit otherwise>
 ---
 ```
 
-Frontmatter contains only these fields. `version`, `updated`, `when`, `source`, and `references` are provenance/audit fields — they are not used for routing or runtime execution. They live in `META.md` alongside the SKILL.md, loaded only when needed. See `META-TEMPLATE.md` in `.agents/skills/write-skill/` for the META.md schema.
-
 ### Body sections
 
 Use `.agents/skills/write-skill/SKILL-TEMPLATE.md` as the authoritative structure reference. The template defines the required sections, correct order, XML grouping, and placeholder comments for each section.
@@ -230,6 +229,6 @@ Upstream review happens per-skill during step 2, not once at chunk start.
 
 ## Open decisions carried forward
 
-- **Bidirectional reference convention** — Chunk 4 (reference scanner tooling; reverse map "what files point to X?"). The `when:` field itself is resolved — it lives in `META.md` alongside every skill.
+- **Bidirectional reference convention** — Chunk 4 (reference scanner tooling; reverse map "what files point to X?").
 - **PRD/issue template scope** — refined during `write-prd` (0020) and `write-issue-spec` (0019) implementation
 - **Merging `zoom-out` into architect role** — revisit at Chunk 5 grill
diff --git a/docs/spec/gates.md b/docs/spec/gates.md
index cdd1e3c..f16c0f8 100644
--- a/docs/spec/gates.md
+++ b/docs/spec/gates.md
@@ -128,12 +128,43 @@ not an authoring change.
 ### `skill-frontmatter`, the other hook on that scope
 
 A second `repo: local` pre-commit hook, `skill-frontmatter`, runs on the **same** `files:` pattern at
-the same stage. It is a short shell loop: for each file, `grep -q "^name:"` and
-`grep -q "^description:"`, failing with "missing required frontmatter fields" if either is absent.
+the same stage. It is a shell loop that, **for the YAML frontmatter block only** — everything between
+the opening `---` and the next `---` — asserts four things per file:
 
-**It overlaps ADR-0020's "description present and non-empty" FAIL, and the overlap is not clean.**
-The ADR (`:95-101`) requires that question be decided on the **YAML-folded value** and nowhere else,
-precisely because a line regex gets it wrong in both directions. Measured on fixtures:
+| Check | Rejects with |
+|---|---|
+| a `^name:` line is present | "missing required frontmatter fields (name: …)" |
+| a `^description:` line is present | "missing required frontmatter fields (description: …)" |
+| `metadata:` contains a `^  version:` key, anchored, scanning to the next top-level key | "missing required frontmatter fields (metadata.version)" |
+| that version's value is three-part semver (`1.0.0`, quoted or not) | "has a malformed frontmatter metadata.version (…)" |
+
+Every one of those qualifiers is load-bearing, and each replaced a defect that let the hook report
+Passed having measured nothing. `tests/test-skill-frontmatter.sh` pins all of them:
+
+- **Frontmatter-scoped, not whole-file.** The checks used to `grep` the entire file, so a `metadata:`
+  or `name:` block quoted in a **body code fence** satisfied them — `skill-author`'s own docs quote
+  exactly such a block.
+- **Bounded by the next top-level key, not by `-A10`.** The version check was
+  `grep -A10 "^metadata:" | grep -q "  version:"`, which ran ten lines past the end of the block: a
+  `version:` belonging to a following `source:` list entry counted (`write-docs` and `research` both
+  have a `source:` list immediately after `metadata:`), while a `metadata:` block with more than ten
+  lines before its `version:` was reported missing.
+- **`^  version:` anchored.** `"  version:"` was an unanchored substring, so a deeper-nested
+  `    version:` matched too.
+- **The value is asserted, not just the key.** `plugins/bin/.apm/skills/write-docs/SKILL.md` carried
+  `version: "1.0"` — present, correctly nested, and not a version — through an entire PR under a
+  presence-only check. Two-part `1.0` is a YAML float, not a version string.
+- **The call shape is pinned.** `entry: bash` with `args: ['-c', <script>, …]` needs an explicit
+  arg0 placeholder after the script: without it `bash -c` puts pre-commit's **first** filename in
+  `$0`, where `for f in "$@"` never sees it. A single-file commit — the normal case — therefore ran
+  the loop body zero times and exited 0. The third `args` entry (`skill-frontmatter`) exists solely
+  to absorb `$0`; do not remove it.
+- **An unreadable file is an error, not a pass.** A file with no closing `---` fails with "no closing
+  YAML frontmatter block" rather than falling through to a green.
+
+**It still overlaps ADR-0020's "description present and non-empty" FAIL, and the overlap is not
+clean.** The ADR (`:95-101`) requires that question be decided on the **YAML-folded value** and
+nowhere else, precisely because a line regex gets it wrong in both directions. Measured on fixtures:
 
 | Frontmatter | `skill-frontmatter` | `skill-size-check` |
 |---|---|---|
@@ -145,10 +176,34 @@ against, and it is the only one of the two that objects to a quoted key. Neither
 currently live in the corpus, and the honest reading is that presence is `skill-size-check`'s
 question — the grep's contribution to it is noise on one shape and silence on the other.
 
-What the grep does add is the `name:` key, which **no** ADR-0020 check reads: a `SKILL.md` with no
-`name:` passes `skill-size-check` at exit 0. That is its real and only unique coverage, and the
+What the hook adds that **no** ADR-0020 check reads is two keys: `name:` and `metadata.version`. A
+`SKILL.md` missing either passes `skill-size-check` at exit 0. That is its unique coverage, and the
 reason not to fold it into the size gate on the grounds of redundancy.
 
+#### Why this one stays a shell parser
+
+[`python3` and PyYAML are hard requirements](#python3-and-pyyaml-are-hard-requirements) below records
+that a hand-rolled frontmatter reader on this exact `files:` scope was **deliberately deleted**,
+because "a reader that mis-parses an unfamiliar scalar shape reports a clean pass on a file it never
+measured." That reasoning is about `skill-size-check` and does **not** transfer here. Do not delete
+this hook citing it. Three differences:
+
+1. **It answers a strictly narrower question.** `skill-size-check` must know the *folded value* of a
+   `>`-block scalar to count its characters, which is where a line reader diverges from a parser —
+   one corpus description measured 270 characters parsed and 412 unparsed. This hook asks only
+   whether a key is on a line and whether one short **plain scalar** matches `N.N.N`. There is no
+   folding, no multi-line value, and no measurement to get subtly wrong.
+2. **It is frontmatter-scoped.** The failure mode that killed the old fallback was silently reading
+   past or short of the block. This one extracts the block explicitly and errors out when it cannot
+   find a closing marker, so "could not parse" is a red, never a green.
+3. **It is pinned by tests.** `tests/test-skill-frontmatter.sh` drives the hook through pre-commit's
+   real `bash -c <script> <arg0> <files…>` invocation and asserts each defect class above. The
+   deleted fallback had no such suite; that is how its disagreement with a real parser survived.
+
+The trade it buys is that the hook stays repo-local. Moving it to a script would change the
+externally exposed `.pre-commit-hooks.yaml` contract for consumers, for a check that has no need of a
+YAML parser.
+
 ### Two independent gate families, neither replaced the other
 
 **Family 1 — agentskills.io spec backstop** (unchanged, conformance not quality):
@@ -413,6 +468,15 @@ reader that mis-parses an unfamiliar scalar shape reports a clean pass on a file
 which is the exact vacuous-green failure the `python3` check exists to avoid. `pip install pyyaml`
 (or `python3 -m pip install PyYAML`, or the distro's `python3-yaml`) if the hook reports it missing.
 
+**Neither requirement generalises to every hook on this scope, and one deliberate exception sits
+right next to it.** [`skill-frontmatter`](#skill-frontmatter-the-other-hook-on-that-scope) runs on the
+same `files:` pattern as a **shell** parser, on purpose — it asks only whether a key is on a line and
+whether one short plain scalar matches `N.N.N`, with no folding to get wrong, and moving it to a
+script would change the externally exposed `.pre-commit-hooks.yaml` contract for consumers. That
+section carries the full argument. A reader arriving here first should not read this one as
+condemning it. `check-rtk-prefix` needs `python3` but **not** PyYAML: it reads the markdown body and
+never touches frontmatter, so it has no scalar to fold.
+
 ## Agent files take the description gates, not the body gate
 
 `check-apm-agents-valid` runs agent-audit's `validate.sh` over every real
@@ -497,6 +561,91 @@ pre-commit run --all-files                    # size AND Vale
 
 Scoping a retrofit off `skill-size-check` output alone leaves you blocked at the second gate.
 
+## The `rtk` prefix gate (ADR-0023)
+
+`check-rtk-prefix` is a `repo: local` pre-commit hook running `scripts/check-rtk-prefix.sh` over
+`^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$`, with `README.md` excluded. It enforces
+**ADR-0023 clause 1 and nothing else**: an executable, instructed local git command in plugin skill
+or agent content is written `rtk git`.
+
+It is wider in file scope than the ADR-0020 hooks — every markdown file under a plugin's
+`.apm/skills/` and `.apm/agents/`, not `SKILL.md` alone — because the rule it enforces is about
+commands an agent runs, and most of those live in `references/`, which the ADR-0020 gates do not
+reach ([the `references/` blind spot](#the-blind-spot-references-is-unlinted-for-two-independent-reasons)).
+
+### What it can decide, and what it declines to
+
+ADR-0023 has three clauses and only the first is a pattern:
+
+| Clause | Rule | Gated |
+|---|---|---|
+| 1 | executable + instructed → `rtk git` | yes |
+| 2 | illustrative / referential → bare `git` | no — undecidable |
+| 3 | machine-parsed or interactive → bare `git` | no — opt-out marker |
+
+Clause 2 is a judgement about what a sentence is *doing*. "Run `git switch <branch>`" and "`git
+switch` refuses rather than clobbering local edits" are the same token sequence. A gate that guessed
+would fire on correct prose, and **a gate that fires on correct content gets added to `SKIP`** —
+which disarms clause 1 along with it. So the hook looks only at the two contexts where a `git`
+mention is unambiguously an instruction to execute:
+
+- a line inside a fenced code block whose info string names a shell — `bash`, `sh`, `shell`, `zsh`,
+  `console`, `shell-session`. Fences tagged `text`, `yaml`, `json`, or tagged with nothing, are **not**
+  checked;
+- the **opening** backticked span of a "Run" column cell in a markdown dispatch table, and only the
+  opening span.
+
+That last narrowing is not fussiness. A Run cell routinely carries a command followed by prose about
+it, and the prose is clause 2. `git-worktrees/SKILL.md` has both shapes on adjacent rows — one cell
+reading `` `rtk git worktree add --track …` `` — always correct. `` `git worktree add <path>
+<branch>` `` expands to exactly this (instruction, then reference), and a `**Never** …` row whose Run
+cell is entirely explanation containing a bare `git push`. Checking every backticked span flags both;
+checking only a leading span flags neither, and still catches the ordinary
+`` | List | `git worktree list -v` | `` case the gate exists for.
+
+### The clause-3 opt-out
+
+A command that is deliberately bare — because rtk rewrites the output the skill parses, or because
+the command is interactive — is exempted by putting the literal string `ADR-0023` **on the same
+line**: in a shell comment for a code line, in the cell text for a table row.
+
+Per line, never per block. A fenced procedure routinely mixes `rtk git` steps with one deliberately
+bare command (`git-remotes/references/push.md` does exactly that), and a block-level marker would
+silently disarm every checked line around the marked one. The cost is a repeated `# bare per
+ADR-0023` in the three blocks of `git-log-format.md` where every line is deliberately bare; that
+repetition is the price of the marked line being the only line the marker speaks for.
+
+The marker is a plain substring match, so a line that mentions `ADR-0023` for an unrelated reason is
+also exempt. Accepted deliberately: the marker records an author's opt-out, it is not a security
+boundary, and a stricter form would only move the same trust to a different string.
+
+### What it deliberately does not cover
+
+- **Clause 2.** Nothing checks that an illustrative mention stayed bare. A sweep that re-prefixes a
+  referential `git` passes this gate. The inline reasons ADR-0023 requires on clause-3 sites are the
+  only defence, and they are prose.
+- **Prose bullets.** Most of `branch-operations.md`, `merging.md` and `rewrite-history.md` instruct
+  in list items, not fences. Those are clause-1 sites the gate cannot see, because it cannot
+  distinguish them from clause-2 mentions in the same list.
+- **`README.md`, excluded by pattern.** A skill-directory README is consumer-facing prose no agent
+  loads, and the `git clone https://github.com/bats-core/…` lines in the seven `tests/README.md`
+  files are setup instructions for a third party who has no `rtk`. Prefixing those would be actively
+  wrong, not merely noisy — see ADR-0023's consumer section.
+- **Quoting.** The line splitter breaks on `;`, `|`, `&&`, `||`, `$(` and backticks without tracking
+  quotes, so a git command inside a quoted argument is decided by accident.
+  `rtk git submodule foreach 'git pull origin main || :'` passes because the segment holding the
+  inner command begins with `rtk` — the right answer for the wrong reason. Write
+  `foreach 'git a; git b'` and the second inner command is a false positive needing the marker.
+  ADR-0023 records this shape as one the rule itself does not decide.
+- **Non-git commands.** Only `git` is checked. `rtk` fronts `gh`, `docker`, `kubectl` and others; no
+  gate covers those, and the corpus does not currently instruct them.
+
+`tests/test-check-rtk-prefix.sh` pins all of it, including the false-positive cases. Its first case
+reconstructs the plugin corpus as it stood on `main` before the #113 sweep and asserts the gate
+fails there with at least 20 findings, one of them the `gitea-*` `git remote get-url origin` drift
+the sweep missed — a gate that only passes on the already-fixed tree proves nothing about the drift
+it was written for.
+
 ## Vale
 
 Install the `vale` binary — `brew install vale` (macOS), `snap install vale` (Linux),
diff --git a/plugins/bin/.apm/skills/caveman/SKILL.md b/plugins/bin/.apm/skills/caveman/SKILL.md
index dea5b4a..542810f 100644
--- a/plugins/bin/.apm/skills/caveman/SKILL.md
+++ b/plugins/bin/.apm/skills/caveman/SKILL.md
@@ -4,6 +4,8 @@ disable-model-invocation: true
 description: >
   Ultra-compressed output mode that drops articles, filler and pleasantries while
   keeping technical substance exact, cutting token usage by roughly 75%.
+metadata:
+  version: "1.0.0"
 ---
 
 Respond terse like smart caveman. All technical substance stay. Only fluff die.
diff --git a/plugins/bin/.apm/skills/diagnose/SKILL.md b/plugins/bin/.apm/skills/diagnose/SKILL.md
index 1e60479..ee85d02 100644
--- a/plugins/bin/.apm/skills/diagnose/SKILL.md
+++ b/plugins/bin/.apm/skills/diagnose/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when the user says "diagnose this" or "debug this", reports something
   broken, throwing, or failing, or says something got slow. Not filing or
   triaging a reported bug -> `triage`. Not test-first feature work -> `tdd`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Diagnose
diff --git a/plugins/bin/.apm/skills/grill-me/SKILL.md b/plugins/bin/.apm/skills/grill-me/SKILL.md
index 1cc8ede..70bb682 100644
--- a/plugins/bin/.apm/skills/grill-me/SKILL.md
+++ b/plugins/bin/.apm/skills/grill-me/SKILL.md
@@ -5,6 +5,8 @@ description: >
   relentless interview — one question at a time, down each branch of the
   decision tree. Not a plan to challenge against `CONTEXT.md` and ADRs ->
   `grill-with-docs`.
+metadata:
+  version: "1.0.0"
 ---
 
 Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
diff --git a/plugins/bin/.apm/skills/grill-with-docs/SKILL.md b/plugins/bin/.apm/skills/grill-with-docs/SKILL.md
index 8610263..cc93aef 100644
--- a/plugins/bin/.apm/skills/grill-with-docs/SKILL.md
+++ b/plugins/bin/.apm/skills/grill-with-docs/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when a plan should be stress-tested against the project's domain model —
   the interview challenges terms against `CONTEXT.md` and writes decisions into
   it and into ADRs as they land. Not a plain interview -> `grill-me`.
+metadata:
+  version: "1.0.0"
 ---
 
 <what-to-do>
diff --git a/plugins/bin/.apm/skills/improve-codebase-architecture/SKILL.md b/plugins/bin/.apm/skills/improve-codebase-architecture/SKILL.md
index 750876a..48803ca 100644
--- a/plugins/bin/.apm/skills/improve-codebase-architecture/SKILL.md
+++ b/plugins/bin/.apm/skills/improve-codebase-architecture/SKILL.md
@@ -6,6 +6,8 @@ description: >
   testable and AI-navigable — deepening opportunities that turn shallow modules
   into deep ones, informed by `CONTEXT.md` and `docs/adr/`. Not debugging a
   failure -> `diagnose`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Improve Codebase Architecture
diff --git a/plugins/bin/.apm/skills/prototype/SKILL.md b/plugins/bin/.apm/skills/prototype/SKILL.md
index 0c9d8e3..b544772 100644
--- a/plugins/bin/.apm/skills/prototype/SKILL.md
+++ b/plugins/bin/.apm/skills/prototype/SKILL.md
@@ -5,6 +5,8 @@ description: >
   a data model, state machine or business logic, or to mock up a UI in several
   variations. Not production code -> `tdd`. Not talking a design through ->
   `grill-me`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Prototype
diff --git a/plugins/bin/.apm/skills/research/SKILL.md b/plugins/bin/.apm/skills/research/SKILL.md
index 19fffee..1d114ab 100644
--- a/plugins/bin/.apm/skills/research/SKILL.md
+++ b/plugins/bin/.apm/skills/research/SKILL.md
@@ -6,6 +6,7 @@ description: >-
   documentation written from existing code or specs -> `write-docs`. Not a bug
   or incident -> `diagnose`.
 metadata:
+  version: "1.0.0"
   category: research
 allowed-tools:
   - Grep
diff --git a/plugins/bin/.apm/skills/tdd/SKILL.md b/plugins/bin/.apm/skills/tdd/SKILL.md
index ad3be57..736773a 100644
--- a/plugins/bin/.apm/skills/tdd/SKILL.md
+++ b/plugins/bin/.apm/skills/tdd/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when the user wants a feature built or a bug fixed test-first, in a strict
   red-green-refactor loop, one behaviour at a time. Not diagnosing an existing
   bug -> `diagnose`. Not throwaway exploratory code -> `prototype`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Test-Driven Development
diff --git a/plugins/bin/.apm/skills/triage/SKILL.md b/plugins/bin/.apm/skills/triage/SKILL.md
index d83ab5e..548026e 100644
--- a/plugins/bin/.apm/skills/triage/SKILL.md
+++ b/plugins/bin/.apm/skills/triage/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when the user wants an issue created, triaged, or moved through the
   tracker's triage states, or an issue prepared for an AFK agent. Not debugging
   the bug itself -> `diagnose`. Not fleshing out a design -> `grill-with-docs`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Triage
diff --git a/plugins/bin/.apm/skills/write-docs/SKILL.md b/plugins/bin/.apm/skills/write-docs/SKILL.md
index 30ea51d..7ca0b97 100644
--- a/plugins/bin/.apm/skills/write-docs/SKILL.md
+++ b/plugins/bin/.apm/skills/write-docs/SKILL.md
@@ -6,10 +6,10 @@ description: >
   module", "create docs for this feature", "write a README for this". Not an ADR
   or other decision record -> `grill-with-docs`. Not an external tool researched
   from its docs -> `research`.
-version: "1.0"
 updated: 2026-05-17
 when: invoked by explicit trigger ("write docs for X", "document this module", "create docs for this feature") or implicit request to produce technical documentation from code or spec
 metadata:
+  version: "1.0.0"
   category: implement
 source:
   - repo: anthropics/skills
diff --git a/plugins/bin/.apm/skills/zoom-out/SKILL.md b/plugins/bin/.apm/skills/zoom-out/SKILL.md
index 1e7a5dc..4ba619a 100644
--- a/plugins/bin/.apm/skills/zoom-out/SKILL.md
+++ b/plugins/bin/.apm/skills/zoom-out/SKILL.md
@@ -2,6 +2,8 @@
 name: zoom-out
 description: Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.
 disable-model-invocation: true
+metadata:
+  version: "1.0.0"
 ---
 
 I don't know this area of code well. Go up a layer of abstraction. Give me a map of all the relevant modules and callers, using the project's domain glossary vocabulary.
diff --git a/plugins/bin/.claude-plugin/plugin.json b/plugins/bin/.claude-plugin/plugin.json
index e1e71ee..ce4a195 100644
--- a/plugins/bin/.claude-plugin/plugin.json
+++ b/plugins/bin/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "bin",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/bin/.github/plugin/plugin.json b/plugins/bin/.github/plugin/plugin.json
index 5f8e98a..bb83d28 100644
--- a/plugins/bin/.github/plugin/plugin.json
+++ b/plugins/bin/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "bin",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/bin/apm.yml b/plugins/bin/apm.yml
index eec10b1..6c15b3e 100644
--- a/plugins/bin/apm.yml
+++ b/plugins/bin/apm.yml
@@ -1,5 +1,5 @@
 name: bin
-version: 1.1.6
+version: 1.1.7
 description: Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.
 author:
   name: Defame1297
diff --git a/plugins/bin/skills/caveman/SKILL.md b/plugins/bin/skills/caveman/SKILL.md
index dea5b4a..542810f 100644
--- a/plugins/bin/skills/caveman/SKILL.md
+++ b/plugins/bin/skills/caveman/SKILL.md
@@ -4,6 +4,8 @@ disable-model-invocation: true
 description: >
   Ultra-compressed output mode that drops articles, filler and pleasantries while
   keeping technical substance exact, cutting token usage by roughly 75%.
+metadata:
+  version: "1.0.0"
 ---
 
 Respond terse like smart caveman. All technical substance stay. Only fluff die.
diff --git a/plugins/bin/skills/diagnose/SKILL.md b/plugins/bin/skills/diagnose/SKILL.md
index 1e60479..ee85d02 100644
--- a/plugins/bin/skills/diagnose/SKILL.md
+++ b/plugins/bin/skills/diagnose/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when the user says "diagnose this" or "debug this", reports something
   broken, throwing, or failing, or says something got slow. Not filing or
   triaging a reported bug -> `triage`. Not test-first feature work -> `tdd`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Diagnose
diff --git a/plugins/bin/skills/grill-me/SKILL.md b/plugins/bin/skills/grill-me/SKILL.md
index 1cc8ede..70bb682 100644
--- a/plugins/bin/skills/grill-me/SKILL.md
+++ b/plugins/bin/skills/grill-me/SKILL.md
@@ -5,6 +5,8 @@ description: >
   relentless interview — one question at a time, down each branch of the
   decision tree. Not a plan to challenge against `CONTEXT.md` and ADRs ->
   `grill-with-docs`.
+metadata:
+  version: "1.0.0"
 ---
 
 Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
diff --git a/plugins/bin/skills/grill-with-docs/SKILL.md b/plugins/bin/skills/grill-with-docs/SKILL.md
index 8610263..cc93aef 100644
--- a/plugins/bin/skills/grill-with-docs/SKILL.md
+++ b/plugins/bin/skills/grill-with-docs/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when a plan should be stress-tested against the project's domain model —
   the interview challenges terms against `CONTEXT.md` and writes decisions into
   it and into ADRs as they land. Not a plain interview -> `grill-me`.
+metadata:
+  version: "1.0.0"
 ---
 
 <what-to-do>
diff --git a/plugins/bin/skills/improve-codebase-architecture/SKILL.md b/plugins/bin/skills/improve-codebase-architecture/SKILL.md
index 750876a..48803ca 100644
--- a/plugins/bin/skills/improve-codebase-architecture/SKILL.md
+++ b/plugins/bin/skills/improve-codebase-architecture/SKILL.md
@@ -6,6 +6,8 @@ description: >
   testable and AI-navigable — deepening opportunities that turn shallow modules
   into deep ones, informed by `CONTEXT.md` and `docs/adr/`. Not debugging a
   failure -> `diagnose`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Improve Codebase Architecture
diff --git a/plugins/bin/skills/prototype/SKILL.md b/plugins/bin/skills/prototype/SKILL.md
index 0c9d8e3..b544772 100644
--- a/plugins/bin/skills/prototype/SKILL.md
+++ b/plugins/bin/skills/prototype/SKILL.md
@@ -5,6 +5,8 @@ description: >
   a data model, state machine or business logic, or to mock up a UI in several
   variations. Not production code -> `tdd`. Not talking a design through ->
   `grill-me`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Prototype
diff --git a/plugins/bin/skills/research/SKILL.md b/plugins/bin/skills/research/SKILL.md
index 19fffee..1d114ab 100644
--- a/plugins/bin/skills/research/SKILL.md
+++ b/plugins/bin/skills/research/SKILL.md
@@ -6,6 +6,7 @@ description: >-
   documentation written from existing code or specs -> `write-docs`. Not a bug
   or incident -> `diagnose`.
 metadata:
+  version: "1.0.0"
   category: research
 allowed-tools:
   - Grep
diff --git a/plugins/bin/skills/tdd/SKILL.md b/plugins/bin/skills/tdd/SKILL.md
index ad3be57..736773a 100644
--- a/plugins/bin/skills/tdd/SKILL.md
+++ b/plugins/bin/skills/tdd/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when the user wants a feature built or a bug fixed test-first, in a strict
   red-green-refactor loop, one behaviour at a time. Not diagnosing an existing
   bug -> `diagnose`. Not throwaway exploratory code -> `prototype`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Test-Driven Development
diff --git a/plugins/bin/skills/triage/SKILL.md b/plugins/bin/skills/triage/SKILL.md
index d83ab5e..548026e 100644
--- a/plugins/bin/skills/triage/SKILL.md
+++ b/plugins/bin/skills/triage/SKILL.md
@@ -4,6 +4,8 @@ description: >
   Use when the user wants an issue created, triaged, or moved through the
   tracker's triage states, or an issue prepared for an AFK agent. Not debugging
   the bug itself -> `diagnose`. Not fleshing out a design -> `grill-with-docs`.
+metadata:
+  version: "1.0.0"
 ---
 
 # Triage
diff --git a/plugins/bin/skills/write-docs/SKILL.md b/plugins/bin/skills/write-docs/SKILL.md
index 30ea51d..7ca0b97 100644
--- a/plugins/bin/skills/write-docs/SKILL.md
+++ b/plugins/bin/skills/write-docs/SKILL.md
@@ -6,10 +6,10 @@ description: >
   module", "create docs for this feature", "write a README for this". Not an ADR
   or other decision record -> `grill-with-docs`. Not an external tool researched
   from its docs -> `research`.
-version: "1.0"
 updated: 2026-05-17
 when: invoked by explicit trigger ("write docs for X", "document this module", "create docs for this feature") or implicit request to produce technical documentation from code or spec
 metadata:
+  version: "1.0.0"
   category: implement
 source:
   - repo: anthropics/skills
diff --git a/plugins/bin/skills/zoom-out/SKILL.md b/plugins/bin/skills/zoom-out/SKILL.md
index 1e7a5dc..4ba619a 100644
--- a/plugins/bin/skills/zoom-out/SKILL.md
+++ b/plugins/bin/skills/zoom-out/SKILL.md
@@ -2,6 +2,8 @@
 name: zoom-out
 description: Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.
 disable-model-invocation: true
+metadata:
+  version: "1.0.0"
 ---
 
 I don't know this area of code well. Go up a layer of abstraction. Give me a map of all the relevant modules and callers, using the project's domain glossary vocabulary.
diff --git a/plugins/git/.apm/skills/git-branches/SKILL.md b/plugins/git/.apm/skills/git-branches/SKILL.md
index 44d79c9..325dd96 100644
--- a/plugins/git/.apm/skills/git-branches/SKILL.md
+++ b/plugins/git/.apm/skills/git-branches/SKILL.md
@@ -9,6 +9,7 @@ description: >
   Not a Gitea remote's branches -> `gitea-branches`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - context7-git-htmldocs
@@ -20,7 +21,7 @@ metadata:
 ## Gotchas
 
 - **Uncommitted changes abort a switch.** `git switch` refuses rather than clobbering conflicting local edits. Offer to stash and retry — forcing the checkout past it is how work disappears.
-- **A branch and a tag can carry the same name.** Detect it before acting — `git branch --list <name>` and `git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
+- **A branch and a tag can carry the same name.** Detect it before acting — `git branch --list <name>` (bare, not `rtk`: rtk prints a phantom `* ` line even on no match, which reports every name as ambiguous — ADR-0023) and `rtk git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
 - **`main` and `master` are a refusal, not a gate.** Force-pushing, force-deleting, or renaming them is rejected even when the caller passes `confirm: true` — no flag makes the remote's history recoverable. Offer a new branch instead.
 
 ## Step 1 — Determine the branching pattern
@@ -51,7 +52,7 @@ These gates are passable. The `main`/`master` refusal in Gotchas is not.
 
 ## Step 4 — Set tracking
 
-A new branch's first push must be `git push -u origin <branch>`. The push itself is `git-remotes`' — every remote-side gate lives there, which is why Step 2's remote-delete row hands off the same way — but the upstream requirement originates here, so carry it in the handoff. Without an upstream, later pushes and pulls either fail or silently target the wrong remote branch, and the caller has no way to tell which happened.
+A new branch's first push must be `rtk git push -u origin <branch>`. The push itself is `git-remotes`' — every remote-side gate lives there, which is why Step 2's remote-delete row hands off the same way — but the upstream requirement originates here, so carry it in the handoff. Without an upstream, later pushes and pulls either fail or silently target the wrong remote branch, and the caller has no way to tell which happened.
 
 ## Step 5 — Return a structured result
 
diff --git a/plugins/git/.apm/skills/git-branches/references/branch-operations.md b/plugins/git/.apm/skills/git-branches/references/branch-operations.md
index b9e29f4..b0d785c 100644
--- a/plugins/git/.apm/skills/git-branches/references/branch-operations.md
+++ b/plugins/git/.apm/skills/git-branches/references/branch-operations.md
@@ -8,21 +8,21 @@ source_keys:
 One command per action. Where two forms exist, the first is the default and the second the escape
 hatch.
 
-- **create** — `git switch -c <branch> <base>`. Base comes from the config's `base_branch`
+- **create** — `rtk git switch -c <branch> <base>`. Base comes from the config's `base_branch`
   (`main` under GitHub Flow, usually `develop` under Gitflow).
-- **switch** — `git switch <branch>` moves to an existing local branch; it aborts rather than
-  clobbering conflicting local changes. `git switch -` returns to the previous branch.
-- **delete (local)** — `git branch -d <branch>` refuses when the branch holds unmerged commits,
-  which is why it is the default. `git branch -D <branch>` forces the deletion and discards that
+- **switch** — `rtk git switch <branch>` moves to an existing local branch; it aborts rather than
+  clobbering conflicting local changes. `rtk git switch -` returns to the previous branch.
+- **delete (local)** — `rtk git branch -d <branch>` refuses when the branch holds unmerged commits,
+  which is why it is the default. `rtk git branch -D <branch>` forces the deletion and discards that
   work — only after the destructive-operation gates pass and `confirm: true` is set.
 - **delete (remote)** — not this skill's. Deleting a remote branch is a push, and every remote-side
   gate lives in `git-remotes`; hand it there rather than running the push from here. Its
   `references/push.md` carries the command and the refspec form.
-- **rename** — `git branch -m <old> <new>`.
-- **list** — `git branch` (local), `-a` (local plus remote-tracking), `-r` (remote-tracking only),
+- **rename** — `rtk git branch -m <old> <new>`.
+- **list** — `rtk git branch` (local), `-a` (local plus remote-tracking), `-r` (remote-tracking only),
   `--merged` / `--no-merged` (filter by merge status into the current branch).
-- **track** — `git branch --set-upstream-to=origin/<branch>` sets an upstream without pushing.
-  `git branch -vv` shows the tracking state of every local branch.
+- **track** — `rtk git branch --set-upstream-to=origin/<branch>` sets an upstream without pushing.
+  `rtk git branch -vv` shows the tracking state of every local branch.
 
 ## get-intent
 
@@ -40,17 +40,20 @@ intent is worse than one built on none.
 A switch aborts rather than clobbering conflicting local changes (see Gotchas). Stash is the way
 past it: it shelves the working tree and index so the branch pointer can move.
 
-- **save** — `git stash push -m "<message>"`. Add `-u` to include untracked files; verified on Git
+- **save** — `rtk git stash push -m "<message>"`. Add `-u` to include untracked files; verified on Git
   2.39.5, a plain `push` leaves them in place, and a plain `push` with *only* untracked changes
   reports `No local changes to save` and stashes nothing. Bare `git stash` is `push` with no message.
-- **restore** — `git stash pop` applies the newest entry and deletes it. `git stash apply stash@{n}`
+- **restore** — `git stash pop` applies the newest entry and deletes it. Bare, not `rtk`: on a
+  conflict rtk prints only `FAILED: git stash pop` and swallows the conflict report the paragraph
+  below tells you to read (ADR-0023). `rtk git stash apply stash@{n}`
   applies without deleting, for replaying one shelf onto more than one branch.
-- **list** — `git stash list`; `git stash show -p stash@{n}` prints that entry's diff.
-- **drop** — `git stash drop stash@{n}` deletes one entry. `git stash clear` deletes all of them
+- **list** — `git stash list` — bare, not `rtk`: rtk prints `No stashes` where git prints nothing,
+  so an empty-output test misfires (ADR-0023). `rtk git stash show -p stash@{n}` prints that entry's diff.
+- **drop** — `rtk git stash drop stash@{n}` deletes one entry. `rtk git stash clear` deletes all of them
   and nothing recovers them — confirm before running it.
-- **branch from a stash** — `git stash branch <branch> stash@{n}` creates a branch at the commit the
+- **branch from a stash** — `rtk git stash branch <branch> stash@{n}` creates a branch at the commit the
   stash was taken from and pops it there. Use it when the stash no longer applies to the current tip.
 
 **A conflicting `pop` keeps the entry.** Verified on 2.39.5: it exits 1, writes conflict markers,
 prints "The stash entry is kept in case you need it again", and `git stash list` still shows it.
-Resolve, `git add`, then `git stash drop` the entry by hand — otherwise it silently accumulates.
+Resolve, `rtk git add`, then `rtk git stash drop` the entry by hand — otherwise it silently accumulates.
diff --git a/plugins/git/.apm/skills/git-branches/references/comparing-branches.md b/plugins/git/.apm/skills/git-branches/references/comparing-branches.md
index 24c3214..cb26f28 100644
--- a/plugins/git/.apm/skills/git-branches/references/comparing-branches.md
+++ b/plugins/git/.apm/skills/git-branches/references/comparing-branches.md
@@ -8,9 +8,9 @@ source_keys:
 The two-dot and three-dot forms mean different things and are easy to swap by accident — check the
 direction before reporting a result.
 
-- `git log main..feature` — commits on `feature` that are not on `main`.
-- `git log feature..main` — the reverse direction: commits on `main` not on `feature`.
-- `git log --left-right main...feature` — both diverging sets at once (symmetric difference).
-- `git diff main...feature` — the diff from the common ancestor to `feature`'s tip, which is what
+- `rtk git log main..feature` — commits on `feature` that are not on `main`.
+- `rtk git log feature..main` — the reverse direction: commits on `main` not on `feature`.
+- `rtk git log --left-right main...feature` — both diverging sets at once (symmetric difference).
+- `rtk git diff main...feature` — the diff from the common ancestor to `feature`'s tip, which is what
   a reviewer sees, rather than the diff between the two tips.
-- `git merge-base main feature` — print the common ancestor commit.
+- `rtk git merge-base main feature` — print the common ancestor commit.
diff --git a/plugins/git/.apm/skills/git-branches/references/merging.md b/plugins/git/.apm/skills/git-branches/references/merging.md
index 0302138..3b122c0 100644
--- a/plugins/git/.apm/skills/git-branches/references/merging.md
+++ b/plugins/git/.apm/skills/git-branches/references/merging.md
@@ -9,22 +9,23 @@ source_keys:
 Scope is fast-forward and merge-commit mechanics plus conflict resolution. Rebase and cherry-pick
 belong to `git-commits`; revert to `git-history`.
 
-- **Fast-forward** — `git merge <branch>` advances the pointer with no merge commit when the
+- **Fast-forward** — `rtk git merge <branch>` advances the pointer with no merge commit when the
   target has not diverged.
-- **True merge** — `git merge --no-ff <branch>` forces a merge commit even when a fast-forward is
+- **True merge** — `rtk git merge --no-ff <branch>` forces a merge commit even when a fast-forward is
   possible. Gitflow requires it on every supporting-branch merge.
-- **Squash merge** — `git merge --squash <branch>` stages the combined diff without committing.
-  Follow it with a `git commit`.
-- **Octopus merge** — `git merge branch-a branch-b branch-c` merges more than two branches at
+- **Squash merge** — `rtk git merge --squash <branch>` stages the combined diff without committing.
+  Follow it with a `rtk git commit`.
+- **Octopus merge** — `rtk git merge branch-a branch-b branch-c` merges more than two branches at
   once, but fails outright on any conflict. Use sequential two-way merges when conflicts are
   likely.
 
 ## Conflict resolution
 
-When Git cannot auto-merge it writes conflict markers and stops mid-merge. Run `git status` to
-list the conflicted files, edit each to resolve its markers, then `git add <file>` and
-`git merge --continue`.
+When Git cannot auto-merge it writes conflict markers and stops mid-merge. Run `rtk git status` to
+list the conflicted files, edit each to resolve its markers, then `rtk git add <file>` and
+`rtk git merge --continue`.
 
-- `git merge --abort` restores the pre-merge state.
-- `git mergetool` opens the configured merge tool.
-- `git diff --diff-filter=U` shows only the still-conflicted files.
+- `rtk git merge --abort` restores the pre-merge state.
+- `git mergetool` opens the configured merge tool — bare, not `rtk`: it hands control to an
+  interactive child process, and a token filter has nothing to offer there (ADR-0023).
+- `rtk git diff --diff-filter=U` shows only the still-conflicted files.
diff --git a/plugins/git/.apm/skills/git-commits/SKILL.md b/plugins/git/.apm/skills/git-commits/SKILL.md
index 59ca602..f1ec375 100644
--- a/plugins/git/.apm/skills/git-commits/SKILL.md
+++ b/plugins/git/.apm/skills/git-commits/SKILL.md
@@ -8,7 +8,7 @@ description: >
   Not branch lifecycle -> `git-branches`.
 
 metadata:
-  version: "0.1.3"
+  version: "0.1.4"
   category: git
   source_keys:
     - conventional-commits-spec
@@ -21,7 +21,7 @@ allowed-tools: Bash
 
 ## Gotchas
 
-- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too.
+- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too. Exceptions: ADR-0023 clause 3.
 - **Refuse to force-push `main`/`master`** — a rewrite leaves the branch diverged and the reflex is to force it back; safe only where nobody else has based work on it.
 - **`reset --hard` is a confirmation gate, not a default.** It overwrites the working tree, and uncommitted edits it discards were never in git, so no reflog recovers them. Name what will be lost and offer a stash first.
 - **Never add `--no-verify`** — using it when a hook fails bypasses the QA gate the pipeline depends on. Only on the user's explicit demand, with a warning.
diff --git a/plugins/git/.apm/skills/git-commits/references/rewrite-history.md b/plugins/git/.apm/skills/git-commits/references/rewrite-history.md
index 88bc993..c86097e 100644
--- a/plugins/git/.apm/skills/git-commits/references/rewrite-history.md
+++ b/plugins/git/.apm/skills/git-commits/references/rewrite-history.md
@@ -21,9 +21,9 @@ Prefer this whenever a commit is written to be folded, because git does the mark
 
 1. `rtk git commit --fixup=<commit>` keeps the target's message; `rtk git commit --squash=<commit>` lets you edit the combined message later. Both prefix the message with `fixup!`/`squash!` and name the target commit.
 2. Get explicit approval — the rebase still rewrites history.
-3. Run `rtk git rebase -i --autosquash HEAD~N`. Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.
+3. Run `git rebase -i --autosquash HEAD~N` — bare, not `rtk`: `-i` opens an interactive sequence editor (ADR-0023). Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.
 
-**`-i` is not optional here.** On Git 2.39.5, `rtk git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.
+**`-i` is not optional here.** On Git 2.39.5, `git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.
 
 ## Squash by hand (interactive rebase)
 
@@ -31,7 +31,7 @@ Use this when the commits were not tagged at commit time. **Interactive rebase h
 
 1. Identify the commits to squash — typically the last N on the current branch.
 2. Get explicit approval.
-3. Run `rtk git rebase -i HEAD~N`, marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
+3. Run `git rebase -i HEAD~N` — bare, not `rtk`, for the same interactive-editor reason — marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
 4. Compose the combined message when the rebase stops to ask. For a non-trivial combined message, follow the structure in `references/commit-template.md`.
 
 ## When a rebase halts on a conflict
diff --git a/plugins/git/.apm/skills/git-history/SKILL.md b/plugins/git/.apm/skills/git-history/SKILL.md
index 6057bee..2a7f62f 100644
--- a/plugins/git/.apm/skills/git-history/SKILL.md
+++ b/plugins/git/.apm/skills/git-history/SKILL.md
@@ -8,6 +8,7 @@ description: >
   `git-commits`. Not a Gitea server's history -> `gitea-branches`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - git-scm-bisect-docs
@@ -34,13 +35,13 @@ allowed-tools: Bash
 
 ## Step 2 — Query the log
 
-Default to `git log --oneline`, then narrow by whatever is known:
+Default to `rtk git log --oneline`, then narrow by whatever is known:
 
-- **Content**: `git log -S"string"`, or `-G"regex"` to match any diff line. `--pickaxe-regex` makes the `-S` argument a POSIX ERE; `--pickaxe-all` shows every file in a matching changeset.
-- **A line or function**: `git log -L <start>,<end>:<file>` or `git log -L :<function>:<file>`. Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
-- **A file across renames**: `git log --follow -- <file>`. Without `--follow` the history stops at the rename boundary.
+- **Content**: `rtk git log -S"string"`, or `-G"regex"` to match any diff line. `--pickaxe-regex` makes the `-S` argument a POSIX ERE; `--pickaxe-all` shows every file in a matching changeset.
+- **A line or function**: `git log -L <start>,<end>:<file>` or `git log -L :<function>:<file>` — bare, not `rtk`: rtk truncates each diff line at ~72 characters (ADR-0023). Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
+- **A file across renames**: `rtk git log --follow -- <file>`. Without `--follow` the history stops at the rename boundary.
 - **Mainline only**: `--first-parent` follows the integration branch and skips commits merged in from side branches.
-- **Structured output**: `git log --format="%h | %s | %an (%ar)"`.
+- **Structured output**: `rtk git log --format="%h | %s | %an (%ar)"`.
 
 If you need the placeholder catalogue, format presets, `--diff-filter` letters, full `-L` syntax, ancestry filters, pickaxe binary-file behaviour, or `git diff` output-control flags such as `--stat`, `--word-diff` and the whitespace options, read `references/git-log-format.md`.
 
@@ -49,8 +50,8 @@ If you need the placeholder catalogue, format presets, `--diff-filter` letters,
 Offer the operation and its consequence; run it only once the user has chosen.
 
 - Backporting the commit to another branch is a cherry-pick, and cherry-pick is `git-commits`' — it owns the destination-branch check, the `rtk git` wrapper and the `--abort` path. Hand it the SHA; do not run `git cherry-pick` from here.
-- `git revert <commit>` adds a new commit undoing it — for un-applying merged work without rewriting history.
-- `git blame <file>` attributes each line to the commit that last touched it, when the question is which commit introduced one specific line.
+- `rtk git revert <commit>` adds a new commit undoing it — for un-applying merged work without rewriting history.
+- `rtk git blame <file>` attributes each line to the commit that last touched it, when the question is which commit introduced one specific line.
 
 For diff output control on the located commit, read `references/git-log-format.md`.
 
diff --git a/plugins/git/.apm/skills/git-history/references/bisect.md b/plugins/git/.apm/skills/git-history/references/bisect.md
index 2fd7026..bfca3e6 100644
--- a/plugins/git/.apm/skills/git-history/references/bisect.md
+++ b/plugins/git/.apm/skills/git-history/references/bisect.md
@@ -12,43 +12,43 @@ or line range to search the log for. Binary search reduces the trials from O(N)
 ## Manual flow
 
 ```bash
-git bisect start
-git bisect bad [HEAD]        # mark current (or specified) as broken
-git bisect good <commit>     # mark known-good baseline
+rtk git bisect start
+rtk git bisect bad [HEAD]        # mark current (or specified) as broken
+rtk git bisect good <commit>     # mark known-good baseline
 # Git checks out the midpoint; test it
-git bisect good              # test passes
-git bisect bad               # test fails
+rtk git bisect good              # test passes
+rtk git bisect bad               # test fails
 # Repeat until git reports "X is the first bad commit"
-git bisect reset             # return to the original HEAD
+rtk git bisect reset             # return to the original HEAD
 ```
 
 ## Automated
 
-With a test command available, use `git bisect run <cmd>`. Git reads the exit code: `0` good,
+With a test command available, use `rtk git bisect run <cmd>`. Git reads the exit code: `0` good,
 `1`–`124` bad, `125` skip (build broken), `126`–`127` POSIX shell errors, treated as bad, and
 `128` or above aborts the session outright rather than marking the commit bad.
 
 ## Untestable commits
 
-`git bisect skip` excludes a commit that cannot be built or tested without deciding good or bad
+`rtk git bisect skip` excludes a commit that cannot be built or tested without deciding good or bad
 for it. When the first bad commit is adjacent to a skipped range, bisect reports that it cannot
 pinpoint the culprit and lists the candidates — that is the precise answer the skip range allows,
 not a failure.
 
 ## Undoing a wrong good/bad call
 
-`git bisect log` prints the session's decision history. Save it, edit out the mistaken entry, and
+`rtk git bisect log` prints the session's decision history. Save it, edit out the mistaken entry, and
 resume from the corrected log rather than restarting the search:
 
 ```bash
-git bisect log > bisect.log
+rtk git bisect log > bisect.log
 # edit bisect.log, removing the wrong decision
-git bisect reset && git bisect replay bisect.log
+rtk git bisect reset && rtk git bisect replay bisect.log
 ```
 
 ## Narrowing and speeding up
 
-- `git bisect start HEAD v1.2 -- src/` restricts bisection to a path, cutting the trial count.
+- `rtk git bisect start HEAD v1.2 -- src/` restricts bisection to a path, cutting the trial count.
 - `--no-checkout` updates the `BISECT_HEAD` ref instead of checking out a working tree — useful
   for tests that do not need one, and automatic in bare repos.
 - `--first-parent` follows only first parents at merges, finding the integration commit that
@@ -56,12 +56,12 @@ git bisect reset && git bisect replay bisect.log
 
 ## Inspecting the remaining candidates
 
-`git bisect visualize` (alias `view`) opens the suspects in gitk, falling back to `git log` when
+`rtk git bisect visualize` (alias `view`) opens the suspects in gitk, falling back to `git log` when
 no graphical display is detected. Add `--stat` or `-p` for a diffstat or full patches.
 
 ## Hunting a non-bug property change
 
-`git bisect start --term-new <new> --term-old <old>` searches for any property change — a
+`rtk git bisect start --term-new <new> --term-old <old>` searches for any property change — a
 performance regression, say — instead of a bug. Use the custom terms in place of `good` and `bad`
 for the rest of the session.
 
diff --git a/plugins/git/.apm/skills/git-history/references/git-log-format.md b/plugins/git/.apm/skills/git-history/references/git-log-format.md
index 821bfdd..2481e09 100644
--- a/plugins/git/.apm/skills/git-history/references/git-log-format.md
+++ b/plugins/git/.apm/skills/git-history/references/git-log-format.md
@@ -116,15 +116,15 @@ source_keys:
 **`-S<string>`** — finds commits where the **count** of `<string>` changed (i.e. the string was added or removed net). Does not match commits where the string merely appears in a diff hunk without a count change.
 
 ```bash
-git log -S"my_function"
-git log -S"my_function" --pickaxe-regex    # treat as POSIX ERE
-git log -S"my_function" --pickaxe-all      # show all files in matching changesets
+rtk git log -S"my_function"
+rtk git log -S"my_function" --pickaxe-regex    # treat as POSIX ERE
+rtk git log -S"my_function" --pickaxe-all      # show all files in matching changesets
 ```
 
 **`-G<regex>`** — finds commits where any added or removed **line** in the patch matches `<regex>`. Broader than `-S`: matches whenever the pattern appears in diff text regardless of count.
 
 ```bash
-git log -G"frotz\(nitfol"
+rtk git log -G"frotz\(nitfol"
 ```
 
 **Critical distinction:** given a diff that removes one occurrence of `foo` and adds one occurrence of `foo` (net change = 0):
@@ -151,8 +151,8 @@ Selects commits (in `git log`) or files (in `git diff`) by change type:
 
 Lowercase letters **exclude** that type:
 ```bash
-git log --diff-filter=ad       # exclude added and deleted files
-git log --diff-filter=M        # only show commits with modified files
+rtk git log --diff-filter=ad       # exclude added and deleted files
+rtk git log --diff-filter=M        # only show commits with modified files
 ```
 
 `C` and `R` only appear when copy/rename detection is enabled (`-C`, `-M` flags or `diff.renames` config).
@@ -161,11 +161,15 @@ git log --diff-filter=M        # only show commits with modified files
 
 Traces the evolution of a specific range of lines or a named function through commits. Implies `--patch`.
 
+Bare `git`, not `rtk git`, on every `-L` form below: rtk truncates each diff body
+line at roughly 72 characters with an ellipsis, on the one query whose whole point
+is showing line content.
+
 ```bash
-git log -L 10,20:file.txt
-git log -L /start_pattern/,/end_pattern/:file.txt
-git log -L :myfunction:src/app.c
-git log -L /init/,+15:config.py          # 15 lines after first match of /init/
+git log -L 10,20:file.txt                          # bare per ADR-0023
+git log -L /start_pattern/,/end_pattern/:file.txt  # bare per ADR-0023
+git log -L :myfunction:src/app.c                   # bare per ADR-0023
+git log -L /init/,+15:config.py                    # bare per ADR-0023; 15 lines after first /init/ match
 ```
 
 Range formats:
@@ -182,12 +186,12 @@ Limitations: incompatible with `--raw`, `--numstat`, `--shortstat`, `--name-only
 ## Graph and Ancestry Filters
 
 ```bash
-git log --first-parent            # at merges, follow only first parent (mainline evolution)
-git log --merges                  # only merge commits (≥2 parents); equivalent to --min-parents=2
-git log --no-merges               # only non-merge commits; equivalent to --max-parents=1
-git log --ancestry-path D..M      # only commits actually on the path from D to M
-git log --min-parents=<n>         # include only commits with ≥ n parents
-git log --max-parents=<n>         # include only commits with ≤ n parents
+rtk git log --first-parent            # at merges, follow only first parent (mainline evolution)
+rtk git log --merges                  # only merge commits (≥2 parents); equivalent to --min-parents=2
+rtk git log --no-merges               # only non-merge commits; equivalent to --max-parents=1
+rtk git log --ancestry-path D..M      # only commits actually on the path from D to M
+rtk git log --min-parents=<n>         # include only commits with ≥ n parents
+rtk git log --max-parents=<n>         # include only commits with ≤ n parents
 ```
 
 `--ancestry-path` is significant: without it, `D..M` includes all commits reachable from M but not D — including side branches that merged into the path. With it, only commits directly between D and M are shown.
@@ -197,28 +201,34 @@ git log --max-parents=<n>         # include only commits with ≤ n parents
 ### --stat
 
 ```bash
-git diff --stat                   # diffstat: file names + ± bar
-git diff --stat=<width>,<name-width>,<count>
-git diff --compact-summary        # alongside --stat: shows new/gone, +x/-x (executable), +l (symlink)
-git diff --numstat                # machine-readable: <added>\t<deleted>\t<path>; - for binary
+rtk git diff --stat                   # diffstat: file names + ± bar
+rtk git diff --stat=<width>,<name-width>,<count>
+rtk git diff --compact-summary        # alongside --stat: shows new/gone, +x/-x (executable), +l (symlink)
+rtk git diff --numstat                # machine-readable: <added>\t<deleted>\t<path>; - for binary
 ```
 
 ### --name-only / --name-status
 
+Bare `git`, not `rtk git`: rtk appends a blank line and a `Changes:` trailer, so
+the output is no longer one record per line.
+
 ```bash
-git diff --name-only              # only filenames, one per line
-git diff --name-status            # status letter + filename per line
+git diff --name-only      # bare per ADR-0023; only filenames, one per line
+git diff --name-status    # bare per ADR-0023; status letter + filename per line
 ```
 
 `--name-status` uses the same status letters as `--diff-filter`.
 
 ### --word-diff
 
+Bare `git`, not `rtk git`: rtk replaces the word-diff with its own diffstat
+renderer and emits none of the `[-removed-] {+added+}` markers.
+
 ```bash
-git diff --word-diff              # inline word-level diff with [-removed-] {+added+} markers
-git diff --word-diff=color        # color only, no markers
-git diff --word-diff=porcelain    # machine-readable: +/- prefixed lines, ~ for newlines
-git diff --word-diff-regex=<re>   # define what counts as a "word"
+git diff --word-diff             # bare per ADR-0023; inline word-level diff, [-removed-] {+added+} markers
+git diff --word-diff=color       # bare per ADR-0023; color only, no markers
+git diff --word-diff=porcelain   # bare per ADR-0023; machine-readable: +/- prefixed lines, ~ for newlines
+git diff --word-diff-regex=<re>  # bare per ADR-0023; define what counts as a "word"
 ```
 
 ### Whitespace Flags
diff --git a/plugins/git/.apm/skills/git-remotes/SKILL.md b/plugins/git/.apm/skills/git-remotes/SKILL.md
index 5f457c1..181768e 100644
--- a/plugins/git/.apm/skills/git-remotes/SKILL.md
+++ b/plugins/git/.apm/skills/git-remotes/SKILL.md
@@ -10,6 +10,7 @@ description: >
   Not submodule pointers -> `git-submodules`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - git-scm-remote-docs
@@ -27,7 +28,7 @@ metadata:
 
 ## Step 1 — Clear the force-push gate
 
-`main` and `master` are a hard refusal: decline a force-push targeting either, whatever confirmation accompanies it, because no local approval can restore what the remote loses. On any other branch, `git push --force` and `-f` run only after the caller passes `confirm: true` for that specific push — for a human caller, prompt instead of failing.
+`main` and `master` are a hard refusal: decline a force-push targeting either, whatever confirmation accompanies it, because no local approval can restore what the remote loses. On any other branch, `rtk git push --force` and `-f` run only after the caller passes `confirm: true` for that specific push — for a human caller, prompt instead of failing.
 
 ## Step 2 — Dispatch
 
diff --git a/plugins/git/.apm/skills/git-remotes/references/fetch.md b/plugins/git/.apm/skills/git-remotes/references/fetch.md
index 0826b17..8198b71 100644
--- a/plugins/git/.apm/skills/git-remotes/references/fetch.md
+++ b/plugins/git/.apm/skills/git-remotes/references/fetch.md
@@ -11,19 +11,19 @@ Fetch **with no refspec** updates remote-tracking branches (`refs/remotes/<name>
 
 That safety comes from the default refspec, not from `fetch` itself. Give it an explicit one and it writes to local branches: verified on Git 2.39.5, `git fetch origin main:probe` fast-forwarded the local `probe` branch, and a `+` prefix force-updates the destination, discarding whatever commits it held. Treat any `fetch` carrying a `<src>:<dst>` refspec as a branch update, not a read.
 
-- **One remote**: `git fetch <remote>` — all branches
-- **One branch**: `git fetch <remote> <branch>` — the result lands in `FETCH_HEAD`, not a tracking ref
-- **All remotes**: `git fetch --all`
-- **Prune properly**: `git fetch --all --prune --prune-tags` cleans stale branches *and* tags
-- **Auto-prune**: `git config --global fetch.prune true` (or `remote.<name>.prune` to scope it to one remote), and `fetch.pruneTags true` for tags
+- **One remote**: `rtk git fetch <remote>` — all branches
+- **One branch**: `rtk git fetch <remote> <branch>` — the result lands in `FETCH_HEAD`, not a tracking ref
+- **All remotes**: `rtk git fetch --all`
+- **Prune properly**: `rtk git fetch --all --prune --prune-tags` cleans stale branches *and* tags
+- **Auto-prune**: `rtk git config --global fetch.prune true` (or `remote.<name>.prune` to scope it to one remote), and `fetch.pruneTags true` for tags
 
 ## Shallow and partial fetch
 
 ```bash
-git fetch --depth=<n>             # deepen history, or create a shallow clone
-git fetch --unshallow             # convert a shallow clone to full history
-git fetch --update-shallow        # allow the fetch to update the shallow boundary
-git fetch --refmap='' <remote> <branch>  # fetch without updating any tracking ref (FETCH_HEAD only)
+rtk git fetch --depth=<n>             # deepen history, or create a shallow clone
+rtk git fetch --unshallow             # convert a shallow clone to full history
+rtk git fetch --update-shallow        # allow the fetch to update the shallow boundary
+rtk git fetch --refmap='' <remote> <branch>  # fetch without updating any tracking ref (FETCH_HEAD only)
 ```
 
 ## Default fetch refspec
diff --git a/plugins/git/.apm/skills/git-remotes/references/pull.md b/plugins/git/.apm/skills/git-remotes/references/pull.md
index b769742..dcf72fc 100644
--- a/plugins/git/.apm/skills/git-remotes/references/pull.md
+++ b/plugins/git/.apm/skills/git-remotes/references/pull.md
@@ -9,11 +9,11 @@ source_keys:
 
 Default strategy: `--ff-only`. It fails on divergence, which forces a conscious choice instead of an accidental merge commit.
 
-- **Fast-forward only**: `git pull --ff-only` — the recommended default
-- **Rebase**: `git pull --rebase` replays your commits on top for linear history, but rewrites SHAs. Verify nothing being replayed has been pushed: rebasing published commits breaks everyone downstream.
-- **Merge**: `git pull --no-rebase` — three-way merge commit, preserves original commits, non-linear
-- **Rebase preserving merges**: `git pull --rebase=merges` keeps intentional local merge commits during the replay
-- **Stage without committing**: `git pull --squash` collapses incoming commits into staged changes; you write the message
+- **Fast-forward only**: `rtk git pull --ff-only` — the recommended default
+- **Rebase**: `rtk git pull --rebase` replays your commits on top for linear history, but rewrites SHAs. Verify nothing being replayed has been pushed: rebasing published commits breaks everyone downstream.
+- **Merge**: `rtk git pull --no-rebase` — three-way merge commit, preserves original commits, non-linear
+- **Rebase preserving merges**: `rtk git pull --rebase=merges` keeps intentional local merge commits during the replay
+- **Stage without committing**: `rtk git pull --squash` collapses incoming commits into staged changes; you write the message
 - **Merge strategy**: Git 2.34+ defaults to `ort` (`recursive` is now an alias for it). Strategy options such as `-X ours`, `-X theirs`, `-X ignore-space-change` pass through unchanged.
 - **Submodules**: `--recurse-submodules` only fetches submodules already checked out. Newly added ones are not initialized — use the `git-submodules` skill for those.
 
@@ -37,7 +37,7 @@ Highest wins:
 4. `branch.autoSetupRebase` (set automatically when the tracking branch was created)
 
 ```bash
-git config pull.ff only                  # deterministic default across Git versions
-git config --global pull.rebase true
-git config branch.develop.rebase false   # develop always merges, regardless of the global default
+rtk git config pull.ff only                  # deterministic default across Git versions
+rtk git config --global pull.rebase true
+rtk git config branch.develop.rebase false   # develop always merges, regardless of the global default
 ```
diff --git a/plugins/git/.apm/skills/git-remotes/references/push.md b/plugins/git/.apm/skills/git-remotes/references/push.md
index dd032fb..8fc10fb 100644
--- a/plugins/git/.apm/skills/git-remotes/references/push.md
+++ b/plugins/git/.apm/skills/git-remotes/references/push.md
@@ -9,14 +9,14 @@ source_keys:
 
 Default: safe push to the same-named branch on the remote.
 
-- **Force-push**: never bare `--force`. Use `git push --force-with-lease --force-if-includes <remote> <branch>`, after the SKILL.md Step 1 gate.
-- **Basic**: `git push <remote> <branch>`
-- **Set upstream**: `git push -u <remote> <branch>` — push and configure tracking
-- **Multi-remote**: push sequentially (`git push origin develop`, `git push staging develop`), or add a second push URL with `git remote set-url --add <name> <url>` to reach both in one command
-- **Delete a remote branch**: `git push <remote> --delete <branch>` — clearer than the `:<branch>` form
-- **Bulk**: `git push --all` (all local branches), `git push --tags` (all tags), `git push origin <tag>` (one tag)
-- **Delete remote branches with no local counterpart**: `git push --prune origin 'refs/heads/*:refs/heads/*'`
-- **Force only part of a multi-ref push**: prefix the one refspec that needs it with `+` — `git push origin +release develop` forces `release` while safe-pushing `develop`. A `+` prefix is a force-push and passes the SKILL.md Step 1 gate like any other.
+- **Force-push**: never bare `--force`. Use `rtk git push --force-with-lease --force-if-includes <remote> <branch>`, after the SKILL.md Step 1 gate.
+- **Basic**: `rtk git push <remote> <branch>`
+- **Set upstream**: `rtk git push -u <remote> <branch>` — push and configure tracking
+- **Multi-remote**: push sequentially (`rtk git push origin develop`, `rtk git push staging develop`), or add a second push URL with `rtk git remote set-url --add <name> <url>` to reach both in one command
+- **Delete a remote branch**: `rtk git push <remote> --delete <branch>` — clearer than the `:<branch>` form
+- **Bulk**: `rtk git push --all` (all local branches), `rtk git push --tags` (all tags), `rtk git push origin <tag>` (one tag)
+- **Delete remote branches with no local counterpart**: `rtk git push --prune origin 'refs/heads/*:refs/heads/*'`
+- **Force only part of a multi-ref push**: prefix the one refspec that needs it with `+` — `rtk git push origin +release develop` forces `release` while safe-pushing `develop`. A `+` prefix is a force-push and passes the SKILL.md Step 1 gate like any other.
 
 ## Refspec syntax — `[+]<src>[:<dst>]`
 
@@ -48,19 +48,21 @@ Two mitigations:
 # Option 1 — dedicated push-only remote: background tools fetch `origin`, you push
 # through a separate remote that nothing else touches, so its tracking ref can't be
 # poisoned by an unrelated fetch.
-git remote add origin-push $(git config remote.origin.url)
-git push --force-with-lease origin-push
+# The inner `git config` is bare: its stdout becomes a remote URL, so any
+# output rewriting would poison the remote silently.
+rtk git remote add origin-push $(git config remote.origin.url)   # inner bare per ADR-0023
+rtk git push --force-with-lease origin-push
 
 # Option 2 — explicit SHA via a local tag, unaffected by tracking-branch state
-git fetch
-git tag base master
-git rebase -i master
-git push --force-with-lease=master:base master:master
+rtk git fetch
+rtk git tag base master
+git rebase -i master   # bare, not `rtk` (ADR-0023): interactive sequence editor
+rtk git push --force-with-lease=master:base master:master
 ```
 
 `--force-if-includes` adds a second check on top of bare `--force-with-lease`: it verifies the remote-tracking tip actually appears in your local branch's reflog, i.e. you genuinely integrated it before rewriting. It is a no-op without `--force-with-lease`, and has no effect with the `--force-with-lease=<ref>:<sha>` form, which already pins an exact SHA.
 
-Safest combination: `git push --force-with-lease --force-if-includes origin`.
+Safest combination: `rtk git push --force-with-lease --force-if-includes origin`.
 
 ## Server-side policy
 
diff --git a/plugins/git/.apm/skills/git-remotes/references/remote-config.md b/plugins/git/.apm/skills/git-remotes/references/remote-config.md
index 5d44eef..3470543 100644
--- a/plugins/git/.apm/skills/git-remotes/references/remote-config.md
+++ b/plugins/git/.apm/skills/git-remotes/references/remote-config.md
@@ -9,31 +9,31 @@ source_keys:
 
 Which remotes exist, where they point, and what they track.
 
-`git remote show <name>` needs network access — use `-n` for cached data offline, or `git remote -v`, which lists URLs without querying.
+`rtk git remote show <name>` needs network access — use `-n` for cached data offline, or `rtk git remote -v`, which lists URLs without querying.
 
 ## Add, remove, rename, inspect
 
-- **Add**: `git remote add <name> <url>`, or `-f` to fetch immediately
-- **Remove**: `git remote remove <name>` — deletes the remote, all its tracking refs, and its config
-- **Rename**: `git remote rename <old> <new>`
-- **Inspect**: `git remote -v` (URLs, offline) or `git remote show <name>` (live tracking status)
-- **Effective URLs**: `git remote get-url <name>` shows the URL after `insteadOf` rewrites; `git remote get-url --push --all <name>` lists every push URL
+- **Add**: `rtk git remote add <name> <url>`, or `-f` to fetch immediately
+- **Remove**: `rtk git remote remove <name>` — deletes the remote, all its tracking refs, and its config
+- **Rename**: `rtk git remote rename <old> <new>`
+- **Inspect**: `rtk git remote -v` (URLs, offline) or `rtk git remote show <name>` (live tracking status)
+- **Effective URLs**: `rtk git remote get-url <name>` shows the URL after `insteadOf` rewrites; `rtk git remote get-url --push --all <name>` lists every push URL
 
 ## Tracking, mirroring, housekeeping
 
-- **Track one branch**: `git remote add -t <branch> <name> <url>` (repeatable); `--no-tags` suppresses tag import entirely
+- **Track one branch**: `rtk git remote add -t <branch> <name> <url>` (repeatable); `--no-tags` suppresses tag import entirely
 - **Mirror**: `--mirror=fetch` mirrors all refs locally (bare repos only); `--mirror=push` makes every push behave like `--mirror`
-- **Prune stale tracking refs without fetching**: `git remote prune <name>`, with `--dry-run` to preview
-- **Default branch pointer**: `git remote set-head <name> -a` (auto-detect, needs a prior fetch), `... <branch>` (explicit), `... -d` (delete `refs/remotes/<name>/HEAD`)
+- **Prune stale tracking refs without fetching**: `rtk git remote prune <name>`, with `--dry-run` to preview
+- **Default branch pointer**: `rtk git remote set-head <name> -a` (auto-detect, needs a prior fetch), `... <branch>` (explicit), `... -d` (delete `refs/remotes/<name>/HEAD`)
 
 ## `set-url` — full form
 
 ```bash
-git remote set-url <name> <newurl>                  # replace the first fetch URL
-git remote set-url <name> <newurl> <oldurl-regex>   # replace only the URL matching regex
-git remote set-url --push <name> <url>              # change push URL only (must point at same repo)
-git remote set-url --add <name> <url>               # add an extra push URL (push to multiple remotes)
-git remote set-url --delete <name> <regex>          # remove URLs matching regex
+rtk git remote set-url <name> <newurl>                  # replace the first fetch URL
+rtk git remote set-url <name> <newurl> <oldurl-regex>   # replace only the URL matching regex
+rtk git remote set-url --push <name> <url>              # change push URL only (must point at same repo)
+rtk git remote set-url --add <name> <url>               # add an extra push URL (push to multiple remotes)
+rtk git remote set-url --delete <name> <regex>          # remove URLs matching regex
 ```
 
 `--push` changes only where pushes go — fetch and push URLs must still reference the same repository. For genuine fetch-from-A / push-to-B workflows, use two separate named remotes instead; `--push` cannot do this.
diff --git a/plugins/git/.apm/skills/git-submodules/SKILL.md b/plugins/git/.apm/skills/git-submodules/SKILL.md
index 55d65f2..f3969f7 100644
--- a/plugins/git/.apm/skills/git-submodules/SKILL.md
+++ b/plugins/git/.apm/skills/git-submodules/SKILL.md
@@ -9,6 +9,7 @@ description: >
   Not the superproject's own remotes -> `git-remotes`.
 
 metadata:
+  version: "1.0.0"
   category: git
   source_keys:
     - git-scm-submodule-docs
diff --git a/plugins/git/.apm/skills/git-workflow/SKILL.md b/plugins/git/.apm/skills/git-workflow/SKILL.md
index 8f2f871..557f81f 100644
--- a/plugins/git/.apm/skills/git-workflow/SKILL.md
+++ b/plugins/git/.apm/skills/git-workflow/SKILL.md
@@ -8,6 +8,7 @@ description: >
   agent caller -> `git-orchestrate`. Not Gitea -> `gitea-workflow`.
 
 metadata:
+  version: "1.0.0"
   category: git
   source_keys:
     - nvie-gitflow-post
diff --git a/plugins/git/.apm/skills/git-worktrees/SKILL.md b/plugins/git/.apm/skills/git-worktrees/SKILL.md
index 15a89fc..a72332c 100644
--- a/plugins/git/.apm/skills/git-worktrees/SKILL.md
+++ b/plugins/git/.apm/skills/git-worktrees/SKILL.md
@@ -8,6 +8,7 @@ description: >
   Not interactive multi-step git guidance -> `git-workflow`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - git-scm-worktree-docs
@@ -16,7 +17,7 @@ metadata:
 ## Gotchas
 
 - **A branch can be checked out in only one worktree at a time.** `git worktree add` on an already-checked-out branch fails; `--force` is the only override, so use it only deliberately.
-- **Never `rm -rf` a worktree directory.** That strands metadata in `$GIT_DIR/worktrees/`. Use `git worktree remove`, or `git worktree prune` afterwards.
+- **Never `rm -rf` a worktree directory.** That strands metadata in `$GIT_DIR/worktrees/`. Use `rtk git worktree remove`, or `rtk git worktree prune` afterwards.
 - **Submodules break worktree support.** A worktree containing submodules cannot be moved at all, and needs `--force` to remove.
 - **`extensions.worktreeConfig = true` is a one-way door.** Without it, `git config --worktree` errors; with it, that flag writes to the worktree's own `config.worktree` file, and `core.bare`/`core.worktree` are forced there too. It also breaks older Git. Leave it off unless per-worktree config is needed.
 
@@ -24,19 +25,19 @@ metadata:
 
 | Operation | Run |
 |---|---|
-| Create on a branch that already exists locally | `git worktree add <path> <branch>` |
-| Create on a new branch | `git worktree add -b <branch> <path>` |
-| Create on the branch named after the path basename | `git worktree add <path>` — checks that branch out if it exists, else creates it from HEAD |
-| Create and reset an existing branch to HEAD — discards its commits | `git worktree add -B <branch> <path>` |
-| Create a local branch tracking a remote one | `git worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add <path> <branch>` expands to exactly this, but **only** under the conditions in `references/worktrees.md` |
-| Throwaway experiment, no branch | `git worktree add -d <path>` — detached HEAD |
+| Create on a branch that already exists locally | `rtk git worktree add <path> <branch>` |
+| Create on a new branch | `rtk git worktree add -b <branch> <path>` |
+| Create on the branch named after the path basename | `rtk git worktree add <path>` — checks that branch out if it exists, else creates it from HEAD |
+| Create and reset an existing branch to HEAD — discards its commits | `rtk git worktree add -B <branch> <path>` |
+| Create a local branch tracking a remote one | `rtk git worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add <path> <branch>` expands to exactly this, but **only** under the conditions in `references/worktrees.md` |
+| Throwaway experiment, no branch | `rtk git worktree add -d <path>` — detached HEAD |
 | **Never** `git worktree add <path> <remote>/<branch>` | That ref resolves, so the shortcut never fires and you get **a detached HEAD, no branch, no upstream**. Commits there go unreachable once HEAD moves, and `git push` needs an explicit refspec. Use the tracking row above |
-| List | `git worktree list -v`, or `--porcelain -z` to parse |
-| Lock or unlock | `git worktree lock [--reason <str>] <path>` / `git worktree unlock <path>` |
-| Move | `git worktree move <from> <to>` |
-| Remove | `git worktree remove <path>` |
-| Prune stale metadata | `git worktree prune --dry-run`, then without the flag |
-| Repair after a manual move | `git worktree repair` — in the main worktree if *it* moved, or inside a linked worktree that moved. `git worktree repair <path>...` — from any worktree, naming each moved linked worktree's new path |
+| List | `git worktree list -v` to read, or `git worktree list --porcelain -z` to parse — both bare per ADR-0023: rtk re-renders the output and drops the porcelain flags |
+| Lock or unlock | `rtk git worktree lock [--reason <str>] <path>` / `rtk git worktree unlock <path>` |
+| Move | `rtk git worktree move <from> <to>` |
+| Remove | `rtk git worktree remove <path>` |
+| Prune stale metadata | `rtk git worktree prune --dry-run`, then without the flag |
+| Repair after a manual move | `rtk git worktree repair` — in the main worktree if *it* moved, or inside a linked worktree that moved. `rtk git worktree repair <path>...` — from any worktree, naming each moved linked worktree's new path |
 
 If the operation needs anything the table does not carry — the full `add` flag
 table, orphan branches, sparse-checkout, locking for removable media, remote
@@ -48,7 +49,7 @@ Gates:
 
 - **`move`, `remove` — the main worktree cannot be moved or removed.** Only linked worktrees, the ones `git worktree add` created, are candidates.
 - **`add`, `move`, `remove` — escalate force flags one step at a time.** `-f` overrides a safeguard such as an unclean tree; `move` and `remove` need `-ff` on top of that when the worktree is locked. Confirm with the user before either — both discard state.
-- **`add` — lock at creation, not after.** `git worktree add --lock` is atomic, where add-then-`lock` leaves a window in which the worktree is unprotected.
+- **`add` — lock at creation, not after.** `rtk git worktree add --lock` is atomic, where add-then-`lock` leaves a window in which the worktree is unprotected.
 
 ## Step 2 — Report
 
@@ -61,6 +62,7 @@ worktrees:
     lock_reason: <reason or empty>
 ```
 
-Derive those fields from `git worktree list --porcelain -z`. For a single
+Derive those fields from `git worktree list --porcelain -z` — bare, not `rtk`:
+rtk drops both flags and never emits `locked`/`lock_reason` (ADR-0023). For a single
 operation, report its outcome instead — `created: true`, `moved: true`,
 `removed: true`.
diff --git a/plugins/git/.apm/skills/git-worktrees/references/worktrees.md b/plugins/git/.apm/skills/git-worktrees/references/worktrees.md
index c4d9b22..5894bd7 100644
--- a/plugins/git/.apm/skills/git-worktrees/references/worktrees.md
+++ b/plugins/git/.apm/skills/git-worktrees/references/worktrees.md
@@ -23,17 +23,17 @@ that are usable.
 ## `add` forms
 
 ```bash
-git worktree add <path> <branch>              # <branch> exists locally: check it out — non-destructive
-git worktree add -b <branch> <path>           # create a new branch; fails if it exists
-git worktree add <path>                       # branch named after $(basename <path>): checked out
+rtk git worktree add <path> <branch>              # <branch> exists locally: check it out — non-destructive
+rtk git worktree add -b <branch> <path>           # create a new branch; fails if it exists
+rtk git worktree add <path>                       # branch named after $(basename <path>): checked out
                                               # if it exists, else created from HEAD
-git worktree add -B <branch> <path>           # create the branch, or reset an existing one to HEAD,
+rtk git worktree add -B <branch> <path>           # create the branch, or reset an existing one to HEAD,
                                               # discarding the commits it carried
-git worktree add --track -b <branch> <path> <remote>/<branch>
+rtk git worktree add --track -b <branch> <path> <remote>/<branch>
                                               # new local branch tracking the remote — always works
-git worktree add <path> <branch>              # <branch> absent locally and in exactly one remote:
+rtk git worktree add <path> <branch>              # <branch> absent locally and in exactly one remote:
                                               # Git expands this to the --track -b form above
-git worktree add -d <path>                    # detached HEAD, no branch
+rtk git worktree add -d <path>                    # detached HEAD, no branch
 ```
 
 The same `git worktree add <path> <branch>` spelling appears twice above and does two
@@ -65,19 +65,19 @@ Using `-` as `<commit-ish>` is shorthand for `@{-1}` (the branch checked out bef
 ## New unborn branch
 
 ```bash
-git worktree add --orphan -b <branch> <path>
+rtk git worktree add --orphan -b <branch> <path>
 ```
 Creates an empty branch with no commits. **`--orphan` needs Git 2.42 or later** — it was added
 upstream in 2.42, and on 2.39.5 this fails with `error: unknown option 'orphan'` and exit 129.
-Check `git --version` before reaching for it.
+Check `rtk git --version` before reaching for it.
 
 Fallback on older Git, verified on 2.39.5 — detach first, then orphan the linked worktree in place,
 which leaves the main worktree on its own branch throughout:
 
 ```bash
-git worktree add -d <path>       # linked worktree, detached HEAD
+rtk git worktree add -d <path>       # linked worktree, detached HEAD
 cd <path>
-git switch --orphan <branch>     # unborn branch: empty index, empty working tree
+rtk git switch --orphan <branch>     # unborn branch: empty index, empty working tree
 ```
 
 `git worktree list` then shows the new worktree at `0000000 [<branch>]` until its first commit.
@@ -88,25 +88,25 @@ the disruption worktrees exist to avoid.
 
 Suppress the initial checkout to configure sparse-checkout first:
 ```bash
-git worktree add --no-checkout ../sparse main
+rtk git worktree add --no-checkout ../sparse main
 cd ../sparse
-git sparse-checkout init --cone
-git sparse-checkout set src/
-git checkout main
+rtk git sparse-checkout init --cone
+rtk git sparse-checkout set src/
+rtk git checkout main
 ```
 
 ## Worktree on removable media
 
 ```bash
-git worktree add --lock --reason "external SSD" <path> <branch>
-git worktree unlock <path>  # when reconnected
+rtk git worktree add --lock --reason "external SSD" <path> <branch>
+rtk git worktree unlock <path>  # when reconnected
 ```
 
 ## Remote-branch disambiguation
 
 ```bash
-git worktree add --track -b <branch> <path> <remote>/<branch>   # explicit: no guessing at all
-git worktree add <path> <branch>                                # shortcut: needs one clear remote
+rtk git worktree add --track -b <branch> <path> <remote>/<branch>   # explicit: no guessing at all
+rtk git worktree add <path> <branch>                                # shortcut: needs one clear remote
 ```
 **The bare-name shortcut needs exactly one remote.** It fires only when `<branch>` is not found
 locally, none of `-b`/`-B`/`--detach` were given, and a tracking branch of that name exists in
@@ -122,10 +122,10 @@ exactly one remote has it, and marks that branch as upstream. Its default comes
 ## Repair after a manual move
 
 ```bash
-git worktree repair            # the MAIN worktree moved: run it there to reconnect every linked
+rtk git worktree repair            # the MAIN worktree moved: run it there to reconnect every linked
                                # worktree back to the main worktree
-git worktree repair            # a LINKED worktree moved: run it inside that recently-moved worktree
-git worktree repair <path>...  # reconnect a specific linked worktree — runnable from any worktree,
+rtk git worktree repair            # a LINKED worktree moved: run it inside that recently-moved worktree
+rtk git worktree repair <path>...  # reconnect a specific linked worktree — runnable from any worktree,
                                # naming each moved tree's new path
 ```
 
@@ -133,10 +133,10 @@ Which form applies depends on what moved:
 
 | What moved | Remedy |
 |---|---|
-| The main worktree (or bare repo) | `git worktree repair` in the main worktree |
-| One linked worktree | `git worktree repair` inside that worktree |
-| Several linked worktrees | `git worktree repair <path>...` from any worktree, listing each new path |
-| Both main and linked worktrees | `git worktree repair <path>...` in the main worktree, naming each linked worktree's new path — this restores the connections in both directions |
+| The main worktree (or bare repo) | `rtk git worktree repair` in the main worktree |
+| One linked worktree | `rtk git worktree repair` inside that worktree |
+| Several linked worktrees | `rtk git worktree repair <path>...` from any worktree, listing each new path |
+| Both main and linked worktrees | `rtk git worktree repair <path>...` in the main worktree, naming each linked worktree's new path — this restores the connections in both directions |
 
 Only the no-argument form is tied to the current directory. The `<path>...` form is not — it
 reestablishes the connection to every path you name, run from any worktree.
@@ -157,20 +157,20 @@ reestablishes the connection to every path you name, run from any worktree.
 untouched throughout:
 
 ```bash
-git worktree add -b emergency-fix ../temp main
+rtk git worktree add -b emergency-fix ../temp main
 cd ../temp
 # fix, then commit
-git commit -a -m "fix: critical production bug"
+rtk git commit -a -m "fix: critical production bug"
 cd -
-git worktree remove ../temp
+rtk git worktree remove ../temp
 ```
 
 **Review a PR branch alongside your own work** — both branches stay checked out, so there is no
 context switch:
 
 ```bash
-git worktree add ../review-pr-123 origin/feature-xyz          # detached HEAD — read-only review
-git worktree add --track -b feature-xyz ../review-pr-123 origin/feature-xyz   # if you will commit
+rtk git worktree add ../review-pr-123 origin/feature-xyz          # detached HEAD — read-only review
+rtk git worktree add --track -b feature-xyz ../review-pr-123 origin/feature-xyz   # if you will commit
 # open ../review-pr-123 in a second editor window or terminal
 ```
 
diff --git a/plugins/git/.apm/skills/pc-author/SKILL.md b/plugins/git/.apm/skills/pc-author/SKILL.md
index b1d1db8..8b7c411 100644
--- a/plugins/git/.apm/skills/pc-author/SKILL.md
+++ b/plugins/git/.apm/skills/pc-author/SKILL.md
@@ -6,6 +6,7 @@ description: >
   shellcheck"). Not running, installing, or updating hooks -> `pc-run`.
 allowed-tools: Bash Read Write Edit
 metadata:
+  version: "1.0.0"
   category: devtools
   source_keys:
     - context7-pre-commit-com
diff --git a/plugins/git/.apm/skills/pc-author/references/create-config.md b/plugins/git/.apm/skills/pc-author/references/create-config.md
index 8adfdfb..c9ef9fd 100644
--- a/plugins/git/.apm/skills/pc-author/references/create-config.md
+++ b/plugins/git/.apm/skills/pc-author/references/create-config.md
@@ -15,7 +15,7 @@ flow's file is not needed here. `SKILL.md`'s three common gates still apply.
    inferring them from the project's name or README:
 
    ```bash
-   git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
+   rtk git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
    ```
 
 2. Read `references/hooks-by-language.md` and map the detected extensions to recommended hooks.
diff --git a/plugins/git/.apm/skills/pc-author/references/modify-config.md b/plugins/git/.apm/skills/pc-author/references/modify-config.md
index 83a0ae6..bfd268f 100644
--- a/plugins/git/.apm/skills/pc-author/references/modify-config.md
+++ b/plugins/git/.apm/skills/pc-author/references/modify-config.md
@@ -17,7 +17,7 @@ Read the existing `.pre-commit-config.yaml` before editing. Note any stale `rev`
 1. Run a shallow extension scan, so the addition is judged against the languages actually present:
 
    ```bash
-   git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
+   rtk git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
    ```
 
 2. Read `references/hooks-by-language.md` for the correct repo URL, `rev` and recommended args
diff --git a/plugins/git/.apm/skills/pc-run/SKILL.md b/plugins/git/.apm/skills/pc-run/SKILL.md
index 82ebc7a..2e58fa5 100644
--- a/plugins/git/.apm/skills/pc-run/SKILL.md
+++ b/plugins/git/.apm/skills/pc-run/SKILL.md
@@ -8,6 +8,7 @@ description: >
 compatibility: Requires pre-commit installed and available on PATH.
 
 metadata:
+  version: "1.0.1"
   category: devtools
   source_keys:
     - context7-pre-commit-com
@@ -18,9 +19,9 @@ allowed-tools: Bash Read
 
 ## Gotchas
 
-- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
+- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks rtk git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
 - Never bypass a failing hook with `git commit --no-verify` (or `-n`). Hooks are the automated QA gate, so a bypassed commit pushes the failure downstream where it costs more — diagnose it instead.
-- `- files were modified by this hook` is not a bug. A fixer hook rewrote a staged file, so the staged snapshot is stale and the commit is blocked on purpose. Re-stage and re-run the same commit: `git add -u && git commit`. Do NOT reach for `pre-commit install -f` here — it overwrites `.git/hooks/` and has nothing to do with re-staging.
+- `- files were modified by this hook` is not a bug. A fixer hook rewrote a staged file, so the staged snapshot is stale and the commit is blocked on purpose. Re-stage and re-run the same commit: `rtk git add -u && rtk git commit`. Do NOT reach for `pre-commit install -f` here — it overwrites `.git/hooks/` and has nothing to do with re-staging.
 
 ## Gate — `pre-commit clean`
 
diff --git a/plugins/git/.apm/skills/pc-run/references/failure-patterns.md b/plugins/git/.apm/skills/pc-run/references/failure-patterns.md
index 8931ebf..5369f84 100644
--- a/plugins/git/.apm/skills/pc-run/references/failure-patterns.md
+++ b/plugins/git/.apm/skills/pc-run/references/failure-patterns.md
@@ -14,8 +14,8 @@ Cause: A fixer hook (e.g. `trailing-whitespace`, `end-of-file-fixer`, `pretty-fo
 
 Fix: Re-stage and recommit.
 ```bash
-git add -u
-git commit -m "same message"
+rtk git add -u
+rtk git commit -m "same message"
 ```
 
 Do NOT reach for `pre-commit install -f` here. That flag overwrites existing hook files in `.git/hooks/`; it has nothing to do with re-staging.
diff --git a/plugins/git/.claude-plugin/plugin.json b/plugins/git/.claude-plugin/plugin.json
index bba9797..d9f6030 100644
--- a/plugins/git/.claude-plugin/plugin.json
+++ b/plugins/git/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "git",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/git/.github/plugin/plugin.json b/plugins/git/.github/plugin/plugin.json
index bba9797..d9f6030 100644
--- a/plugins/git/.github/plugin/plugin.json
+++ b/plugins/git/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "git",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/git/README.md b/plugins/git/README.md
new file mode 100644
index 0000000..8f7a2a3
--- /dev/null
+++ b/plugins/git/README.md
@@ -0,0 +1,48 @@
+# git
+
+Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.
+
+## Install
+
+**Claude Code:**
+
+```bash
+claude plugin marketplace add <owner>/<repo>
+claude plugin install git@<marketplace-name>
+```
+
+**GitHub Copilot CLI:**
+
+```bash
+copilot plugin marketplace add <owner>/<repo>
+copilot plugin install git
+```
+
+**Local (development):**
+
+```bash
+# Claude Code
+claude --plugin-dir ./plugins/git
+
+# GitHub Copilot CLI
+copilot plugin install ./plugins/git
+```
+
+## Conventions
+
+Skills here run local git commands through the org's `rtk` wrapper. **When a command is prefixed, when it stays bare, and why some executable commands must stay bare are all decided by ADR-0023** (`docs/adr/0023-rtk-prefix-marks-executable-commands-only.md`), which is repo-wide and not specific to this plugin. `check-rtk-prefix` enforces the part of it that is machine-decidable.
+
+Installing this plugin without `rtk`? Every prefixed command is a plain `git` invocation with a word in front of it — drop the `rtk ` and it is correct.
+
+## Contents
+
+| Component | Path | Description |
+|---|---|---|
+| Skills | `.apm/skills/` → `skills/` | `git-commits`, `git-branches`, `git-history`, `git-remotes`, `git-submodules`, `git-workflow`, `git-worktrees`, `pc-author`, `pc-run` |
+| Agents | `.apm/agents/` → `agents/` | `git-orchestrate` |
+
+`.apm/` is the authoring source; `skills/`/`agents/` are the generated mirrors plugin hosts scan (ADR-0017) — edit only under `.apm/`.
+
+## Author
+
+Defame1297
diff --git a/plugins/git/apm.yml b/plugins/git/apm.yml
index 3201a1f..d6bf7c8 100644
--- a/plugins/git/apm.yml
+++ b/plugins/git/apm.yml
@@ -1,5 +1,5 @@
 name: git
-version: 1.3.6
+version: 1.3.7
 description: Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.
 author:
   name: Defame1297
diff --git a/plugins/git/skills/git-branches/SKILL.md b/plugins/git/skills/git-branches/SKILL.md
index 44d79c9..325dd96 100644
--- a/plugins/git/skills/git-branches/SKILL.md
+++ b/plugins/git/skills/git-branches/SKILL.md
@@ -9,6 +9,7 @@ description: >
   Not a Gitea remote's branches -> `gitea-branches`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - context7-git-htmldocs
@@ -20,7 +21,7 @@ metadata:
 ## Gotchas
 
 - **Uncommitted changes abort a switch.** `git switch` refuses rather than clobbering conflicting local edits. Offer to stash and retry — forcing the checkout past it is how work disappears.
-- **A branch and a tag can carry the same name.** Detect it before acting — `git branch --list <name>` and `git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
+- **A branch and a tag can carry the same name.** Detect it before acting — `git branch --list <name>` (bare, not `rtk`: rtk prints a phantom `* ` line even on no match, which reports every name as ambiguous — ADR-0023) and `rtk git tag --list <name>`; output from both means the name is ambiguous. Prefer `git switch` over `git checkout`, and where a command accepts either ref, disambiguate with `refs/heads/<name>` or `refs/tags/<name>`.
 - **`main` and `master` are a refusal, not a gate.** Force-pushing, force-deleting, or renaming them is rejected even when the caller passes `confirm: true` — no flag makes the remote's history recoverable. Offer a new branch instead.
 
 ## Step 1 — Determine the branching pattern
@@ -51,7 +52,7 @@ These gates are passable. The `main`/`master` refusal in Gotchas is not.
 
 ## Step 4 — Set tracking
 
-A new branch's first push must be `git push -u origin <branch>`. The push itself is `git-remotes`' — every remote-side gate lives there, which is why Step 2's remote-delete row hands off the same way — but the upstream requirement originates here, so carry it in the handoff. Without an upstream, later pushes and pulls either fail or silently target the wrong remote branch, and the caller has no way to tell which happened.
+A new branch's first push must be `rtk git push -u origin <branch>`. The push itself is `git-remotes`' — every remote-side gate lives there, which is why Step 2's remote-delete row hands off the same way — but the upstream requirement originates here, so carry it in the handoff. Without an upstream, later pushes and pulls either fail or silently target the wrong remote branch, and the caller has no way to tell which happened.
 
 ## Step 5 — Return a structured result
 
diff --git a/plugins/git/skills/git-branches/references/branch-operations.md b/plugins/git/skills/git-branches/references/branch-operations.md
index b9e29f4..b0d785c 100644
--- a/plugins/git/skills/git-branches/references/branch-operations.md
+++ b/plugins/git/skills/git-branches/references/branch-operations.md
@@ -8,21 +8,21 @@ source_keys:
 One command per action. Where two forms exist, the first is the default and the second the escape
 hatch.
 
-- **create** — `git switch -c <branch> <base>`. Base comes from the config's `base_branch`
+- **create** — `rtk git switch -c <branch> <base>`. Base comes from the config's `base_branch`
   (`main` under GitHub Flow, usually `develop` under Gitflow).
-- **switch** — `git switch <branch>` moves to an existing local branch; it aborts rather than
-  clobbering conflicting local changes. `git switch -` returns to the previous branch.
-- **delete (local)** — `git branch -d <branch>` refuses when the branch holds unmerged commits,
-  which is why it is the default. `git branch -D <branch>` forces the deletion and discards that
+- **switch** — `rtk git switch <branch>` moves to an existing local branch; it aborts rather than
+  clobbering conflicting local changes. `rtk git switch -` returns to the previous branch.
+- **delete (local)** — `rtk git branch -d <branch>` refuses when the branch holds unmerged commits,
+  which is why it is the default. `rtk git branch -D <branch>` forces the deletion and discards that
   work — only after the destructive-operation gates pass and `confirm: true` is set.
 - **delete (remote)** — not this skill's. Deleting a remote branch is a push, and every remote-side
   gate lives in `git-remotes`; hand it there rather than running the push from here. Its
   `references/push.md` carries the command and the refspec form.
-- **rename** — `git branch -m <old> <new>`.
-- **list** — `git branch` (local), `-a` (local plus remote-tracking), `-r` (remote-tracking only),
+- **rename** — `rtk git branch -m <old> <new>`.
+- **list** — `rtk git branch` (local), `-a` (local plus remote-tracking), `-r` (remote-tracking only),
   `--merged` / `--no-merged` (filter by merge status into the current branch).
-- **track** — `git branch --set-upstream-to=origin/<branch>` sets an upstream without pushing.
-  `git branch -vv` shows the tracking state of every local branch.
+- **track** — `rtk git branch --set-upstream-to=origin/<branch>` sets an upstream without pushing.
+  `rtk git branch -vv` shows the tracking state of every local branch.
 
 ## get-intent
 
@@ -40,17 +40,20 @@ intent is worse than one built on none.
 A switch aborts rather than clobbering conflicting local changes (see Gotchas). Stash is the way
 past it: it shelves the working tree and index so the branch pointer can move.
 
-- **save** — `git stash push -m "<message>"`. Add `-u` to include untracked files; verified on Git
+- **save** — `rtk git stash push -m "<message>"`. Add `-u` to include untracked files; verified on Git
   2.39.5, a plain `push` leaves them in place, and a plain `push` with *only* untracked changes
   reports `No local changes to save` and stashes nothing. Bare `git stash` is `push` with no message.
-- **restore** — `git stash pop` applies the newest entry and deletes it. `git stash apply stash@{n}`
+- **restore** — `git stash pop` applies the newest entry and deletes it. Bare, not `rtk`: on a
+  conflict rtk prints only `FAILED: git stash pop` and swallows the conflict report the paragraph
+  below tells you to read (ADR-0023). `rtk git stash apply stash@{n}`
   applies without deleting, for replaying one shelf onto more than one branch.
-- **list** — `git stash list`; `git stash show -p stash@{n}` prints that entry's diff.
-- **drop** — `git stash drop stash@{n}` deletes one entry. `git stash clear` deletes all of them
+- **list** — `git stash list` — bare, not `rtk`: rtk prints `No stashes` where git prints nothing,
+  so an empty-output test misfires (ADR-0023). `rtk git stash show -p stash@{n}` prints that entry's diff.
+- **drop** — `rtk git stash drop stash@{n}` deletes one entry. `rtk git stash clear` deletes all of them
   and nothing recovers them — confirm before running it.
-- **branch from a stash** — `git stash branch <branch> stash@{n}` creates a branch at the commit the
+- **branch from a stash** — `rtk git stash branch <branch> stash@{n}` creates a branch at the commit the
   stash was taken from and pops it there. Use it when the stash no longer applies to the current tip.
 
 **A conflicting `pop` keeps the entry.** Verified on 2.39.5: it exits 1, writes conflict markers,
 prints "The stash entry is kept in case you need it again", and `git stash list` still shows it.
-Resolve, `git add`, then `git stash drop` the entry by hand — otherwise it silently accumulates.
+Resolve, `rtk git add`, then `rtk git stash drop` the entry by hand — otherwise it silently accumulates.
diff --git a/plugins/git/skills/git-branches/references/comparing-branches.md b/plugins/git/skills/git-branches/references/comparing-branches.md
index 24c3214..cb26f28 100644
--- a/plugins/git/skills/git-branches/references/comparing-branches.md
+++ b/plugins/git/skills/git-branches/references/comparing-branches.md
@@ -8,9 +8,9 @@ source_keys:
 The two-dot and three-dot forms mean different things and are easy to swap by accident — check the
 direction before reporting a result.
 
-- `git log main..feature` — commits on `feature` that are not on `main`.
-- `git log feature..main` — the reverse direction: commits on `main` not on `feature`.
-- `git log --left-right main...feature` — both diverging sets at once (symmetric difference).
-- `git diff main...feature` — the diff from the common ancestor to `feature`'s tip, which is what
+- `rtk git log main..feature` — commits on `feature` that are not on `main`.
+- `rtk git log feature..main` — the reverse direction: commits on `main` not on `feature`.
+- `rtk git log --left-right main...feature` — both diverging sets at once (symmetric difference).
+- `rtk git diff main...feature` — the diff from the common ancestor to `feature`'s tip, which is what
   a reviewer sees, rather than the diff between the two tips.
-- `git merge-base main feature` — print the common ancestor commit.
+- `rtk git merge-base main feature` — print the common ancestor commit.
diff --git a/plugins/git/skills/git-branches/references/merging.md b/plugins/git/skills/git-branches/references/merging.md
index 0302138..3b122c0 100644
--- a/plugins/git/skills/git-branches/references/merging.md
+++ b/plugins/git/skills/git-branches/references/merging.md
@@ -9,22 +9,23 @@ source_keys:
 Scope is fast-forward and merge-commit mechanics plus conflict resolution. Rebase and cherry-pick
 belong to `git-commits`; revert to `git-history`.
 
-- **Fast-forward** — `git merge <branch>` advances the pointer with no merge commit when the
+- **Fast-forward** — `rtk git merge <branch>` advances the pointer with no merge commit when the
   target has not diverged.
-- **True merge** — `git merge --no-ff <branch>` forces a merge commit even when a fast-forward is
+- **True merge** — `rtk git merge --no-ff <branch>` forces a merge commit even when a fast-forward is
   possible. Gitflow requires it on every supporting-branch merge.
-- **Squash merge** — `git merge --squash <branch>` stages the combined diff without committing.
-  Follow it with a `git commit`.
-- **Octopus merge** — `git merge branch-a branch-b branch-c` merges more than two branches at
+- **Squash merge** — `rtk git merge --squash <branch>` stages the combined diff without committing.
+  Follow it with a `rtk git commit`.
+- **Octopus merge** — `rtk git merge branch-a branch-b branch-c` merges more than two branches at
   once, but fails outright on any conflict. Use sequential two-way merges when conflicts are
   likely.
 
 ## Conflict resolution
 
-When Git cannot auto-merge it writes conflict markers and stops mid-merge. Run `git status` to
-list the conflicted files, edit each to resolve its markers, then `git add <file>` and
-`git merge --continue`.
+When Git cannot auto-merge it writes conflict markers and stops mid-merge. Run `rtk git status` to
+list the conflicted files, edit each to resolve its markers, then `rtk git add <file>` and
+`rtk git merge --continue`.
 
-- `git merge --abort` restores the pre-merge state.
-- `git mergetool` opens the configured merge tool.
-- `git diff --diff-filter=U` shows only the still-conflicted files.
+- `rtk git merge --abort` restores the pre-merge state.
+- `git mergetool` opens the configured merge tool — bare, not `rtk`: it hands control to an
+  interactive child process, and a token filter has nothing to offer there (ADR-0023).
+- `rtk git diff --diff-filter=U` shows only the still-conflicted files.
diff --git a/plugins/git/skills/git-commits/SKILL.md b/plugins/git/skills/git-commits/SKILL.md
index 59ca602..f1ec375 100644
--- a/plugins/git/skills/git-commits/SKILL.md
+++ b/plugins/git/skills/git-commits/SKILL.md
@@ -8,7 +8,7 @@ description: >
   Not branch lifecycle -> `git-branches`.
 
 metadata:
-  version: "0.1.3"
+  version: "0.1.4"
   category: git
   source_keys:
     - conventional-commits-spec
@@ -21,7 +21,7 @@ allowed-tools: Bash
 
 ## Gotchas
 
-- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too.
+- **Run git as `rtk git <subcommand>`, never bare `git`** — org convention, in `&&` chains too. Exceptions: ADR-0023 clause 3.
 - **Refuse to force-push `main`/`master`** — a rewrite leaves the branch diverged and the reflex is to force it back; safe only where nobody else has based work on it.
 - **`reset --hard` is a confirmation gate, not a default.** It overwrites the working tree, and uncommitted edits it discards were never in git, so no reflog recovers them. Name what will be lost and offer a stash first.
 - **Never add `--no-verify`** — using it when a hook fails bypasses the QA gate the pipeline depends on. Only on the user's explicit demand, with a warning.
diff --git a/plugins/git/skills/git-commits/references/rewrite-history.md b/plugins/git/skills/git-commits/references/rewrite-history.md
index 88bc993..c86097e 100644
--- a/plugins/git/skills/git-commits/references/rewrite-history.md
+++ b/plugins/git/skills/git-commits/references/rewrite-history.md
@@ -21,9 +21,9 @@ Prefer this whenever a commit is written to be folded, because git does the mark
 
 1. `rtk git commit --fixup=<commit>` keeps the target's message; `rtk git commit --squash=<commit>` lets you edit the combined message later. Both prefix the message with `fixup!`/`squash!` and name the target commit.
 2. Get explicit approval — the rebase still rewrites history.
-3. Run `rtk git rebase -i --autosquash HEAD~N`. Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.
+3. Run `git rebase -i --autosquash HEAD~N` — bare, not `rtk`: `-i` opens an interactive sequence editor (ADR-0023). Git pre-fills the todo list with the tagged commits already reordered against their targets; save it unchanged to apply.
 
-**`-i` is not optional here.** On Git 2.39.5, `rtk git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.
+**`-i` is not optional here.** On Git 2.39.5, `git rebase --autosquash HEAD~N` without `-i` prints `Successfully rebased and updated refs/heads/<branch>.` and exits 0 while leaving the `fixup!` commit in place at its original SHA — `--autosquash` is honoured only by the interactive machinery, and the false success is the trap: the fold is reported as done, and the surviving `fixup!` subject then fails the Conventional Commits `commit-msg` hook. Later Git versions taught the non-interactive rebase to honour the flag, but `-i --autosquash` is correct on every version, so always write that.
 
 ## Squash by hand (interactive rebase)
 
@@ -31,7 +31,7 @@ Use this when the commits were not tagged at commit time. **Interactive rebase h
 
 1. Identify the commits to squash — typically the last N on the current branch.
 2. Get explicit approval.
-3. Run `rtk git rebase -i HEAD~N`, marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
+3. Run `git rebase -i HEAD~N` — bare, not `rtk`, for the same interactive-editor reason — marking the older commits `squash` to keep their messages for editing, or `fixup` to discard them.
 4. Compose the combined message when the rebase stops to ask. For a non-trivial combined message, follow the structure in `references/commit-template.md`.
 
 ## When a rebase halts on a conflict
diff --git a/plugins/git/skills/git-history/SKILL.md b/plugins/git/skills/git-history/SKILL.md
index 6057bee..2a7f62f 100644
--- a/plugins/git/skills/git-history/SKILL.md
+++ b/plugins/git/skills/git-history/SKILL.md
@@ -8,6 +8,7 @@ description: >
   `git-commits`. Not a Gitea server's history -> `gitea-branches`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - git-scm-bisect-docs
@@ -34,13 +35,13 @@ allowed-tools: Bash
 
 ## Step 2 — Query the log
 
-Default to `git log --oneline`, then narrow by whatever is known:
+Default to `rtk git log --oneline`, then narrow by whatever is known:
 
-- **Content**: `git log -S"string"`, or `-G"regex"` to match any diff line. `--pickaxe-regex` makes the `-S` argument a POSIX ERE; `--pickaxe-all` shows every file in a matching changeset.
-- **A line or function**: `git log -L <start>,<end>:<file>` or `git log -L :<function>:<file>`. Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
-- **A file across renames**: `git log --follow -- <file>`. Without `--follow` the history stops at the rename boundary.
+- **Content**: `rtk git log -S"string"`, or `-G"regex"` to match any diff line. `--pickaxe-regex` makes the `-S` argument a POSIX ERE; `--pickaxe-all` shows every file in a matching changeset.
+- **A line or function**: `git log -L <start>,<end>:<file>` or `git log -L :<function>:<file>` — bare, not `rtk`: rtk truncates each diff line at ~72 characters (ADR-0023). Confirm the range resolves before reporting on it — an off-by-one silently omits the target.
+- **A file across renames**: `rtk git log --follow -- <file>`. Without `--follow` the history stops at the rename boundary.
 - **Mainline only**: `--first-parent` follows the integration branch and skips commits merged in from side branches.
-- **Structured output**: `git log --format="%h | %s | %an (%ar)"`.
+- **Structured output**: `rtk git log --format="%h | %s | %an (%ar)"`.
 
 If you need the placeholder catalogue, format presets, `--diff-filter` letters, full `-L` syntax, ancestry filters, pickaxe binary-file behaviour, or `git diff` output-control flags such as `--stat`, `--word-diff` and the whitespace options, read `references/git-log-format.md`.
 
@@ -49,8 +50,8 @@ If you need the placeholder catalogue, format presets, `--diff-filter` letters,
 Offer the operation and its consequence; run it only once the user has chosen.
 
 - Backporting the commit to another branch is a cherry-pick, and cherry-pick is `git-commits`' — it owns the destination-branch check, the `rtk git` wrapper and the `--abort` path. Hand it the SHA; do not run `git cherry-pick` from here.
-- `git revert <commit>` adds a new commit undoing it — for un-applying merged work without rewriting history.
-- `git blame <file>` attributes each line to the commit that last touched it, when the question is which commit introduced one specific line.
+- `rtk git revert <commit>` adds a new commit undoing it — for un-applying merged work without rewriting history.
+- `rtk git blame <file>` attributes each line to the commit that last touched it, when the question is which commit introduced one specific line.
 
 For diff output control on the located commit, read `references/git-log-format.md`.
 
diff --git a/plugins/git/skills/git-history/references/bisect.md b/plugins/git/skills/git-history/references/bisect.md
index 2fd7026..bfca3e6 100644
--- a/plugins/git/skills/git-history/references/bisect.md
+++ b/plugins/git/skills/git-history/references/bisect.md
@@ -12,43 +12,43 @@ or line range to search the log for. Binary search reduces the trials from O(N)
 ## Manual flow
 
 ```bash
-git bisect start
-git bisect bad [HEAD]        # mark current (or specified) as broken
-git bisect good <commit>     # mark known-good baseline
+rtk git bisect start
+rtk git bisect bad [HEAD]        # mark current (or specified) as broken
+rtk git bisect good <commit>     # mark known-good baseline
 # Git checks out the midpoint; test it
-git bisect good              # test passes
-git bisect bad               # test fails
+rtk git bisect good              # test passes
+rtk git bisect bad               # test fails
 # Repeat until git reports "X is the first bad commit"
-git bisect reset             # return to the original HEAD
+rtk git bisect reset             # return to the original HEAD
 ```
 
 ## Automated
 
-With a test command available, use `git bisect run <cmd>`. Git reads the exit code: `0` good,
+With a test command available, use `rtk git bisect run <cmd>`. Git reads the exit code: `0` good,
 `1`–`124` bad, `125` skip (build broken), `126`–`127` POSIX shell errors, treated as bad, and
 `128` or above aborts the session outright rather than marking the commit bad.
 
 ## Untestable commits
 
-`git bisect skip` excludes a commit that cannot be built or tested without deciding good or bad
+`rtk git bisect skip` excludes a commit that cannot be built or tested without deciding good or bad
 for it. When the first bad commit is adjacent to a skipped range, bisect reports that it cannot
 pinpoint the culprit and lists the candidates — that is the precise answer the skip range allows,
 not a failure.
 
 ## Undoing a wrong good/bad call
 
-`git bisect log` prints the session's decision history. Save it, edit out the mistaken entry, and
+`rtk git bisect log` prints the session's decision history. Save it, edit out the mistaken entry, and
 resume from the corrected log rather than restarting the search:
 
 ```bash
-git bisect log > bisect.log
+rtk git bisect log > bisect.log
 # edit bisect.log, removing the wrong decision
-git bisect reset && git bisect replay bisect.log
+rtk git bisect reset && rtk git bisect replay bisect.log
 ```
 
 ## Narrowing and speeding up
 
-- `git bisect start HEAD v1.2 -- src/` restricts bisection to a path, cutting the trial count.
+- `rtk git bisect start HEAD v1.2 -- src/` restricts bisection to a path, cutting the trial count.
 - `--no-checkout` updates the `BISECT_HEAD` ref instead of checking out a working tree — useful
   for tests that do not need one, and automatic in bare repos.
 - `--first-parent` follows only first parents at merges, finding the integration commit that
@@ -56,12 +56,12 @@ git bisect reset && git bisect replay bisect.log
 
 ## Inspecting the remaining candidates
 
-`git bisect visualize` (alias `view`) opens the suspects in gitk, falling back to `git log` when
+`rtk git bisect visualize` (alias `view`) opens the suspects in gitk, falling back to `git log` when
 no graphical display is detected. Add `--stat` or `-p` for a diffstat or full patches.
 
 ## Hunting a non-bug property change
 
-`git bisect start --term-new <new> --term-old <old>` searches for any property change — a
+`rtk git bisect start --term-new <new> --term-old <old>` searches for any property change — a
 performance regression, say — instead of a bug. Use the custom terms in place of `good` and `bad`
 for the rest of the session.
 
diff --git a/plugins/git/skills/git-history/references/git-log-format.md b/plugins/git/skills/git-history/references/git-log-format.md
index 821bfdd..2481e09 100644
--- a/plugins/git/skills/git-history/references/git-log-format.md
+++ b/plugins/git/skills/git-history/references/git-log-format.md
@@ -116,15 +116,15 @@ source_keys:
 **`-S<string>`** — finds commits where the **count** of `<string>` changed (i.e. the string was added or removed net). Does not match commits where the string merely appears in a diff hunk without a count change.
 
 ```bash
-git log -S"my_function"
-git log -S"my_function" --pickaxe-regex    # treat as POSIX ERE
-git log -S"my_function" --pickaxe-all      # show all files in matching changesets
+rtk git log -S"my_function"
+rtk git log -S"my_function" --pickaxe-regex    # treat as POSIX ERE
+rtk git log -S"my_function" --pickaxe-all      # show all files in matching changesets
 ```
 
 **`-G<regex>`** — finds commits where any added or removed **line** in the patch matches `<regex>`. Broader than `-S`: matches whenever the pattern appears in diff text regardless of count.
 
 ```bash
-git log -G"frotz\(nitfol"
+rtk git log -G"frotz\(nitfol"
 ```
 
 **Critical distinction:** given a diff that removes one occurrence of `foo` and adds one occurrence of `foo` (net change = 0):
@@ -151,8 +151,8 @@ Selects commits (in `git log`) or files (in `git diff`) by change type:
 
 Lowercase letters **exclude** that type:
 ```bash
-git log --diff-filter=ad       # exclude added and deleted files
-git log --diff-filter=M        # only show commits with modified files
+rtk git log --diff-filter=ad       # exclude added and deleted files
+rtk git log --diff-filter=M        # only show commits with modified files
 ```
 
 `C` and `R` only appear when copy/rename detection is enabled (`-C`, `-M` flags or `diff.renames` config).
@@ -161,11 +161,15 @@ git log --diff-filter=M        # only show commits with modified files
 
 Traces the evolution of a specific range of lines or a named function through commits. Implies `--patch`.
 
+Bare `git`, not `rtk git`, on every `-L` form below: rtk truncates each diff body
+line at roughly 72 characters with an ellipsis, on the one query whose whole point
+is showing line content.
+
 ```bash
-git log -L 10,20:file.txt
-git log -L /start_pattern/,/end_pattern/:file.txt
-git log -L :myfunction:src/app.c
-git log -L /init/,+15:config.py          # 15 lines after first match of /init/
+git log -L 10,20:file.txt                          # bare per ADR-0023
+git log -L /start_pattern/,/end_pattern/:file.txt  # bare per ADR-0023
+git log -L :myfunction:src/app.c                   # bare per ADR-0023
+git log -L /init/,+15:config.py                    # bare per ADR-0023; 15 lines after first /init/ match
 ```
 
 Range formats:
@@ -182,12 +186,12 @@ Limitations: incompatible with `--raw`, `--numstat`, `--shortstat`, `--name-only
 ## Graph and Ancestry Filters
 
 ```bash
-git log --first-parent            # at merges, follow only first parent (mainline evolution)
-git log --merges                  # only merge commits (≥2 parents); equivalent to --min-parents=2
-git log --no-merges               # only non-merge commits; equivalent to --max-parents=1
-git log --ancestry-path D..M      # only commits actually on the path from D to M
-git log --min-parents=<n>         # include only commits with ≥ n parents
-git log --max-parents=<n>         # include only commits with ≤ n parents
+rtk git log --first-parent            # at merges, follow only first parent (mainline evolution)
+rtk git log --merges                  # only merge commits (≥2 parents); equivalent to --min-parents=2
+rtk git log --no-merges               # only non-merge commits; equivalent to --max-parents=1
+rtk git log --ancestry-path D..M      # only commits actually on the path from D to M
+rtk git log --min-parents=<n>         # include only commits with ≥ n parents
+rtk git log --max-parents=<n>         # include only commits with ≤ n parents
 ```
 
 `--ancestry-path` is significant: without it, `D..M` includes all commits reachable from M but not D — including side branches that merged into the path. With it, only commits directly between D and M are shown.
@@ -197,28 +201,34 @@ git log --max-parents=<n>         # include only commits with ≤ n parents
 ### --stat
 
 ```bash
-git diff --stat                   # diffstat: file names + ± bar
-git diff --stat=<width>,<name-width>,<count>
-git diff --compact-summary        # alongside --stat: shows new/gone, +x/-x (executable), +l (symlink)
-git diff --numstat                # machine-readable: <added>\t<deleted>\t<path>; - for binary
+rtk git diff --stat                   # diffstat: file names + ± bar
+rtk git diff --stat=<width>,<name-width>,<count>
+rtk git diff --compact-summary        # alongside --stat: shows new/gone, +x/-x (executable), +l (symlink)
+rtk git diff --numstat                # machine-readable: <added>\t<deleted>\t<path>; - for binary
 ```
 
 ### --name-only / --name-status
 
+Bare `git`, not `rtk git`: rtk appends a blank line and a `Changes:` trailer, so
+the output is no longer one record per line.
+
 ```bash
-git diff --name-only              # only filenames, one per line
-git diff --name-status            # status letter + filename per line
+git diff --name-only      # bare per ADR-0023; only filenames, one per line
+git diff --name-status    # bare per ADR-0023; status letter + filename per line
 ```
 
 `--name-status` uses the same status letters as `--diff-filter`.
 
 ### --word-diff
 
+Bare `git`, not `rtk git`: rtk replaces the word-diff with its own diffstat
+renderer and emits none of the `[-removed-] {+added+}` markers.
+
 ```bash
-git diff --word-diff              # inline word-level diff with [-removed-] {+added+} markers
-git diff --word-diff=color        # color only, no markers
-git diff --word-diff=porcelain    # machine-readable: +/- prefixed lines, ~ for newlines
-git diff --word-diff-regex=<re>   # define what counts as a "word"
+git diff --word-diff             # bare per ADR-0023; inline word-level diff, [-removed-] {+added+} markers
+git diff --word-diff=color       # bare per ADR-0023; color only, no markers
+git diff --word-diff=porcelain   # bare per ADR-0023; machine-readable: +/- prefixed lines, ~ for newlines
+git diff --word-diff-regex=<re>  # bare per ADR-0023; define what counts as a "word"
 ```
 
 ### Whitespace Flags
diff --git a/plugins/git/skills/git-remotes/SKILL.md b/plugins/git/skills/git-remotes/SKILL.md
index 5f457c1..181768e 100644
--- a/plugins/git/skills/git-remotes/SKILL.md
+++ b/plugins/git/skills/git-remotes/SKILL.md
@@ -10,6 +10,7 @@ description: >
   Not submodule pointers -> `git-submodules`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - git-scm-remote-docs
@@ -27,7 +28,7 @@ metadata:
 
 ## Step 1 — Clear the force-push gate
 
-`main` and `master` are a hard refusal: decline a force-push targeting either, whatever confirmation accompanies it, because no local approval can restore what the remote loses. On any other branch, `git push --force` and `-f` run only after the caller passes `confirm: true` for that specific push — for a human caller, prompt instead of failing.
+`main` and `master` are a hard refusal: decline a force-push targeting either, whatever confirmation accompanies it, because no local approval can restore what the remote loses. On any other branch, `rtk git push --force` and `-f` run only after the caller passes `confirm: true` for that specific push — for a human caller, prompt instead of failing.
 
 ## Step 2 — Dispatch
 
diff --git a/plugins/git/skills/git-remotes/references/fetch.md b/plugins/git/skills/git-remotes/references/fetch.md
index 0826b17..8198b71 100644
--- a/plugins/git/skills/git-remotes/references/fetch.md
+++ b/plugins/git/skills/git-remotes/references/fetch.md
@@ -11,19 +11,19 @@ Fetch **with no refspec** updates remote-tracking branches (`refs/remotes/<name>
 
 That safety comes from the default refspec, not from `fetch` itself. Give it an explicit one and it writes to local branches: verified on Git 2.39.5, `git fetch origin main:probe` fast-forwarded the local `probe` branch, and a `+` prefix force-updates the destination, discarding whatever commits it held. Treat any `fetch` carrying a `<src>:<dst>` refspec as a branch update, not a read.
 
-- **One remote**: `git fetch <remote>` — all branches
-- **One branch**: `git fetch <remote> <branch>` — the result lands in `FETCH_HEAD`, not a tracking ref
-- **All remotes**: `git fetch --all`
-- **Prune properly**: `git fetch --all --prune --prune-tags` cleans stale branches *and* tags
-- **Auto-prune**: `git config --global fetch.prune true` (or `remote.<name>.prune` to scope it to one remote), and `fetch.pruneTags true` for tags
+- **One remote**: `rtk git fetch <remote>` — all branches
+- **One branch**: `rtk git fetch <remote> <branch>` — the result lands in `FETCH_HEAD`, not a tracking ref
+- **All remotes**: `rtk git fetch --all`
+- **Prune properly**: `rtk git fetch --all --prune --prune-tags` cleans stale branches *and* tags
+- **Auto-prune**: `rtk git config --global fetch.prune true` (or `remote.<name>.prune` to scope it to one remote), and `fetch.pruneTags true` for tags
 
 ## Shallow and partial fetch
 
 ```bash
-git fetch --depth=<n>             # deepen history, or create a shallow clone
-git fetch --unshallow             # convert a shallow clone to full history
-git fetch --update-shallow        # allow the fetch to update the shallow boundary
-git fetch --refmap='' <remote> <branch>  # fetch without updating any tracking ref (FETCH_HEAD only)
+rtk git fetch --depth=<n>             # deepen history, or create a shallow clone
+rtk git fetch --unshallow             # convert a shallow clone to full history
+rtk git fetch --update-shallow        # allow the fetch to update the shallow boundary
+rtk git fetch --refmap='' <remote> <branch>  # fetch without updating any tracking ref (FETCH_HEAD only)
 ```
 
 ## Default fetch refspec
diff --git a/plugins/git/skills/git-remotes/references/pull.md b/plugins/git/skills/git-remotes/references/pull.md
index b769742..dcf72fc 100644
--- a/plugins/git/skills/git-remotes/references/pull.md
+++ b/plugins/git/skills/git-remotes/references/pull.md
@@ -9,11 +9,11 @@ source_keys:
 
 Default strategy: `--ff-only`. It fails on divergence, which forces a conscious choice instead of an accidental merge commit.
 
-- **Fast-forward only**: `git pull --ff-only` — the recommended default
-- **Rebase**: `git pull --rebase` replays your commits on top for linear history, but rewrites SHAs. Verify nothing being replayed has been pushed: rebasing published commits breaks everyone downstream.
-- **Merge**: `git pull --no-rebase` — three-way merge commit, preserves original commits, non-linear
-- **Rebase preserving merges**: `git pull --rebase=merges` keeps intentional local merge commits during the replay
-- **Stage without committing**: `git pull --squash` collapses incoming commits into staged changes; you write the message
+- **Fast-forward only**: `rtk git pull --ff-only` — the recommended default
+- **Rebase**: `rtk git pull --rebase` replays your commits on top for linear history, but rewrites SHAs. Verify nothing being replayed has been pushed: rebasing published commits breaks everyone downstream.
+- **Merge**: `rtk git pull --no-rebase` — three-way merge commit, preserves original commits, non-linear
+- **Rebase preserving merges**: `rtk git pull --rebase=merges` keeps intentional local merge commits during the replay
+- **Stage without committing**: `rtk git pull --squash` collapses incoming commits into staged changes; you write the message
 - **Merge strategy**: Git 2.34+ defaults to `ort` (`recursive` is now an alias for it). Strategy options such as `-X ours`, `-X theirs`, `-X ignore-space-change` pass through unchanged.
 - **Submodules**: `--recurse-submodules` only fetches submodules already checked out. Newly added ones are not initialized — use the `git-submodules` skill for those.
 
@@ -37,7 +37,7 @@ Highest wins:
 4. `branch.autoSetupRebase` (set automatically when the tracking branch was created)
 
 ```bash
-git config pull.ff only                  # deterministic default across Git versions
-git config --global pull.rebase true
-git config branch.develop.rebase false   # develop always merges, regardless of the global default
+rtk git config pull.ff only                  # deterministic default across Git versions
+rtk git config --global pull.rebase true
+rtk git config branch.develop.rebase false   # develop always merges, regardless of the global default
 ```
diff --git a/plugins/git/skills/git-remotes/references/push.md b/plugins/git/skills/git-remotes/references/push.md
index dd032fb..8fc10fb 100644
--- a/plugins/git/skills/git-remotes/references/push.md
+++ b/plugins/git/skills/git-remotes/references/push.md
@@ -9,14 +9,14 @@ source_keys:
 
 Default: safe push to the same-named branch on the remote.
 
-- **Force-push**: never bare `--force`. Use `git push --force-with-lease --force-if-includes <remote> <branch>`, after the SKILL.md Step 1 gate.
-- **Basic**: `git push <remote> <branch>`
-- **Set upstream**: `git push -u <remote> <branch>` — push and configure tracking
-- **Multi-remote**: push sequentially (`git push origin develop`, `git push staging develop`), or add a second push URL with `git remote set-url --add <name> <url>` to reach both in one command
-- **Delete a remote branch**: `git push <remote> --delete <branch>` — clearer than the `:<branch>` form
-- **Bulk**: `git push --all` (all local branches), `git push --tags` (all tags), `git push origin <tag>` (one tag)
-- **Delete remote branches with no local counterpart**: `git push --prune origin 'refs/heads/*:refs/heads/*'`
-- **Force only part of a multi-ref push**: prefix the one refspec that needs it with `+` — `git push origin +release develop` forces `release` while safe-pushing `develop`. A `+` prefix is a force-push and passes the SKILL.md Step 1 gate like any other.
+- **Force-push**: never bare `--force`. Use `rtk git push --force-with-lease --force-if-includes <remote> <branch>`, after the SKILL.md Step 1 gate.
+- **Basic**: `rtk git push <remote> <branch>`
+- **Set upstream**: `rtk git push -u <remote> <branch>` — push and configure tracking
+- **Multi-remote**: push sequentially (`rtk git push origin develop`, `rtk git push staging develop`), or add a second push URL with `rtk git remote set-url --add <name> <url>` to reach both in one command
+- **Delete a remote branch**: `rtk git push <remote> --delete <branch>` — clearer than the `:<branch>` form
+- **Bulk**: `rtk git push --all` (all local branches), `rtk git push --tags` (all tags), `rtk git push origin <tag>` (one tag)
+- **Delete remote branches with no local counterpart**: `rtk git push --prune origin 'refs/heads/*:refs/heads/*'`
+- **Force only part of a multi-ref push**: prefix the one refspec that needs it with `+` — `rtk git push origin +release develop` forces `release` while safe-pushing `develop`. A `+` prefix is a force-push and passes the SKILL.md Step 1 gate like any other.
 
 ## Refspec syntax — `[+]<src>[:<dst>]`
 
@@ -48,19 +48,21 @@ Two mitigations:
 # Option 1 — dedicated push-only remote: background tools fetch `origin`, you push
 # through a separate remote that nothing else touches, so its tracking ref can't be
 # poisoned by an unrelated fetch.
-git remote add origin-push $(git config remote.origin.url)
-git push --force-with-lease origin-push
+# The inner `git config` is bare: its stdout becomes a remote URL, so any
+# output rewriting would poison the remote silently.
+rtk git remote add origin-push $(git config remote.origin.url)   # inner bare per ADR-0023
+rtk git push --force-with-lease origin-push
 
 # Option 2 — explicit SHA via a local tag, unaffected by tracking-branch state
-git fetch
-git tag base master
-git rebase -i master
-git push --force-with-lease=master:base master:master
+rtk git fetch
+rtk git tag base master
+git rebase -i master   # bare, not `rtk` (ADR-0023): interactive sequence editor
+rtk git push --force-with-lease=master:base master:master
 ```
 
 `--force-if-includes` adds a second check on top of bare `--force-with-lease`: it verifies the remote-tracking tip actually appears in your local branch's reflog, i.e. you genuinely integrated it before rewriting. It is a no-op without `--force-with-lease`, and has no effect with the `--force-with-lease=<ref>:<sha>` form, which already pins an exact SHA.
 
-Safest combination: `git push --force-with-lease --force-if-includes origin`.
+Safest combination: `rtk git push --force-with-lease --force-if-includes origin`.
 
 ## Server-side policy
 
diff --git a/plugins/git/skills/git-remotes/references/remote-config.md b/plugins/git/skills/git-remotes/references/remote-config.md
index 5d44eef..3470543 100644
--- a/plugins/git/skills/git-remotes/references/remote-config.md
+++ b/plugins/git/skills/git-remotes/references/remote-config.md
@@ -9,31 +9,31 @@ source_keys:
 
 Which remotes exist, where they point, and what they track.
 
-`git remote show <name>` needs network access — use `-n` for cached data offline, or `git remote -v`, which lists URLs without querying.
+`rtk git remote show <name>` needs network access — use `-n` for cached data offline, or `rtk git remote -v`, which lists URLs without querying.
 
 ## Add, remove, rename, inspect
 
-- **Add**: `git remote add <name> <url>`, or `-f` to fetch immediately
-- **Remove**: `git remote remove <name>` — deletes the remote, all its tracking refs, and its config
-- **Rename**: `git remote rename <old> <new>`
-- **Inspect**: `git remote -v` (URLs, offline) or `git remote show <name>` (live tracking status)
-- **Effective URLs**: `git remote get-url <name>` shows the URL after `insteadOf` rewrites; `git remote get-url --push --all <name>` lists every push URL
+- **Add**: `rtk git remote add <name> <url>`, or `-f` to fetch immediately
+- **Remove**: `rtk git remote remove <name>` — deletes the remote, all its tracking refs, and its config
+- **Rename**: `rtk git remote rename <old> <new>`
+- **Inspect**: `rtk git remote -v` (URLs, offline) or `rtk git remote show <name>` (live tracking status)
+- **Effective URLs**: `rtk git remote get-url <name>` shows the URL after `insteadOf` rewrites; `rtk git remote get-url --push --all <name>` lists every push URL
 
 ## Tracking, mirroring, housekeeping
 
-- **Track one branch**: `git remote add -t <branch> <name> <url>` (repeatable); `--no-tags` suppresses tag import entirely
+- **Track one branch**: `rtk git remote add -t <branch> <name> <url>` (repeatable); `--no-tags` suppresses tag import entirely
 - **Mirror**: `--mirror=fetch` mirrors all refs locally (bare repos only); `--mirror=push` makes every push behave like `--mirror`
-- **Prune stale tracking refs without fetching**: `git remote prune <name>`, with `--dry-run` to preview
-- **Default branch pointer**: `git remote set-head <name> -a` (auto-detect, needs a prior fetch), `... <branch>` (explicit), `... -d` (delete `refs/remotes/<name>/HEAD`)
+- **Prune stale tracking refs without fetching**: `rtk git remote prune <name>`, with `--dry-run` to preview
+- **Default branch pointer**: `rtk git remote set-head <name> -a` (auto-detect, needs a prior fetch), `... <branch>` (explicit), `... -d` (delete `refs/remotes/<name>/HEAD`)
 
 ## `set-url` — full form
 
 ```bash
-git remote set-url <name> <newurl>                  # replace the first fetch URL
-git remote set-url <name> <newurl> <oldurl-regex>   # replace only the URL matching regex
-git remote set-url --push <name> <url>              # change push URL only (must point at same repo)
-git remote set-url --add <name> <url>               # add an extra push URL (push to multiple remotes)
-git remote set-url --delete <name> <regex>          # remove URLs matching regex
+rtk git remote set-url <name> <newurl>                  # replace the first fetch URL
+rtk git remote set-url <name> <newurl> <oldurl-regex>   # replace only the URL matching regex
+rtk git remote set-url --push <name> <url>              # change push URL only (must point at same repo)
+rtk git remote set-url --add <name> <url>               # add an extra push URL (push to multiple remotes)
+rtk git remote set-url --delete <name> <regex>          # remove URLs matching regex
 ```
 
 `--push` changes only where pushes go — fetch and push URLs must still reference the same repository. For genuine fetch-from-A / push-to-B workflows, use two separate named remotes instead; `--push` cannot do this.
diff --git a/plugins/git/skills/git-submodules/SKILL.md b/plugins/git/skills/git-submodules/SKILL.md
index 55d65f2..f3969f7 100644
--- a/plugins/git/skills/git-submodules/SKILL.md
+++ b/plugins/git/skills/git-submodules/SKILL.md
@@ -9,6 +9,7 @@ description: >
   Not the superproject's own remotes -> `git-remotes`.
 
 metadata:
+  version: "1.0.0"
   category: git
   source_keys:
     - git-scm-submodule-docs
diff --git a/plugins/git/skills/git-workflow/SKILL.md b/plugins/git/skills/git-workflow/SKILL.md
index 8f2f871..557f81f 100644
--- a/plugins/git/skills/git-workflow/SKILL.md
+++ b/plugins/git/skills/git-workflow/SKILL.md
@@ -8,6 +8,7 @@ description: >
   agent caller -> `git-orchestrate`. Not Gitea -> `gitea-workflow`.
 
 metadata:
+  version: "1.0.0"
   category: git
   source_keys:
     - nvie-gitflow-post
diff --git a/plugins/git/skills/git-worktrees/SKILL.md b/plugins/git/skills/git-worktrees/SKILL.md
index 15a89fc..a72332c 100644
--- a/plugins/git/skills/git-worktrees/SKILL.md
+++ b/plugins/git/skills/git-worktrees/SKILL.md
@@ -8,6 +8,7 @@ description: >
   Not interactive multi-step git guidance -> `git-workflow`.
 
 metadata:
+  version: "1.0.1"
   category: git
   source_keys:
     - git-scm-worktree-docs
@@ -16,7 +17,7 @@ metadata:
 ## Gotchas
 
 - **A branch can be checked out in only one worktree at a time.** `git worktree add` on an already-checked-out branch fails; `--force` is the only override, so use it only deliberately.
-- **Never `rm -rf` a worktree directory.** That strands metadata in `$GIT_DIR/worktrees/`. Use `git worktree remove`, or `git worktree prune` afterwards.
+- **Never `rm -rf` a worktree directory.** That strands metadata in `$GIT_DIR/worktrees/`. Use `rtk git worktree remove`, or `rtk git worktree prune` afterwards.
 - **Submodules break worktree support.** A worktree containing submodules cannot be moved at all, and needs `--force` to remove.
 - **`extensions.worktreeConfig = true` is a one-way door.** Without it, `git config --worktree` errors; with it, that flag writes to the worktree's own `config.worktree` file, and `core.bare`/`core.worktree` are forced there too. It also breaks older Git. Leave it off unless per-worktree config is needed.
 
@@ -24,19 +25,19 @@ metadata:
 
 | Operation | Run |
 |---|---|
-| Create on a branch that already exists locally | `git worktree add <path> <branch>` |
-| Create on a new branch | `git worktree add -b <branch> <path>` |
-| Create on the branch named after the path basename | `git worktree add <path>` — checks that branch out if it exists, else creates it from HEAD |
-| Create and reset an existing branch to HEAD — discards its commits | `git worktree add -B <branch> <path>` |
-| Create a local branch tracking a remote one | `git worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add <path> <branch>` expands to exactly this, but **only** under the conditions in `references/worktrees.md` |
-| Throwaway experiment, no branch | `git worktree add -d <path>` — detached HEAD |
+| Create on a branch that already exists locally | `rtk git worktree add <path> <branch>` |
+| Create on a new branch | `rtk git worktree add -b <branch> <path>` |
+| Create on the branch named after the path basename | `rtk git worktree add <path>` — checks that branch out if it exists, else creates it from HEAD |
+| Create and reset an existing branch to HEAD — discards its commits | `rtk git worktree add -B <branch> <path>` |
+| Create a local branch tracking a remote one | `rtk git worktree add --track -b <branch> <path> <remote>/<branch>` — always correct. `git worktree add <path> <branch>` expands to exactly this, but **only** under the conditions in `references/worktrees.md` |
+| Throwaway experiment, no branch | `rtk git worktree add -d <path>` — detached HEAD |
 | **Never** `git worktree add <path> <remote>/<branch>` | That ref resolves, so the shortcut never fires and you get **a detached HEAD, no branch, no upstream**. Commits there go unreachable once HEAD moves, and `git push` needs an explicit refspec. Use the tracking row above |
-| List | `git worktree list -v`, or `--porcelain -z` to parse |
-| Lock or unlock | `git worktree lock [--reason <str>] <path>` / `git worktree unlock <path>` |
-| Move | `git worktree move <from> <to>` |
-| Remove | `git worktree remove <path>` |
-| Prune stale metadata | `git worktree prune --dry-run`, then without the flag |
-| Repair after a manual move | `git worktree repair` — in the main worktree if *it* moved, or inside a linked worktree that moved. `git worktree repair <path>...` — from any worktree, naming each moved linked worktree's new path |
+| List | `git worktree list -v` to read, or `git worktree list --porcelain -z` to parse — both bare per ADR-0023: rtk re-renders the output and drops the porcelain flags |
+| Lock or unlock | `rtk git worktree lock [--reason <str>] <path>` / `rtk git worktree unlock <path>` |
+| Move | `rtk git worktree move <from> <to>` |
+| Remove | `rtk git worktree remove <path>` |
+| Prune stale metadata | `rtk git worktree prune --dry-run`, then without the flag |
+| Repair after a manual move | `rtk git worktree repair` — in the main worktree if *it* moved, or inside a linked worktree that moved. `rtk git worktree repair <path>...` — from any worktree, naming each moved linked worktree's new path |
 
 If the operation needs anything the table does not carry — the full `add` flag
 table, orphan branches, sparse-checkout, locking for removable media, remote
@@ -48,7 +49,7 @@ Gates:
 
 - **`move`, `remove` — the main worktree cannot be moved or removed.** Only linked worktrees, the ones `git worktree add` created, are candidates.
 - **`add`, `move`, `remove` — escalate force flags one step at a time.** `-f` overrides a safeguard such as an unclean tree; `move` and `remove` need `-ff` on top of that when the worktree is locked. Confirm with the user before either — both discard state.
-- **`add` — lock at creation, not after.** `git worktree add --lock` is atomic, where add-then-`lock` leaves a window in which the worktree is unprotected.
+- **`add` — lock at creation, not after.** `rtk git worktree add --lock` is atomic, where add-then-`lock` leaves a window in which the worktree is unprotected.
 
 ## Step 2 — Report
 
@@ -61,6 +62,7 @@ worktrees:
     lock_reason: <reason or empty>
 ```
 
-Derive those fields from `git worktree list --porcelain -z`. For a single
+Derive those fields from `git worktree list --porcelain -z` — bare, not `rtk`:
+rtk drops both flags and never emits `locked`/`lock_reason` (ADR-0023). For a single
 operation, report its outcome instead — `created: true`, `moved: true`,
 `removed: true`.
diff --git a/plugins/git/skills/git-worktrees/references/worktrees.md b/plugins/git/skills/git-worktrees/references/worktrees.md
index c4d9b22..5894bd7 100644
--- a/plugins/git/skills/git-worktrees/references/worktrees.md
+++ b/plugins/git/skills/git-worktrees/references/worktrees.md
@@ -23,17 +23,17 @@ that are usable.
 ## `add` forms
 
 ```bash
-git worktree add <path> <branch>              # <branch> exists locally: check it out — non-destructive
-git worktree add -b <branch> <path>           # create a new branch; fails if it exists
-git worktree add <path>                       # branch named after $(basename <path>): checked out
+rtk git worktree add <path> <branch>              # <branch> exists locally: check it out — non-destructive
+rtk git worktree add -b <branch> <path>           # create a new branch; fails if it exists
+rtk git worktree add <path>                       # branch named after $(basename <path>): checked out
                                               # if it exists, else created from HEAD
-git worktree add -B <branch> <path>           # create the branch, or reset an existing one to HEAD,
+rtk git worktree add -B <branch> <path>           # create the branch, or reset an existing one to HEAD,
                                               # discarding the commits it carried
-git worktree add --track -b <branch> <path> <remote>/<branch>
+rtk git worktree add --track -b <branch> <path> <remote>/<branch>
                                               # new local branch tracking the remote — always works
-git worktree add <path> <branch>              # <branch> absent locally and in exactly one remote:
+rtk git worktree add <path> <branch>              # <branch> absent locally and in exactly one remote:
                                               # Git expands this to the --track -b form above
-git worktree add -d <path>                    # detached HEAD, no branch
+rtk git worktree add -d <path>                    # detached HEAD, no branch
 ```
 
 The same `git worktree add <path> <branch>` spelling appears twice above and does two
@@ -65,19 +65,19 @@ Using `-` as `<commit-ish>` is shorthand for `@{-1}` (the branch checked out bef
 ## New unborn branch
 
 ```bash
-git worktree add --orphan -b <branch> <path>
+rtk git worktree add --orphan -b <branch> <path>
 ```
 Creates an empty branch with no commits. **`--orphan` needs Git 2.42 or later** — it was added
 upstream in 2.42, and on 2.39.5 this fails with `error: unknown option 'orphan'` and exit 129.
-Check `git --version` before reaching for it.
+Check `rtk git --version` before reaching for it.
 
 Fallback on older Git, verified on 2.39.5 — detach first, then orphan the linked worktree in place,
 which leaves the main worktree on its own branch throughout:
 
 ```bash
-git worktree add -d <path>       # linked worktree, detached HEAD
+rtk git worktree add -d <path>       # linked worktree, detached HEAD
 cd <path>
-git switch --orphan <branch>     # unborn branch: empty index, empty working tree
+rtk git switch --orphan <branch>     # unborn branch: empty index, empty working tree
 ```
 
 `git worktree list` then shows the new worktree at `0000000 [<branch>]` until its first commit.
@@ -88,25 +88,25 @@ the disruption worktrees exist to avoid.
 
 Suppress the initial checkout to configure sparse-checkout first:
 ```bash
-git worktree add --no-checkout ../sparse main
+rtk git worktree add --no-checkout ../sparse main
 cd ../sparse
-git sparse-checkout init --cone
-git sparse-checkout set src/
-git checkout main
+rtk git sparse-checkout init --cone
+rtk git sparse-checkout set src/
+rtk git checkout main
 ```
 
 ## Worktree on removable media
 
 ```bash
-git worktree add --lock --reason "external SSD" <path> <branch>
-git worktree unlock <path>  # when reconnected
+rtk git worktree add --lock --reason "external SSD" <path> <branch>
+rtk git worktree unlock <path>  # when reconnected
 ```
 
 ## Remote-branch disambiguation
 
 ```bash
-git worktree add --track -b <branch> <path> <remote>/<branch>   # explicit: no guessing at all
-git worktree add <path> <branch>                                # shortcut: needs one clear remote
+rtk git worktree add --track -b <branch> <path> <remote>/<branch>   # explicit: no guessing at all
+rtk git worktree add <path> <branch>                                # shortcut: needs one clear remote
 ```
 **The bare-name shortcut needs exactly one remote.** It fires only when `<branch>` is not found
 locally, none of `-b`/`-B`/`--detach` were given, and a tracking branch of that name exists in
@@ -122,10 +122,10 @@ exactly one remote has it, and marks that branch as upstream. Its default comes
 ## Repair after a manual move
 
 ```bash
-git worktree repair            # the MAIN worktree moved: run it there to reconnect every linked
+rtk git worktree repair            # the MAIN worktree moved: run it there to reconnect every linked
                                # worktree back to the main worktree
-git worktree repair            # a LINKED worktree moved: run it inside that recently-moved worktree
-git worktree repair <path>...  # reconnect a specific linked worktree — runnable from any worktree,
+rtk git worktree repair            # a LINKED worktree moved: run it inside that recently-moved worktree
+rtk git worktree repair <path>...  # reconnect a specific linked worktree — runnable from any worktree,
                                # naming each moved tree's new path
 ```
 
@@ -133,10 +133,10 @@ Which form applies depends on what moved:
 
 | What moved | Remedy |
 |---|---|
-| The main worktree (or bare repo) | `git worktree repair` in the main worktree |
-| One linked worktree | `git worktree repair` inside that worktree |
-| Several linked worktrees | `git worktree repair <path>...` from any worktree, listing each new path |
-| Both main and linked worktrees | `git worktree repair <path>...` in the main worktree, naming each linked worktree's new path — this restores the connections in both directions |
+| The main worktree (or bare repo) | `rtk git worktree repair` in the main worktree |
+| One linked worktree | `rtk git worktree repair` inside that worktree |
+| Several linked worktrees | `rtk git worktree repair <path>...` from any worktree, listing each new path |
+| Both main and linked worktrees | `rtk git worktree repair <path>...` in the main worktree, naming each linked worktree's new path — this restores the connections in both directions |
 
 Only the no-argument form is tied to the current directory. The `<path>...` form is not — it
 reestablishes the connection to every path you name, run from any worktree.
@@ -157,20 +157,20 @@ reestablishes the connection to every path you name, run from any worktree.
 untouched throughout:
 
 ```bash
-git worktree add -b emergency-fix ../temp main
+rtk git worktree add -b emergency-fix ../temp main
 cd ../temp
 # fix, then commit
-git commit -a -m "fix: critical production bug"
+rtk git commit -a -m "fix: critical production bug"
 cd -
-git worktree remove ../temp
+rtk git worktree remove ../temp
 ```
 
 **Review a PR branch alongside your own work** — both branches stay checked out, so there is no
 context switch:
 
 ```bash
-git worktree add ../review-pr-123 origin/feature-xyz          # detached HEAD — read-only review
-git worktree add --track -b feature-xyz ../review-pr-123 origin/feature-xyz   # if you will commit
+rtk git worktree add ../review-pr-123 origin/feature-xyz          # detached HEAD — read-only review
+rtk git worktree add --track -b feature-xyz ../review-pr-123 origin/feature-xyz   # if you will commit
 # open ../review-pr-123 in a second editor window or terminal
 ```
 
diff --git a/plugins/git/skills/pc-author/SKILL.md b/plugins/git/skills/pc-author/SKILL.md
index b1d1db8..8b7c411 100644
--- a/plugins/git/skills/pc-author/SKILL.md
+++ b/plugins/git/skills/pc-author/SKILL.md
@@ -6,6 +6,7 @@ description: >
   shellcheck"). Not running, installing, or updating hooks -> `pc-run`.
 allowed-tools: Bash Read Write Edit
 metadata:
+  version: "1.0.0"
   category: devtools
   source_keys:
     - context7-pre-commit-com
diff --git a/plugins/git/skills/pc-author/references/create-config.md b/plugins/git/skills/pc-author/references/create-config.md
index 8adfdfb..c9ef9fd 100644
--- a/plugins/git/skills/pc-author/references/create-config.md
+++ b/plugins/git/skills/pc-author/references/create-config.md
@@ -15,7 +15,7 @@ flow's file is not needed here. `SKILL.md`'s three common gates still apply.
    inferring them from the project's name or README:
 
    ```bash
-   git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
+   rtk git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
    ```
 
 2. Read `references/hooks-by-language.md` and map the detected extensions to recommended hooks.
diff --git a/plugins/git/skills/pc-author/references/modify-config.md b/plugins/git/skills/pc-author/references/modify-config.md
index 83a0ae6..bfd268f 100644
--- a/plugins/git/skills/pc-author/references/modify-config.md
+++ b/plugins/git/skills/pc-author/references/modify-config.md
@@ -17,7 +17,7 @@ Read the existing `.pre-commit-config.yaml` before editing. Note any stale `rev`
 1. Run a shallow extension scan, so the addition is judged against the languages actually present:
 
    ```bash
-   git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
+   rtk git ls-files | grep -oE '\.[a-z]+$' | sort | uniq -c | sort -rn
    ```
 
 2. Read `references/hooks-by-language.md` for the correct repo URL, `rev` and recommended args
diff --git a/plugins/git/skills/pc-run/SKILL.md b/plugins/git/skills/pc-run/SKILL.md
index 82ebc7a..2e58fa5 100644
--- a/plugins/git/skills/pc-run/SKILL.md
+++ b/plugins/git/skills/pc-run/SKILL.md
@@ -8,6 +8,7 @@ description: >
 compatibility: Requires pre-commit installed and available on PATH.
 
 metadata:
+  version: "1.0.1"
   category: devtools
   source_keys:
     - context7-pre-commit-com
@@ -18,9 +19,9 @@ allowed-tools: Bash Read
 
 ## Gotchas
 
-- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
+- The `SKIP` env var takes exact hook `id` values, comma-separated with no spaces: `SKIP=check-yaml,gitleaks rtk git commit -m "msg"`. A space after a comma silently skips nothing instead of erroring.
 - Never bypass a failing hook with `git commit --no-verify` (or `-n`). Hooks are the automated QA gate, so a bypassed commit pushes the failure downstream where it costs more — diagnose it instead.
-- `- files were modified by this hook` is not a bug. A fixer hook rewrote a staged file, so the staged snapshot is stale and the commit is blocked on purpose. Re-stage and re-run the same commit: `git add -u && git commit`. Do NOT reach for `pre-commit install -f` here — it overwrites `.git/hooks/` and has nothing to do with re-staging.
+- `- files were modified by this hook` is not a bug. A fixer hook rewrote a staged file, so the staged snapshot is stale and the commit is blocked on purpose. Re-stage and re-run the same commit: `rtk git add -u && rtk git commit`. Do NOT reach for `pre-commit install -f` here — it overwrites `.git/hooks/` and has nothing to do with re-staging.
 
 ## Gate — `pre-commit clean`
 
diff --git a/plugins/git/skills/pc-run/references/failure-patterns.md b/plugins/git/skills/pc-run/references/failure-patterns.md
index 8931ebf..5369f84 100644
--- a/plugins/git/skills/pc-run/references/failure-patterns.md
+++ b/plugins/git/skills/pc-run/references/failure-patterns.md
@@ -14,8 +14,8 @@ Cause: A fixer hook (e.g. `trailing-whitespace`, `end-of-file-fixer`, `pretty-fo
 
 Fix: Re-stage and recommit.
 ```bash
-git add -u
-git commit -m "same message"
+rtk git add -u
+rtk git commit -m "same message"
 ```
 
 Do NOT reach for `pre-commit install -f` here. That flag overwrites existing hook files in `.git/hooks/`; it has nothing to do with re-staging.
diff --git a/plugins/gitea/.apm/agents/gitea-orchestrate.agent.md b/plugins/gitea/.apm/agents/gitea-orchestrate.agent.md
index 50e3493..92223ef 100644
--- a/plugins/gitea/.apm/agents/gitea-orchestrate.agent.md
+++ b/plugins/gitea/.apm/agents/gitea-orchestrate.agent.md
@@ -14,7 +14,7 @@ disallowedTools: Edit, Write, NotebookEdit
 
 You are the orchestrator for the gitea plugin — a composable workflow dispatcher designed for other agents to invoke multi-step Gitea operations reliably. Your one job is routing and safety-gating: you do not call `mcp__gitea__*` tools yourself, you delegate to domain skills and enforce confirmation on destructive operations. You never edit files. Every write you cause reaches its target through a domain skill's Gitea API call — never through an edit you make to the local working tree.
 
-You resolve `owner`/`repo` once per session (via `git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
+You resolve `owner`/`repo` once per session (via `rtk git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
 
 **Scope:** this orchestrator routes Gitea-object operations across the six domain skills only: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`. `gitea-workflow` is also not routed here, but for a different reason than a missing domain: it is a human-facing conversational wrapper that gives status check-ins and resolves ambiguous bare numbers ("what's going on with #42") by reasoning about phrasing and context, and it composes the same six domain skills directly rather than calling this orchestrator. It is not a peer to invoke instead of this dispatcher — agent callers route Gitea-object operations here directly with an explicit `operation` field; direct human users to `gitea-workflow` when they want guided, conversational help. Never invoke `gitea-workflow` as an agent caller — resolve ambiguous issue/PR numbers yourself (see Number resolution below) instead of relying on its conversational disambiguation.
 
@@ -30,7 +30,7 @@ These are non-negotiable regardless of `confirm` or any skill-local override:
 - Issues and PRs share one number space. Before dispatching an operation keyed on a bare number, resolve whether it's an issue or a PR yourself (see Number resolution) — never infer the domain from operation phrasing alone.
 - `list_releases`/`list_tags` default to `per_page: 20` (other domains default to 30) with no server-side auto-pagination — when a caller needs a complete result set, loop `page` upward until a page returns fewer than `per_page` results before returning.
 - Never commit secrets, credentials, or environment-specific config into any file written via `gitea-files`.
-- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `git remote -v`) to resolve context.
+- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `rtk git remote -v`) to resolve context.
 
 ### Number resolution
 
@@ -68,7 +68,7 @@ When invoked, you:
 1. Validate the request structure and check if `operation` is known
 2. Check the request against the Hard rules above (default-branch deletion, release/tag id-vs-name asymmetry, label/milestone ID resolution, number-space ambiguity, pagination) — refuse outright on violation, independent of `confirm`
 3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
-4. Resolve `owner`/`repo` via `git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
+4. Resolve `owner`/`repo` via `rtk git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
 5. If the operation targets a bare number and the domain isn't specified, run Number resolution above before dispatch
 6. Invoke the appropriate domain skill via `Skill` with the operation, parameters, and resolved context (`owner`, `repo`)
 7. Catch and handle Gitea errors: disambiguate 404s (not-found vs. permission-hidden), retry transient failures, loop pagination for `list_releases`/`list_tags` until exhausted
diff --git a/plugins/gitea/.apm/skills/gitea-branches/SKILL.md b/plugins/gitea/.apm/skills/gitea-branches/SKILL.md
index a0a3a0d..47c113a 100644
--- a/plugins/gitea/.apm/skills/gitea-branches/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-branches/SKILL.md
@@ -12,7 +12,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo
 
 metadata:
   category: integration
-  version: "0.1.2"
+  version: "0.1.3"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__list_branches mcp__gitea__create_branch mcp__git
 Before any tool call, extract `owner` and `repo` from the git remote:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 `get_me` and `list_my_repos` are blocked under the token scope this skill assumes, so the remote is the only source. If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/.apm/skills/gitea-branches/references/branches.md b/plugins/gitea/.apm/skills/gitea-branches/references/branches.md
index d15cb8a..d4643a3 100644
--- a/plugins/gitea/.apm/skills/gitea-branches/references/branches.md
+++ b/plugins/gitea/.apm/skills/gitea-branches/references/branches.md
@@ -48,7 +48,7 @@ create_branch owner: <owner> repo: <repo> branch: <new-name> old_branch: <source
 
 Default dispatch: if the user gives a base ("branch off of X", "from X"), pass it as `old_branch`.
 If they don't specify a base and you're mid-task on a local branch, pass your current branch
-(`git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
+(`rtk git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
 working, rather than silently falling back to the repo default. If neither applies (e.g. a fresh
 top-level request with no working branch context), omit `old_branch` and let it default server-side.
 
diff --git a/plugins/gitea/.apm/skills/gitea-files/SKILL.md b/plugins/gitea/.apm/skills/gitea-files/SKILL.md
index 168e875..26265da 100644
--- a/plugins/gitea/.apm/skills/gitea-files/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-files/SKILL.md
@@ -11,6 +11,7 @@ compatibility: Requires the Gitea MCP server configured with a token scoped to a
   is not actually required for any of this domain's five tools.
 
 metadata:
+  version: "1.0.0"
   category: gitea
   source_keys:
     - gitea-mcp-repo
diff --git a/plugins/gitea/.apm/skills/gitea-issues/SKILL.md b/plugins/gitea/.apm/skills/gitea-issues/SKILL.md
index a210459..ab785f8 100644
--- a/plugins/gitea/.apm/skills/gitea-issues/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-issues/SKILL.md
@@ -14,7 +14,7 @@ compatibility: Requires Gitea MCP server configured with write:issue and write:r
 
 metadata:
   category: integration
-  version: "0.1.3"
+  version: "0.1.4"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
@@ -36,7 +36,7 @@ allowed-tools: Bash mcp__gitea__list_issues mcp__gitea__issue_read mcp__gitea__i
 An orchestrating caller may pass `owner` and `repo` in already, and the `search` row is cross-repository and needs only a query — both skip this step. Otherwise, before any tool call:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is unset or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/.apm/skills/gitea-labels-milestones/SKILL.md b/plugins/gitea/.apm/skills/gitea-labels-milestones/SKILL.md
index e0605ab..6619a29 100644
--- a/plugins/gitea/.apm/skills/gitea-labels-milestones/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-labels-milestones/SKILL.md
@@ -16,7 +16,7 @@ metadata:
     - gitea-mcp-slim-go
     - context7-websites-gitea
     - context7-gitea-tea-cli
-  version: "0.1.4"
+  version: "0.1.5"
 
 allowed-tools: Bash mcp__gitea__label_read mcp__gitea__label_write mcp__gitea__milestone_read mcp__gitea__milestone_write
 ---
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__label_read mcp__gitea__label_write mcp__gitea__m
 Before any tool call, extract `owner` and `repo` from the git remote (skip this if an orchestrating caller already passed them in):
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/.apm/skills/gitea-prs/SKILL.md b/plugins/gitea/.apm/skills/gitea-prs/SKILL.md
index 1be7d5b..37ab15d 100644
--- a/plugins/gitea/.apm/skills/gitea-prs/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-prs/SKILL.md
@@ -19,7 +19,7 @@ metadata:
     - gitea-mcp-slim-go
     - context7-websites-gitea
     - context7-gitea-tea-cli
-  version: "0.1.2"
+  version: "0.1.3"
 
 allowed-tools: Bash mcp__gitea__list_pull_requests mcp__gitea__pull_request_read mcp__gitea__pull_request_write mcp__gitea__pull_request_review_write
 ---
@@ -34,7 +34,7 @@ allowed-tools: Bash mcp__gitea__list_pull_requests mcp__gitea__pull_request_read
 Extract them from the git remote before any tool call, skipping this when an orchestrating caller already passed them in:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/.apm/skills/gitea-releases/SKILL.md b/plugins/gitea/.apm/skills/gitea-releases/SKILL.md
index 88a455b..f55cd7d 100644
--- a/plugins/gitea/.apm/skills/gitea-releases/SKILL.md
+++ b/plugins/gitea/.apm/skills/gitea-releases/SKILL.md
@@ -14,7 +14,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo
 
 metadata:
   category: integration
-  version: "0.1.0"
+  version: "0.1.1"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
@@ -36,7 +36,7 @@ allowed-tools: Bash mcp__gitea__list_releases mcp__gitea__get_release mcp__gitea
 `owner` and `repo` are required on every tool below. Extract them from the git remote, unless an orchestrating caller passed them in already:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/.claude-plugin/plugin.json b/plugins/gitea/.claude-plugin/plugin.json
index 10dd4fd..bd4575d 100644
--- a/plugins/gitea/.claude-plugin/plugin.json
+++ b/plugins/gitea/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "gitea",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "description": "Skills and agents for working with a Gitea forge through its HTTP API \u2014 the forge's own objects, as distinct from the local git clone.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/gitea/.github/plugin/plugin.json b/plugins/gitea/.github/plugin/plugin.json
index 10dd4fd..bd4575d 100644
--- a/plugins/gitea/.github/plugin/plugin.json
+++ b/plugins/gitea/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "gitea",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "description": "Skills and agents for working with a Gitea forge through its HTTP API \u2014 the forge's own objects, as distinct from the local git clone.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/gitea/agents/gitea-orchestrate.agent.md b/plugins/gitea/agents/gitea-orchestrate.agent.md
index 50e3493..92223ef 100644
--- a/plugins/gitea/agents/gitea-orchestrate.agent.md
+++ b/plugins/gitea/agents/gitea-orchestrate.agent.md
@@ -14,7 +14,7 @@ disallowedTools: Edit, Write, NotebookEdit
 
 You are the orchestrator for the gitea plugin — a composable workflow dispatcher designed for other agents to invoke multi-step Gitea operations reliably. Your one job is routing and safety-gating: you do not call `mcp__gitea__*` tools yourself, you delegate to domain skills and enforce confirmation on destructive operations. You never edit files. Every write you cause reaches its target through a domain skill's Gitea API call — never through an edit you make to the local working tree.
 
-You resolve `owner`/`repo` once per session (via `git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
+You resolve `owner`/`repo` once per session (via `rtk git remote -v` on `origin`) and carry that forward as session context to every domain skill you dispatch to, rather than making each skill re-resolve it.
 
 **Scope:** this orchestrator routes Gitea-object operations across the six domain skills only: `gitea-issues`, `gitea-labels-milestones`, `gitea-prs`, `gitea-branches`, `gitea-files`, `gitea-releases`. `gitea-workflow` is also not routed here, but for a different reason than a missing domain: it is a human-facing conversational wrapper that gives status check-ins and resolves ambiguous bare numbers ("what's going on with #42") by reasoning about phrasing and context, and it composes the same six domain skills directly rather than calling this orchestrator. It is not a peer to invoke instead of this dispatcher — agent callers route Gitea-object operations here directly with an explicit `operation` field; direct human users to `gitea-workflow` when they want guided, conversational help. Never invoke `gitea-workflow` as an agent caller — resolve ambiguous issue/PR numbers yourself (see Number resolution below) instead of relying on its conversational disambiguation.
 
@@ -30,7 +30,7 @@ These are non-negotiable regardless of `confirm` or any skill-local override:
 - Issues and PRs share one number space. Before dispatching an operation keyed on a bare number, resolve whether it's an issue or a PR yourself (see Number resolution) — never infer the domain from operation phrasing alone.
 - `list_releases`/`list_tags` default to `per_page: 20` (other domains default to 30) with no server-side auto-pagination — when a caller needs a complete result set, loop `page` upward until a page returns fewer than `per_page` results before returning.
 - Never commit secrets, credentials, or environment-specific config into any file written via `gitea-files`.
-- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `git remote -v`) to resolve context.
+- You are read-only against the local working tree. Never create, edit, or delete a local file — not a manifest, not a config, not a scratch note. Local state is the caller's, and you only read it (e.g. `rtk git remote -v`) to resolve context.
 
 ### Number resolution
 
@@ -68,7 +68,7 @@ When invoked, you:
 1. Validate the request structure and check if `operation` is known
 2. Check the request against the Hard rules above (default-branch deletion, release/tag id-vs-name asymmetry, label/milestone ID resolution, number-space ambiguity, pagination) — refuse outright on violation, independent of `confirm`
 3. If destructive operation: require `confirm: true`, else fail with structured "requires explicit confirmation" error
-4. Resolve `owner`/`repo` via `git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
+4. Resolve `owner`/`repo` via `rtk git remote -v` on `origin` if not already present in `context`, and reuse the resolution for the remainder of the request
 5. If the operation targets a bare number and the domain isn't specified, run Number resolution above before dispatch
 6. Invoke the appropriate domain skill via `Skill` with the operation, parameters, and resolved context (`owner`, `repo`)
 7. Catch and handle Gitea errors: disambiguate 404s (not-found vs. permission-hidden), retry transient failures, loop pagination for `list_releases`/`list_tags` until exhausted
diff --git a/plugins/gitea/apm.yml b/plugins/gitea/apm.yml
index 3150647..34942e8 100644
--- a/plugins/gitea/apm.yml
+++ b/plugins/gitea/apm.yml
@@ -1,5 +1,5 @@
 name: gitea
-version: 1.3.7
+version: 1.3.8
 description: Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.
 author:
   name: Defame1297
diff --git a/plugins/gitea/skills/gitea-branches/SKILL.md b/plugins/gitea/skills/gitea-branches/SKILL.md
index a0a3a0d..47c113a 100644
--- a/plugins/gitea/skills/gitea-branches/SKILL.md
+++ b/plugins/gitea/skills/gitea-branches/SKILL.md
@@ -12,7 +12,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo
 
 metadata:
   category: integration
-  version: "0.1.2"
+  version: "0.1.3"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__list_branches mcp__gitea__create_branch mcp__git
 Before any tool call, extract `owner` and `repo` from the git remote:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 `get_me` and `list_my_repos` are blocked under the token scope this skill assumes, so the remote is the only source. If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/skills/gitea-branches/references/branches.md b/plugins/gitea/skills/gitea-branches/references/branches.md
index d15cb8a..d4643a3 100644
--- a/plugins/gitea/skills/gitea-branches/references/branches.md
+++ b/plugins/gitea/skills/gitea-branches/references/branches.md
@@ -48,7 +48,7 @@ create_branch owner: <owner> repo: <repo> branch: <new-name> old_branch: <source
 
 Default dispatch: if the user gives a base ("branch off of X", "from X"), pass it as `old_branch`.
 If they don't specify a base and you're mid-task on a local branch, pass your current branch
-(`git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
+(`rtk git branch --show-current`) as `old_branch` so the new branch forks from where you're actually
 working, rather than silently falling back to the repo default. If neither applies (e.g. a fresh
 top-level request with no working branch context), omit `old_branch` and let it default server-side.
 
diff --git a/plugins/gitea/skills/gitea-files/SKILL.md b/plugins/gitea/skills/gitea-files/SKILL.md
index 168e875..26265da 100644
--- a/plugins/gitea/skills/gitea-files/SKILL.md
+++ b/plugins/gitea/skills/gitea-files/SKILL.md
@@ -11,6 +11,7 @@ compatibility: Requires the Gitea MCP server configured with a token scoped to a
   is not actually required for any of this domain's five tools.
 
 metadata:
+  version: "1.0.0"
   category: gitea
   source_keys:
     - gitea-mcp-repo
diff --git a/plugins/gitea/skills/gitea-issues/SKILL.md b/plugins/gitea/skills/gitea-issues/SKILL.md
index a210459..ab785f8 100644
--- a/plugins/gitea/skills/gitea-issues/SKILL.md
+++ b/plugins/gitea/skills/gitea-issues/SKILL.md
@@ -14,7 +14,7 @@ compatibility: Requires Gitea MCP server configured with write:issue and write:r
 
 metadata:
   category: integration
-  version: "0.1.3"
+  version: "0.1.4"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
@@ -36,7 +36,7 @@ allowed-tools: Bash mcp__gitea__list_issues mcp__gitea__issue_read mcp__gitea__i
 An orchestrating caller may pass `owner` and `repo` in already, and the `search` row is cross-repository and needs only a query — both skip this step. Otherwise, before any tool call:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is unset or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/skills/gitea-labels-milestones/SKILL.md b/plugins/gitea/skills/gitea-labels-milestones/SKILL.md
index e0605ab..6619a29 100644
--- a/plugins/gitea/skills/gitea-labels-milestones/SKILL.md
+++ b/plugins/gitea/skills/gitea-labels-milestones/SKILL.md
@@ -16,7 +16,7 @@ metadata:
     - gitea-mcp-slim-go
     - context7-websites-gitea
     - context7-gitea-tea-cli
-  version: "0.1.4"
+  version: "0.1.5"
 
 allowed-tools: Bash mcp__gitea__label_read mcp__gitea__label_write mcp__gitea__milestone_read mcp__gitea__milestone_write
 ---
@@ -32,7 +32,7 @@ allowed-tools: Bash mcp__gitea__label_read mcp__gitea__label_write mcp__gitea__m
 Before any tool call, extract `owner` and `repo` from the git remote (skip this if an orchestrating caller already passed them in):
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/skills/gitea-prs/SKILL.md b/plugins/gitea/skills/gitea-prs/SKILL.md
index 1be7d5b..37ab15d 100644
--- a/plugins/gitea/skills/gitea-prs/SKILL.md
+++ b/plugins/gitea/skills/gitea-prs/SKILL.md
@@ -19,7 +19,7 @@ metadata:
     - gitea-mcp-slim-go
     - context7-websites-gitea
     - context7-gitea-tea-cli
-  version: "0.1.2"
+  version: "0.1.3"
 
 allowed-tools: Bash mcp__gitea__list_pull_requests mcp__gitea__pull_request_read mcp__gitea__pull_request_write mcp__gitea__pull_request_review_write
 ---
@@ -34,7 +34,7 @@ allowed-tools: Bash mcp__gitea__list_pull_requests mcp__gitea__pull_request_read
 Extract them from the git remote before any tool call, skipping this when an orchestrating caller already passed them in:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/gitea/skills/gitea-releases/SKILL.md b/plugins/gitea/skills/gitea-releases/SKILL.md
index 88a455b..f55cd7d 100644
--- a/plugins/gitea/skills/gitea-releases/SKILL.md
+++ b/plugins/gitea/skills/gitea-releases/SKILL.md
@@ -14,7 +14,7 @@ compatibility: Requires Gitea MCP server configured with a token with write:repo
 
 metadata:
   category: integration
-  version: "0.1.0"
+  version: "0.1.1"
   source_keys:
     - gitea-mcp-repo
     - gitea-mcp-slim-go
@@ -36,7 +36,7 @@ allowed-tools: Bash mcp__gitea__list_releases mcp__gitea__get_release mcp__gitea
 `owner` and `repo` are required on every tool below. Extract them from the git remote, unless an orchestrating caller passed them in already:
 
 ```bash
-git remote get-url origin
+rtk git remote get-url origin
 ```
 
 If origin is not set or the URL is not a Gitea URL, stop and report: "No Gitea remote found — set origin to your Gitea instance URL."
diff --git a/plugins/kyberforge/.apm/skills/agent-audit/SKILL.md b/plugins/kyberforge/.apm/skills/agent-audit/SKILL.md
index 19abac3..67396dc 100644
--- a/plugins/kyberforge/.apm/skills/agent-audit/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/agent-audit/SKILL.md
@@ -7,6 +7,7 @@ description: >
   directory -> skill-audit.
 allowed-tools: Bash Read
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - context7-websites-code-claude
diff --git a/plugins/kyberforge/.apm/skills/agent-audit/references/description-quality.md b/plugins/kyberforge/.apm/skills/agent-audit/references/description-quality.md
index eac9c27..4083917 100644
--- a/plugins/kyberforge/.apm/skills/agent-audit/references/description-quality.md
+++ b/plugins/kyberforge/.apm/skills/agent-audit/references/description-quality.md
@@ -27,15 +27,22 @@ where the body's flowchart specified two.
 
 Read the frontmatter before judging a single word.
 
-- **`disable-model-invocation: true` or `user-invocable: false`** — the agent is hand-invoked. Its
-  description is never matched against user intent, so it is not a routing string. It carries **one
-  plain human-facing sentence** stating what the agent does. Audit it for that and nothing else.
-  Reporting a missing trigger clause, a missing boundary clause or absent indirect triggers on a
-  hand-invoked agent is a wrong finding, not a strict one. Both fields are Copilot-only and neither
-  is on the vendor-neutral APM allowlist, so this case arises in a Copilot `.agent.md` at
-  project/user scope and nowhere else. Its Claude Code counterpart has no equivalent field and stays
-  model-invoked, so the two halves of the pair carrying differently shaped descriptions is expected
-  there rather than a pair-consistency finding.
+- **`disable-model-invocation: true`** — the agent is hand-invoked. Its description is never
+  matched against user intent, so it is not a routing string. It carries **one plain human-facing
+  sentence** stating what the agent does. Audit it for that and nothing else. Reporting a missing
+  trigger clause, a missing boundary clause or absent indirect triggers on a hand-invoked agent is a
+  wrong finding, not a strict one. The field is Copilot-only and not on the vendor-neutral APM
+  allowlist, so this case arises in a Copilot `.agent.md` at project/user scope and nowhere else.
+  Its Claude Code counterpart has no equivalent field and stays model-invoked, so the two halves of
+  the pair carrying differently shaped descriptions is expected there rather than a
+  pair-consistency finding.
+  `user-invocable: false` does not belong in this bullet. The two are separate fields with opposite
+  defaults — `disable-model-invocation` (default `false`) governs runtime auto-selection,
+  `user-invocable` (default `true`) governs manual invocation, and the retired `infer` field was
+  replaced by the pair rather than by either one. So `user-invocable: false` says nothing about
+  whether the agent is model-routed: judge that from `disable-model-invocation` alone, and where
+  that is absent the three-part shape below still applies. `user-invocable` carries no
+  description-quality contract of its own and is out of this file's scope entirely.
 - **No such flag** — the agent is model-invoked and the rest of this file applies.
 
 ## The three-part shape
diff --git a/plugins/kyberforge/.apm/skills/agent-audit/references/scope-project-user.md b/plugins/kyberforge/.apm/skills/agent-audit/references/scope-project-user.md
index d91a5ad..642c128 100644
--- a/plugins/kyberforge/.apm/skills/agent-audit/references/scope-project-user.md
+++ b/plugins/kyberforge/.apm/skills/agent-audit/references/scope-project-user.md
@@ -41,8 +41,8 @@ those same sections, so any restatement is a copy that can disagree with the che
   If it carries one, it still has to be kebab-case.
 - `Use proactively` is meaningful in a CC description and steers the runtime to offer the agent
   unprompted. In a Copilot description it does nothing; `KyberforgeCopilot.ProactivePhrase` flags
-  it. The Copilot equivalent is `disable-model-invocation` / `user-invocable`, which changes the
-  description contract entirely — see `references/description-quality.md`, Step 0.
+  it. The Copilot equivalent is `disable-model-invocation`, which changes the description contract
+  entirely — see `references/description-quality.md`, Step 0.
 
 ## Pair consistency
 
diff --git a/plugins/kyberforge/.apm/skills/agent-author/SKILL.md b/plugins/kyberforge/.apm/skills/agent-author/SKILL.md
index c6ca310..c399ffa 100644
--- a/plugins/kyberforge/.apm/skills/agent-author/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/agent-author/SKILL.md
@@ -6,6 +6,7 @@ description: >
   Not read-only review -> `agent-audit`. Not skills -> `skill-author`.
 allowed-tools: Bash Read Write Edit
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - context7-websites-code-claude
@@ -30,7 +31,7 @@ metadata:
 
 Signals: grill output, `agent-audit` findings, inline feedback, session context describing what went wrong. With none, ask: "No improvement signals found. Did you mean to create a new agent, or do you have feedback to apply?"
 
-Read only the reference for the resolved flow. Capture `git log --oneline -1` before touching the filesystem; Step 4 needs it.
+Read only the reference for the resolved flow. Capture `rtk git log --oneline -1` before touching the filesystem; Step 4 needs it.
 
 ## Step 2 — Scope
 
@@ -61,4 +62,4 @@ Invoke `agent-audit` on each file written and resolve every FAIL before reportin
 
 At plugin/APM scope bump the resolved package's `apm.yml` `version` — **minor** on create, **patch** on improve — because consumers compare it to detect updates. Project and user scope have no manifest.
 
-**Commit verification.** Once the audit is clean, run `git add` and `git commit` — do not stop at staging. Re-run `git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is lost if the tree is cleaned up. Report done only once the hash has changed.
+**Commit verification.** Once the audit is clean, run `rtk git add` and `rtk git commit` — do not stop at staging. Re-run `rtk git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is lost if the tree is cleaned up. Report done only once the hash has changed.
diff --git a/plugins/kyberforge/.apm/skills/apm-install/SKILL.md b/plugins/kyberforge/.apm/skills/apm-install/SKILL.md
index 054d161..d576504 100644
--- a/plugins/kyberforge/.apm/skills/apm-install/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/apm-install/SKILL.md
@@ -6,6 +6,7 @@ description: >
   authoring, publishing, auditing, or dependency installation for an apm
   package -> `apm-workflow`.
 metadata:
+  version: "1.0.0"
   category: apm
   source_keys:
     - context7-microsoft-apm
diff --git a/plugins/kyberforge/.apm/skills/apm-workflow/SKILL.md b/plugins/kyberforge/.apm/skills/apm-workflow/SKILL.md
index cd258b4..85e2f30 100644
--- a/plugins/kyberforge/.apm/skills/apm-workflow/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/apm-workflow/SKILL.md
@@ -5,6 +5,7 @@ description: >
   the dependencies it declares, or an apm marketplace — even when the user does
   not say "apm". Not the apm binary or an agent runtime -> `apm-install`.
 metadata:
+  version: "1.0.0"
   category: apm
   source_keys:
     - context7-microsoft-apm
diff --git a/plugins/kyberforge/.apm/skills/forge/SKILL.md b/plugins/kyberforge/.apm/skills/forge/SKILL.md
index 860e9db..f63242a 100644
--- a/plugins/kyberforge/.apm/skills/forge/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/forge/SKILL.md
@@ -8,6 +8,7 @@ description: >
   already named — invoke `skill-author`, `agent-author` or `apm-workflow`
   directly.
 metadata:
+  version: "1.0.0"
   category: factory
   source_keys:
     - claude-code-subagents-docs
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/README.md b/plugins/kyberforge/.apm/skills/skill-audit/README.md
index 277c836..468be43 100644
--- a/plugins/kyberforge/.apm/skills/skill-audit/README.md
+++ b/plugins/kyberforge/.apm/skills/skill-audit/README.md
@@ -11,7 +11,7 @@ Audit a skill directory against the agentskills.io specification and the house c
 
 `validate.sh` enforces two independent length families that must not be conflated: the agentskills.io spec conformance ceilings (500 lines, 2,770 words, both counting the whole file) and the ADR-0020 context budget (250/400 description characters, 600/900 body-only words).
 
-Alongside those it runs four shape checks that are not length measurements at all. Two are FAILs: every routing target named in the description — in the compressed `Not <thing> -> <name>` arrow **and** in the prose form — must resolve to a real skill or agent, and every `references/<file>.md` the body names must exist on disk. Three are SUGGESTIONs: a missing boundary clause, a Gotchas section over five entries, and a Gotchas section over 25% of the body. The resolution universe for boundary targets is derived by walking up from the audited `SKILL.md` — the authoring root above it, its own apm package, and that package's declared `apm.yml` dependencies — so a fresh clone and a machine that has run `apm install` return the same verdict. When no universe can be determined the check prints `INFO ... DID NOT RUN` and does not silently pass.
+Alongside those it runs shape checks that are not length measurements at all. Three are FAILs: every routing target named in the description — in the compressed `Not <thing> -> <name>` arrow **and** in the prose form — must resolve to a real skill or agent; every `references/<file>.md` the body names must exist on disk; and `metadata.version` must be present and three-part semver (ADR-0022). That last one is FAIL rather than SUGGESTION because the `skill-frontmatter` pre-commit hook rejects the file without it — an audit grading it lower would report ready-to-ship on a file the commit gate refuses. Three are SUGGESTIONs: a missing boundary clause, a Gotchas section over five entries, and a Gotchas section over 25% of the body. The resolution universe for boundary targets is derived by walking up from the audited `SKILL.md` — the authoring root above it, its own apm package, and that package's declared `apm.yml` dependencies — so a fresh clone and a machine that has run `apm install` return the same verdict. When no universe can be determined the check prints `INFO ... DID NOT RUN` and does not silently pass.
 
 ## Usage
 
@@ -26,8 +26,8 @@ Provide the path to the skill directory to audit when invoking.
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Skill instructions for agents |
-| `scripts/validate.sh` | Structural validator — checks name format, name matches directory, description presence and length, body-only word count, line and whole-file word ceilings, boundary-clause presence, boundary-target resolution, `references/` pointer existence, Gotchas entry count and body share, placeholder detection, script executable bit, and interactive-prompt detection |
-| `scripts/validate-provenance.sh` | Provenance validator — checks sources.md completeness, source_keys/slug consistency, Contributing files existence, bidirectional linkage, Research doc: fields, and upstream research doc alignment |
+| `scripts/validate.sh` | Structural validator — checks name format, name matches directory, description presence and length, `metadata.version` presence and semver shape (ADR-0022), body-only word count, line and whole-file word ceilings, boundary-clause presence, boundary-target resolution, `references/` pointer existence, Gotchas entry count and body share, placeholder detection, script executable bit, and interactive-prompt detection |
+| `scripts/validate-provenance.sh` | Provenance validator — checks sources.md completeness, source_keys/slug consistency, Contributing files existence, bidirectional linkage, Research doc: fields, upstream research doc alignment, and (check 9, INFO only) whether a slug's `Description` or `Contributing files` text has changed since a base ref — `--base-ref=<ref>` or `VALIDATE_PROVENANCE_BASE_REF`, defaulting to the merge base with `origin/main` |
 | `scripts/vale-wrap.sh` | Vale prefilter wrapper — runs the bundled `Kyberforge` Vale styles against SKILL.md and reports alerts as deterministic FAILs ahead of Step 3's qualitative review |
 | `assets/vale/.vale.ini` | Vale configuration — points Vale at the bundled `Kyberforge` style path, self-located relative to `vale-wrap.sh` |
 | `assets/vale/styles/Kyberforge/CompositionNote.yml` | Vale rule — flags composition and architecture notes in a description (e.g. "cross-cutting", "entry point", "rather than duplicating") |
@@ -41,7 +41,7 @@ Provide the path to the skill directory to audit when invoking.
 | `references/patterns.md` | Rubric for the patterns dimension — which instruction construct fits which job, and how each is correctly formed |
 | `references/file-structure.md` | Rubric for the file-structure and internal-consistency dimensions — permitted directories, cross-plugin path rules and their two structural exemptions, README drift |
 | `references/formatting-and-scripts.md` | Rubric for the formatting and scripts dimensions — heading and fencing conventions, and the agentic-use criteria for bundled scripts |
-| `references/validation-scripts.md` | Step 1 troubleshooting — the manual structural fallback when `validate.sh` cannot run, and the script exit codes that are easy to misread (loaded only on a script failure) |
+| `references/validation-scripts.md` | Step 1 troubleshooting — the manual structural fallback when `validate.sh` cannot run, and the script exit codes that are easy to misread (loaded on a script failure, and on any exit-0 run that printed something — `validate-provenance.sh`'s check 9 is INFO-only, so its findings arrive that way) |
 | `references/sources.md` | Provenance record — agentskills.io sources that informed this skill and which files each contributed to |
 | `tests/validate.bats` | (source-only) Bats test suite for validate.sh |
 | `tests/validate-provenance.bats` | (source-only) Bats test suite for validate-provenance.sh |
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/SKILL.md b/plugins/kyberforge/.apm/skills/skill-audit/SKILL.md
index 1a66612..8f093d9 100644
--- a/plugins/kyberforge/.apm/skills/skill-audit/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/skill-audit/SKILL.md
@@ -7,6 +7,7 @@ description: >
   skill-author.
 allowed-tools: Bash Read
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - agentskills-home
@@ -35,9 +36,9 @@ bash scripts/vale-wrap.sh <skill-dir>/SKILL.md
 
 `validate.sh` findings become the `### Structure` dimension — its FAILs and its SUGGESTIONs both, at the tier the script assigned. Report each once; never re-grade one under another dimension. Unresolved boundary targets are where this bites, because their tier turns on notation.
 
-If any of the three cannot run, or exits non-zero for a reason other than findings, read `references/validation-scripts.md` — it carries the manual fallback and the misleading exit codes. Ordinary content FAILs are the expected outcome here and need no fallback.
+Read `references/validation-scripts.md` when any of the three cannot run or exits non-zero for a reason other than findings, **and whenever `validate-provenance.sh` exits 0 having printed anything**. Ordinary content FAILs are the expected outcome here and need no fallback.
 
-`validate-provenance.sh` prints nothing on success, so read its exit code before you read its silence. **0** is a genuine pass. **1** means real findings: its FAILs and INFOs become a separate `### Provenance` dimension, and it emits Why and Fix itself — surface those verbatim. **2** means the check never ran — a usage or environment error, reason on stderr, no findings and often no stdout at all. On a 2, report `### Provenance` as unverified and quote the stderr reason. Never grade an exit 2 as a clean pass: empty stdout there means nothing was checked, not that nothing was wrong.
+`validate-provenance.sh` reports through exit code **and** output; neither alone is the verdict. **0, silent** is a genuine pass. **0 with output** is INFO-only findings — still a `### Provenance` dimension; `references/validation-scripts.md` says what each obliges — for a check-9 INFO, reading rather than relaying. **1** is FAILs plus any INFOs; it emits Why and Fix itself — surface those verbatim. **2** means it never ran — a usage or environment error, reason on stderr, often no stdout — so report `### Provenance` unverified and quote that reason. Never grade an exit 2, or an exit 0 that printed, as a clean pass.
 
 `vale-wrap.sh` applies the bundled `Kyberforge` style as a prefilter. Pass no `--config`; the wrapper locates its own. Every rule is graded `error`, so every alert is a FAIL. Report each one citing its rule ID, filed under the dimension it belongs to, and do not re-derive it by judgment:
 
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/references/validation-scripts.md b/plugins/kyberforge/.apm/skills/skill-audit/references/validation-scripts.md
index a1ddb24..24b138f 100644
--- a/plugins/kyberforge/.apm/skills/skill-audit/references/validation-scripts.md
+++ b/plugins/kyberforge/.apm/skills/skill-audit/references/validation-scripts.md
@@ -6,8 +6,9 @@ source_keys:
 
 # Validation Scripts Reference
 
-Read this when a Step 1 script fails, cannot run, or reports something that needs interpreting.
-Nothing here is needed on a clean run.
+Read this when a Step 1 script fails, cannot run, or reports something that needs interpreting —
+including `validate-provenance.sh` exiting **0 having printed something**, which is INFO findings,
+not a clean run. Its silent exit 0 is the only outcome that needs nothing here.
 
 ## Report the gap, do not guess
 
@@ -105,6 +106,34 @@ Three ways to read the result wrong:
   is not a directory, a directory holding no `SKILL.md`, a missing or extra argument, and an absent
   `python3` all exit **2** with a message on stderr. Exit 2 means the script never ran — report it
   as an unaudited dimension, never as a pass and never as a finding. Exit 1 is findings.
+- **A check-9 INFO — `'<field>' changed for '<slug>' since <ref>` — means go read, not just relay.**
+  Check 9 diffs the current `references/sources.md` against a base ref and flags a slug whose
+  `Description` or `Contributing files` text differs. It is structurally incapable of telling you
+  whether the new wording is still *true* — it only detects that the text changed — so when this
+  INFO fires, open that slug's own entry: the document named in its `Research doc:` field, and the
+  files its `Contributing files` list names. Read whichever the changed field is a claim *about* —
+  a Description-only change often leaves the file list untouched, so "open the Contributing files"
+  is where to look, not proof that they are what moved. Confirm by reading whether the (possibly
+  strengthened) claim genuinely holds. This is the one provenance finding this script cannot verify
+  for you: every other check here is a structural fact you can relay as-is, but check 9's job is
+  only to tell you *where* to spend that reading effort, not to replace it. Acknowledging the INFO
+  without opening those files is not auditing it. Its companion — `'<field>' removed for '<slug>'
+  since <ref>` — is the same obligation in the other direction: a claim withdrawn rather than
+  rewritten. No other check here requires the field, so confirm the removal was deliberate.
+- **The check-9 base ref defaults to `git merge-base HEAD origin/main`, and there are two ways to
+  override it.** `--base-ref=<ref>` on the command line, or the `VALIDATE_PROVENANCE_BASE_REF`
+  environment variable; the flag wins when both are given, including when it is given empty
+  (`--base-ref=`), which selects the default resolution and ignores the environment. Reach for one
+  on a fork, a long-lived branch, or a mirror whose remote is not called `origin` — and when a
+  review asks what changed since a specific commit rather than since the branch point.
+- **A single check-9 INFO naming a whole-check skip is an unaudited dimension, not a finding about
+  the skill.** There are three: "no repo root above the skill directory", "no base ref could be
+  resolved", and "`<path>` is not tracked at `<ref>`". The third is the one to read carefully — it
+  fires when the base ref resolved but `git show <ref>:<path>` did not, which covers both a
+  genuinely new `sources.md` (nothing to flag) and a path git does not know under that name: a
+  renamed skill directory, or an installed, gitignored copy such as a deployed `.claude/skills/`
+  tree. Auditing the deployed copy silently checks nothing; re-run against the authoring path under
+  `plugins/*/.apm/skills/`.
 - **`vale` reports `0 files`.** Treat the pass as NOT RUN, not as clean, and fall back to full
   Step 3 judgment for the dimensions it would have covered. The bundled `Kyberforge` style is
   scoped by glob in `assets/vale/.vale.ini`; a file outside those globs is silently not linted.
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate-provenance.sh b/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate-provenance.sh
index 4ed3629..4b720b4 100755
--- a/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate-provenance.sh
+++ b/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate-provenance.sh
@@ -3,12 +3,20 @@ set -euo pipefail
 
 usage() {
   cat <<EOF
-Usage: validate-provenance.sh <skill-dir>
+Usage: validate-provenance.sh <skill-dir> [--base-ref=<ref>]
 
 Validate that a skill's sources provenance chain is complete and internally consistent.
 
 Arguments:
-  skill-dir  Path to the skill directory to validate.
+  skill-dir       Path to the skill directory to validate.
+  --base-ref=REF  Git ref to diff references/sources.md against for check 9.
+                  Defaults to \`git merge-base HEAD origin/main\`. Override this
+                  when origin/main is not the right comparison point (a fork,
+                  a long-lived branch, a mirror with a different remote name).
+                  The VALIDATE_PROVENANCE_BASE_REF environment variable is an
+                  equivalent, lower-precedence way to set it — the flag wins
+                  if both are given, including when the flag is given empty
+                  (\`--base-ref=\`), which selects the default resolution.
 
 Exit codes:
   0  All checks passed (or nothing to validate)
@@ -38,6 +46,15 @@ Checks performed:
      resolved; a path that still does not resolve is reported as an INFO saying
      checks 7 and 8 did not run, never skipped silently.
   8  Extracted non-(none) slug in research doc present in sources.md
+  9  Description or Contributing files text changed since --base-ref (INFO
+     only — a bash script cannot verify the claim is still TRUE, only that it
+     changed; the auditor reads the named files to check that). Wrapped values
+     are joined before comparison, so a re-wrap alone is not a change and a
+     rewrite of any line of one is. A slug absent at the base ref is a
+     creation, not a change, and is not flagged; a field that WAS there and is
+     now gone is announced as a removal. When the base ref cannot be resolved,
+     or references/sources.md is not tracked under this path at that ref, this
+     is announced as ONE INFO for the whole check, never a silent skip.
 
   Checks 7 and 8 apply ONLY when the Research doc value names a research SOURCE
   INDEX — a file whose basename is sources.md, whose H2 headings ARE source
@@ -52,13 +69,38 @@ if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
   exit 0
 fi
 
+# --base-ref=<ref> is the only recognised flag, for check 9's base-ref
+# override. It is pulled out before the positional-count checks below so it
+# never counts against them — a caller passing it alongside skill-dir sees
+# the same argument-count behaviour as one who does not pass it at all, and a
+# genuinely extra positional argument is still rejected.
+#
+# BASE_REF_OVERRIDE is deliberately left UNSET here rather than initialised to
+# the empty string. `--base-ref=` (given, but empty) and "no flag at all" are
+# different instructions — the first says "use the default resolution, ignoring
+# the environment", the second says "fall back to the environment" — and an
+# empty-string initialiser collapsed them: `${BASE_REF_OVERRIDE:-$ENV}` treats
+# an empty flag value as absent, so the environment variable won and the usage
+# text's "the flag wins if both are given" was false for exactly that spelling.
+declare -a POSITIONAL_ARGS=()
+for arg in "$@"; do
+  case "$arg" in
+    --base-ref=*)
+      BASE_REF_OVERRIDE="${arg#--base-ref=}"
+      ;;
+    *)
+      POSITIONAL_ARGS+=("$arg")
+      ;;
+  esac
+done
+
 # Usage and environment problems exit 2, findings exit 1. See the usage text
 # above for why the two must not share a code. This is a deliberate divergence
 # from validate.sh, which has no 2 tier: validate.sh always prints PASS lines,
 # so a usage error there is visibly not a findings report. This script prints
 # NOTHING on a clean run, so exit 1 plus empty stdout was the only signal a
 # caller got either way.
-if [[ $# -lt 1 ]]; then
+if [[ ${#POSITIONAL_ARGS[@]} -lt 1 ]]; then
   echo "Error: skill-dir is required." >&2
   echo "" >&2
   usage >&2
@@ -67,13 +109,25 @@ fi
 
 # Extra positional arguments were silently dropped, so a typo'd flag or a second
 # path looked like it had been honoured.
-if [[ $# -gt 1 ]]; then
-  echo "Error: expected exactly one argument, got $#: $*" >&2
+if [[ ${#POSITIONAL_ARGS[@]} -gt 1 ]]; then
+  echo "Error: expected exactly one argument, got ${#POSITIONAL_ARGS[@]}: ${POSITIONAL_ARGS[*]}" >&2
   echo "" >&2
   usage >&2
   exit 2
 fi
 
+SKILL_DIR_ARG="${POSITIONAL_ARGS[0]}"
+
+# The flag wins over the environment variable whenever the flag was GIVEN —
+# `+x` tests for presence, not for a non-empty value, which is the distinction
+# `:-` could not make. An empty result either way tells the Python body to fall
+# back to `git merge-base HEAD origin/main`.
+if [[ -n "${BASE_REF_OVERRIDE+x}" ]]; then
+  BASE_REF="$BASE_REF_OVERRIDE"
+else
+  BASE_REF="${VALIDATE_PROVENANCE_BASE_REF:-}"
+fi
+
 # python3 is a HARD dependency. Without this preflight a missing interpreter
 # produced 'line NN: python3: command not found' and exit 127 — an exit code no
 # caller maps to anything, from a message that names this script's line number
@@ -91,24 +145,25 @@ fi
 # references/validation-scripts.md explicitly told the auditor to read as a
 # pass. A typo'd target was therefore indistinguishable from a clean skill.
 # vale-wrap.sh hard-errors on a nonexistent path for exactly this reason.
-if [[ ! -d "$1" ]]; then
-  echo "Error: not a directory: $1" >&2
+if [[ ! -d "$SKILL_DIR_ARG" ]]; then
+  echo "Error: not a directory: $SKILL_DIR_ARG" >&2
   echo "  Why: a nonexistent target would otherwise report a silent pass." >&2
   echo "  Fix: pass the path of the skill directory to validate." >&2
   exit 2
 fi
 
-if [[ ! -f "$1/SKILL.md" ]]; then
-  echo "Error: not a skill directory (no SKILL.md): $1" >&2
+if [[ ! -f "$SKILL_DIR_ARG/SKILL.md" ]]; then
+  echo "Error: not a skill directory (no SKILL.md): $SKILL_DIR_ARG" >&2
   echo "  Why: a directory with no SKILL.md has no provenance chain to validate, and reporting that as a pass hides the wrong-target mistake." >&2
   echo "  Fix: pass the skill directory itself, not its parent or its references/ subdirectory." >&2
   exit 2
 fi
 
-python3 -u - "$1" <<'PYTHON'
+python3 -u - "$SKILL_DIR_ARG" "$BASE_REF" <<'PYTHON'
 import sys
 import os
 import re
+import subprocess
 
 # Output is UTF-8 for the same reason input is: under LC_ALL=C the streams
 # default to ASCII, and every finding this script prints contains an em dash.
@@ -125,6 +180,11 @@ skill_dir = os.path.abspath(sys.argv[1])
 sources_md_path = os.path.join(skill_dir, "references", "sources.md")
 refs_dir = os.path.join(skill_dir, "references")
 
+# Empty string (the shell side passes "" when neither --base-ref nor
+# VALIDATE_PROVENANCE_BASE_REF was given) means: resolve the default via
+# `git merge-base HEAD origin/main` at check-9 time, below.
+base_ref_override = sys.argv[2] if len(sys.argv) > 2 else ""
+
 # --- Helpers ---
 
 # The trailing character class used to be CONSUMING — `[^`\n]` — so a
@@ -444,6 +504,143 @@ def find_repo_root(start_dir):
             return None
         current = parent
 
+# --- Check 9 helpers ---------------------------------------------------
+# Check 9 needs a raw field VALUE (as text, to diff against an earlier
+# version), not the parsed structure parse_contributing_files() and
+# parse_status() return. The ONE normalization applied is whitespace
+# collapsing, which is what makes a re-wrap or a re-indent invisible; nothing
+# else is normalized away.
+#
+# In particular a REORDERED Contributing files list DOES fire this check, and
+# that is deliberate — the header here used to claim the opposite, which the
+# code never did. Order-insensitivity cannot be had for one field without
+# distorting the other: the two fields share this parser, and the only way to
+# ignore order is to split the value into items and sort them, which for a
+# prose Description means splitting on commas and would then hide a genuine
+# rewrite that merely permuted its clauses. Check 9 is always an INFO whose
+# whole job is to point a human at a place to read; a reordered list costs
+# that human one glance to dismiss, whereas a hidden rewrite is the exact
+# failure #118 exists to catch. False positive over false negative, on this
+# check, on purpose.
+
+def run_git(args, cwd):
+    """Run `git <args>` in cwd. Returns (returncode, stdout, stderr) — never
+    raises, so a missing git binary or an unexpected OSError is just another
+    non-zero result the caller folds into "could not run", not a crash."""
+    try:
+        result = subprocess.run(
+            ["git"] + args, cwd=cwd, capture_output=True, text=True,
+            encoding="utf-8", errors="replace"
+        )
+        return result.returncode, result.stdout, result.stderr
+    except OSError as exc:
+        return 1, "", str(exc)
+
+def ref_exists(ref, cwd):
+    """True when ref resolves to a commit in the repo at cwd."""
+    rc, _out, _err = run_git(["rev-parse", "--verify", "--quiet", ref + "^{commit}"], cwd)
+    return rc == 0
+
+def find_slug_block(content, slug):
+    """The raw text of a '## <slug>' entry's body, or None if no such H2."""
+    pattern = re.compile(
+        r'^## ' + re.escape(slug) + r'\s*\n(.*?)(?=^## |\Z)',
+        re.MULTILINE | re.DOTALL
+    )
+    m = pattern.search(content)
+    return m.group(1) if m else None
+
+# A field value ENDS at the next field, the next heading, or a blank line.
+# Every other non-blank line is a continuation of the value the author wrapped
+# across physical lines.
+#
+# This boundary is what the old `(.+)$` regex did not have. `.` does not cross
+# a newline, so only the FIRST physical line of a wrapped value was ever
+# compared — and a rewrite confined to a continuation line produced no finding
+# at all. That is verbatim the hedge-to-confident-claim regression #118 exists
+# to catch, invisible to the check written to catch it. The bullet branch had
+# the same defect one level down: a wrapped bullet's continuation does not
+# start with '- ', so the loop broke there and silently dropped every
+# remaining bullet.
+#
+# A continuation line that itself opens with bold text ('**note** — ...') is
+# read as a boundary and truncates the value. That is a known, narrow
+# false-negative, accepted because the alternative — no boundary at all —
+# is what produced the wide one above.
+FIELD_BOUNDARY_RE = re.compile(r'^(?:- )?\*\*|^#{1,6} ')
+
+
+def _is_field_boundary(stripped_line):
+    """True when a stripped line starts a new field, bullet-less heading or H2."""
+    return bool(FIELD_BOUNDARY_RE.match(stripped_line))
+
+
+def parse_field_raw(content, slug, field_name):
+    """Raw text of a '**<field_name>:**' field under a slug H2, wrapping joined.
+
+    Mirrors the two authored shapes parse_contributing_files() and
+    parse_status() already handle (inline value on the same line, or a
+    bare heading followed by '- ' bullets), but returns text rather than a
+    parsed structure, because check 9 diffs wording, not semantics.
+
+    Continuation lines are joined into the value they belong to before the
+    caller normalizes and compares, so a value wrapped across two lines and
+    the same value on one line are the same text — and a change made on any
+    line of a wrapped value is visible, not just one made on the first.
+
+    Returns None when the H2 itself is absent (the slug did not exist at
+    this content's revision) or the field is absent — both read as "no
+    earlier claim to compare against" to the caller, which is deliberate:
+    a field appearing for the first time is a creation, not a change.
+    """
+    block = find_slug_block(content, slug)
+    if block is None:
+        return None
+    lines = block.splitlines()
+    inline_re = re.compile(r'^\- \*\*' + re.escape(field_name) + r':\*\*[ \t]*(.*)$')
+    heading_re = re.compile(r'^\*\*' + re.escape(field_name) + r':\*\*[ \t]*$')
+
+    for idx, line in enumerate(lines):
+        im = inline_re.match(line)
+        if im:
+            parts = [im.group(1).strip()]
+            for cont in lines[idx + 1:]:
+                stripped = cont.strip()
+                if not stripped or stripped.startswith("- ") or _is_field_boundary(stripped):
+                    break
+                parts.append(stripped)
+            joined = " ".join(p for p in parts if p).strip()
+            return joined or None
+        if heading_re.match(line):
+            entries = []
+            for cont in lines[idx + 1:]:
+                stripped = cont.strip()
+                if not stripped:
+                    if entries:
+                        break
+                    continue
+                if _is_field_boundary(stripped):
+                    break
+                if stripped.startswith("- "):
+                    entries.append(stripped[2:].strip())
+                elif entries:
+                    # A wrapped bullet: fold it back into the bullet it
+                    # continues rather than ending the list here.
+                    entries[-1] = (entries[-1] + " " + stripped).strip()
+                else:
+                    break
+            return ", ".join(e for e in entries if e) or None
+    return None
+
+def normalize_field_text(value):
+    """Collapse whitespace so reformatting alone never registers as a change.
+
+    True only because parse_field_raw() joins wrapped continuation lines
+    first: collapsing whitespace inside a value that had already been
+    truncated at its first newline normalized nothing a re-wrap could change.
+    """
+    return re.sub(r'\s+', ' ', value).strip()
+
 findings = []
 has_fail = False
 
@@ -859,6 +1056,143 @@ for rd_abs, (rd_rel, known_slugs, rd_content) in research_docs_seen.items():
                 f"Add '## {rd_slug}' to references/sources.md or mark it as '(none)' in the research doc's Contributing files."
             )
 
+# --- Check 9: Description / Contributing files changed since --base-ref ---
+# A structural fact — the field's TEXT differs from an earlier revision — is
+# all git can tell us. Whether the (possibly stronger) new wording is still
+# TRUE is a semantic question no parser here can answer; that is what sent
+# the earlier literal-text approaches (flagging a named-but-missing filename)
+# to 3/3 false positives against the real corpus without even catching the
+# bug that motivated this check. So check 9 does the one thing git reliably
+# can: detect the change, and hand the auditor the slug and field to go read,
+# never a verdict on the claim itself. Always INFO, never FAIL.
+if repo_root is None:
+    emit_info(
+        "Check 9 skipped — no repo root above the skill directory",
+        "references/sources.md",
+        "No ancestor of the skill directory contains a .git entry, so there is no git history to diff "
+        "references/sources.md against. Check 9 did not run for any slug in this skill. "
+        "Run this script against a skill inside a checkout to get this check."
+    )
+else:
+    resolved_base_ref = base_ref_override.strip()
+    resolve_error = None
+    if not resolved_base_ref:
+        rc, mb_out, mb_err = run_git(["merge-base", "HEAD", "origin/main"], repo_root)
+        if rc == 0 and mb_out.strip():
+            resolved_base_ref = mb_out.strip()
+        else:
+            resolve_error = (
+                "`git merge-base HEAD origin/main` could not resolve a base ref"
+                + (f" ({mb_err.strip()})" if mb_err.strip() else "")
+                + " — there may be no origin/main remote, HEAD may be detached, or the clone may be shallow."
+            )
+    elif not ref_exists(resolved_base_ref, repo_root):
+        resolve_error = f"--base-ref value '{resolved_base_ref}' does not resolve to a commit in this repository."
+
+    if resolve_error:
+        emit_info(
+            "Check 9 skipped — no base ref could be resolved",
+            "references/sources.md",
+            resolve_error + " Check 9 did not run for any slug in this skill. "
+            "Pass --base-ref=<ref>, or set the VALIDATE_PROVENANCE_BASE_REF environment variable, "
+            "to compare against something other than origin/main."
+        )
+    else:
+        sources_md_relpath = os.path.relpath(sources_md_path, repo_root)
+        rc, old_sources_content, show_err = run_git(
+            ["show", f"{resolved_base_ref}:{sources_md_relpath}"], repo_root
+        )
+        if rc != 0:
+            # The base ref resolved fine but `git show <ref>:<path>` did not.
+            # That single return code covers two situations this check cannot
+            # tell apart, and only one of them is harmless:
+            #
+            #   the file genuinely did not exist at the base ref — the whole
+            #   sources.md is new, every entry in it is a creation, and there
+            #   is nothing check 9 could have flagged;
+            #
+            #   the path is not TRACKED under that name at the base ref — a
+            #   renamed skill directory, or a copy of the skill living
+            #   somewhere untracked or gitignored (an installed .claude/skills
+            #   tree is the everyday case).
+            #
+            # Treating both as "creation, nothing to flag" made the second one
+            # a silent, whole-skill skip: the same directory audited at its
+            # authoring path reported changed claims and at its deployed path
+            # reported nothing, with no way to tell that from a clean run.
+            # That is the exact fail-open this script's own header forbids —
+            # "never a silent skip" — so announce it once for the whole check
+            # and hand over git's own stderr, which is the only diagnostic
+            # that separates the two cases.
+            detail = show_err.strip().splitlines()
+            detail = detail[0] if detail else "git gave no reason"
+            emit_info(
+                f"Check 9 skipped — '{sources_md_relpath}' is not tracked at {resolved_base_ref}",
+                "references/sources.md",
+                f"`git show {resolved_base_ref}:{sources_md_relpath}` failed ({detail}). "
+                f"Either the file did not exist at that ref — in which case every entry is a "
+                f"creation and there was nothing to flag — or this path is not tracked under "
+                f"that name there: a renamed skill directory, or an untracked or gitignored copy "
+                f"of the skill such as a deployed .claude/skills/ tree. "
+                f"Check 9 did not run for any slug in this skill. "
+                f"Re-run against the tracked authoring path, or pass --base-ref=<ref> naming a "
+                f"commit where this path exists."
+            )
+            old_sources_content = None
+
+        if old_sources_content is not None:
+            for slug in unique_slugs:
+                changed_fields = []
+                removed_fields = []
+                for field_name in ("Description", "Contributing files"):
+                    old_value = parse_field_raw(old_sources_content, slug, field_name)
+                    new_value = parse_field_raw(sources_content, slug, field_name)
+                    if old_value is None and new_value is None:
+                        continue
+                    if old_value is None:
+                        # No earlier claim to compare against — a brand-new
+                        # entry, or a field that did not exist yet at the
+                        # base ref. That is a creation, not a change, and is
+                        # never flagged.
+                        continue
+                    if new_value is None:
+                        # The field existed at the base ref and is gone now.
+                        # This was folded into the creation skip above, which
+                        # justified only the other half: deleting a whole
+                        # '- **Description:**' line left NO finding anywhere —
+                        # no other check in this script requires the field, so
+                        # a claim could be removed as invisibly as it could be
+                        # strengthened. Announce it; the auditor decides
+                        # whether the removal was intended.
+                        removed_fields.append(field_name)
+                        continue
+                    if normalize_field_text(old_value) != normalize_field_text(new_value):
+                        changed_fields.append(field_name)
+                if removed_fields:
+                    removed_list = " and ".join(removed_fields)
+                    emit_info(
+                        f"'{removed_list}' removed for '{slug}' since {resolved_base_ref}",
+                        f"references/sources.md (## {slug})",
+                        f"The '## {slug}' entry had {removed_list} at {resolved_base_ref} and has "
+                        f"none now. Nothing else in this script requires the field, so the removal "
+                        f"is otherwise invisible. Confirm it was deliberate — a provenance claim "
+                        f"withdrawn is as much a change to the chain as one rewritten — and "
+                        f"restore the field if it was lost to an edit."
+                    )
+                if changed_fields:
+                    field_list = " and ".join(changed_fields)
+                    emit_info(
+                        f"'{field_list}' changed for '{slug}' since {resolved_base_ref}",
+                        f"references/sources.md (## {slug})",
+                        f"The '## {slug}' entry's {field_list} text differs from the version at "
+                        f"{resolved_base_ref}. This script can confirm the entry is internally "
+                        f"consistent, but it cannot verify whether the claim itself is still true — a "
+                        f"retrofit once turned an honest hedge into an unsupported confident claim and "
+                        f"every structural check here passed it silently. Re-read the upstream research "
+                        f"doc named in this entry's Research doc field and the Contributing files it "
+                        f"lists, and confirm by hand that the wording still holds."
+                    )
+
 print_findings()
 sys.exit(1 if has_fail else 0)
 PYTHON
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate.sh b/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate.sh
index e5ce8f3..d6f9b98 100755
--- a/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate.sh
+++ b/plugins/kyberforge/.apm/skills/skill-audit/scripts/validate.sh
@@ -1289,6 +1289,50 @@ else:
     if desc:
         ok("description has no unfilled placeholders")
 
+# --- ADR-0022: metadata.version is mandatory -------------------------------
+# FAIL, not SUGGESTION, and the tier is set by the gate rather than by taste.
+# `.pre-commit-config.yaml`'s `skill-frontmatter` hook REJECTS a SKILL.md with
+# no `metadata.version`, and rejects a value that is not three-part semver.
+# skill-author's Step 4 says to run this audit and "resolve every FAIL", so any
+# tier below FAIL lets that step report done on a skill the commit gate then
+# refuses — the same audit-disagrees-with-the-gate failure the MAX_LINES note
+# below warns about, arrived at from the other direction. Verified before this
+# check existed: a SKILL.md with no `metadata:` block at all reported "All
+# checks passed".
+#
+# The rule is DUPLICATED from that hook for the same cache-isolation reason as
+# every other constant here — an installed plugin's scripts cannot read the
+# repo-root config. Keep the two in step: this check must accept exactly what
+# the hook accepts.
+SEMVER_RE = re.compile(r'^\d+\.\d+\.\d+$')
+
+try:
+    fm_data = yaml.safe_load(fm)
+except Exception:
+    # Unreachable in practice: description_value() above parses the same text
+    # and hard-exits on a YAML error, so anything arriving here already parsed.
+    fm_data = None
+metadata_block = fm_data.get('metadata') if isinstance(fm_data, dict) else None
+
+if not isinstance(metadata_block, dict) or metadata_block.get('version') is None:
+    fail("frontmatter has no metadata.version — ADR-0022 makes it mandatory for "
+         "every skill, and the skill-frontmatter pre-commit hook rejects the file "
+         "without it. Add `metadata:` / `  version: \"1.0.0\"` (new skills start "
+         "at \"0.1.0\")")
+else:
+    version_value = metadata_block['version']
+    # NOT str()-coerced blind: `version: 1.0` is a YAML float, and its "1.0"
+    # spelling is exactly the two-part value the hook rejects — coercing and
+    # then matching keeps this check and the hook agreeing on that case.
+    version_text = version_value if isinstance(version_value, str) else str(version_value)
+    version_text = version_text.strip()
+    if SEMVER_RE.match(version_text):
+        ok(f"metadata.version present: '{version_text}' (ADR-0022)")
+    else:
+        fail(f"metadata.version '{version_text}' is not three-part semver — the "
+             f"skill-frontmatter pre-commit hook rejects it. Use MAJOR.MINOR.PATCH, "
+             f"e.g. \"1.0.0\"")
+
 # SKILL.md size ceilings (agentskills.io skill-authoring.md: 500 lines,
 # ~5,000 tokens). Both constants are DUPLICATED from the repo-root pre-commit
 # hook scripts/skill-size-check.sh — a plugin skill's scripts cannot read files
@@ -1515,11 +1559,66 @@ def stdin_redirected(line, prev_line):
     unquoted = re.sub(r'"[^"]*"|\'[^\']*\'', '', line)
     return '<' in unquoted or prev_line.rstrip().endswith('|')
 
+# A here-doc body is DATA, not command position. Every script in this corpus
+# carries a `usage() { cat <<EOF ... EOF; }`, and prose wrapped inside one puts
+# ordinary English at the start of a line — "read is reported as an INFO ..."
+# in this skill's own validate-provenance.sh, which made skill-audit hard-FAIL
+# on its own script. Reflowing that one sentence would have cleared the finding
+# and left the cause: every future usage text is one wrap away from the same
+# false positive, and the remedy an author reaches for is contorting working
+# source, which the note above records has already happened twice.
+#
+# Detection is deliberately conservative in the direction that matters. A
+# here-doc body is skipped only when its terminator is actually found further
+# down the file; an opener with no terminator — the shape a stray `<<` inside a
+# string would produce — is ignored rather than allowed to swallow the tail,
+# because swallowing the tail is a false NEGATIVE and this check exists to fail
+# closed. `<<<` here-strings open nothing and are excluded by the lookbehind.
+HEREDOC_START_RE = re.compile(r'(?<!<)<<-?\s*(["\']?)([A-Za-z_][A-Za-z0-9_]*)\1')
+
+
+def heredoc_delimiter(line):
+    """The here-doc terminator this line opens, or None."""
+    m = HEREDOC_START_RE.search(line)
+    return m.group(2) if m else None
+
+
+def heredoc_body_indices(lines):
+    """Line indices that are here-doc BODY (plus its terminator), not code."""
+    skip = set()
+    i, n = 0, len(lines)
+    while i < n:
+        stripped = lines[i].strip()
+        delim = None if stripped.startswith('#') else heredoc_delimiter(lines[i])
+        if delim:
+            # `<<-` allows an indented terminator, so compare stripped.
+            for j in range(i + 1, n):
+                if lines[j].strip() == delim:
+                    skip.update(range(i + 1, j + 1))
+                    i = j
+                    break
+        i += 1
+    return skip
+
+
+# The here-doc exemption applies to the `read` heuristic ONLY, and the
+# asymmetry is the point. `read` is an ordinary English verb, so any prose a
+# script prints is one line-wrap away from opening with it. `input(` is not a
+# word — a line beginning `input(` inside a here-doc is an embedded Python
+# program pausing for a keypress, which is exactly what this check is for, and
+# these scripts embed Python in a here-doc as a matter of course. Exempting the
+# whole body would have disarmed the check across every script in the corpus.
 def interactive_reads(source):
     hits = []
     prev_line = ''
-    for line in source.splitlines():
+    lines = source.splitlines()
+    in_heredoc = heredoc_body_indices(lines)
+    for idx, line in enumerate(lines):
         stripped = line.strip()
+        if idx in in_heredoc:
+            if re.match(r'input\(', stripped):
+                hits.append(stripped)
+            continue
         if re.match(r'read(\s|$)', stripped):
             if not stdin_redirected(line, prev_line):
                 hits.append(stripped)
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/tests/validate-provenance.bats b/plugins/kyberforge/.apm/skills/skill-audit/tests/validate-provenance.bats
index c5f7d95..3eae819 100644
--- a/plugins/kyberforge/.apm/skills/skill-audit/tests/validate-provenance.bats
+++ b/plugins/kyberforge/.apm/skills/skill-audit/tests/validate-provenance.bats
@@ -67,17 +67,55 @@ EOF
 EOF
     }
 
-    # Helper: create a fake repo (a .git marker makes find_repo_root stop there)
-    # holding one skill whose single sources.md slug points at the given
-    # Research doc value. Checks 7 and 8 only run for a skill inside a checkout,
-    # so every upstream case needs this shape; the research doc itself is
-    # written per test into "$repo/docs/research/sources.md".
+    # Helper: a sources.md whose Description is wrapped across two physical
+    # lines — the shape check 9's parser used to truncate at the first newline.
+    make_wrapped_sources_md() {
+        local dir="$1"
+        mkdir -p "$dir/references"
+        cat > "$dir/references/sources.md" <<'EOF'
+# Sources
+
+## my-source
+
+- **URL:** https://example.com/my-source
+- **Description:** A test source, informing the dispatch table's shape with
+  no forge-specific content drawn directly from it beyond that.
+- **Contributing files:** SKILL.md
+- **Research doc:** (none)
+- **Status:** `extracted`
+EOF
+    }
+
+    # Helper: turn dir into a real git repo with one commit of its current
+    # contents, and a refs/remotes/origin/main pointing at that same commit.
+    # Check 9 diffs the skill's references/sources.md against `git merge-base
+    # HEAD origin/main` by default; this makes that resolve to a commit whose
+    # sources.md is byte-identical to the working tree, so check 9 has
+    # nothing to report there — exactly what a real repo looks like the
+    # instant after a clean commit. Fixtures that go on to test something
+    # else entirely (checks 3, 4, 5, 7, 8...) call this once, at the point
+    # their skill's own sources.md is in its final state, so a completely
+    # clean run stays completely clean.
+    commit_as_base() {
+        local dir="$1"
+        git -C "$dir" init -q >/dev/null 2>&1
+        git -C "$dir" -c user.email=test@example.com -c user.name=test add -A >/dev/null 2>&1
+        git -C "$dir" -c user.email=test@example.com -c user.name=test commit -q -m base >/dev/null 2>&1
+        git -C "$dir" update-ref refs/remotes/origin/main HEAD >/dev/null 2>&1
+    }
+
+    # Helper: create a fake repo (a real git repo, one commit, makes
+    # find_repo_root stop there) holding one skill whose single sources.md
+    # slug points at the given Research doc value. Checks 7 and 8 only run
+    # for a skill inside a checkout, so every upstream case needs this shape;
+    # the research doc itself is written per test into
+    # "$repo/docs/research/sources.md" — which check 9 does not examine, so
+    # a test overwriting it after this helper runs does not disturb check 9.
     make_upstream_skill() {
         local repo="$1"
         local research="${2:-docs/research/sources.md}"
         local skill="$repo/my-skill"
         mkdir -p "$skill/references" "$repo/docs/research"
-        touch "$repo/.git"
         cat > "$skill/SKILL.md" <<EOF
 ---
 name: my-skill
@@ -102,6 +140,7 @@ EOF
 - **Research doc:** ${research}
 - **Status:** \`extracted\`
 EOF
+        commit_as_base "$repo"
     }
 }
 
@@ -790,6 +829,7 @@ source_keys: []
 
 House-authored, no external source.
 EOF
+    commit_as_base "$skill"
     run bash "$SCRIPT" "$skill"
     assert_success
     assert_output ""
@@ -809,6 +849,7 @@ metadata:
 
 House-authored, no external source.
 EOF
+    commit_as_base "$skill"
     run bash "$SCRIPT" "$skill"
     assert_success
     assert_output ""
@@ -1046,6 +1087,7 @@ EOF
     local skill="$TMPDIR/my-skill"
     make_skill_with_source_keys "$skill"
     make_sources_md "$skill" "my-source" "(none — not used directly)"
+    commit_as_base "$skill"
     run bash "$SCRIPT" "$skill"
     assert_success
     assert_output ""
@@ -1494,3 +1536,367 @@ EOF
     assert_failure
     assert_output --partial "not valid UTF-8"
 }
+
+# ---------------------------------------------------------------------------
+# Cycle 28 — Check 9: a changed Description or Contributing files claim is an
+# INFO, never a FAIL — the script can tell the text changed, not whether the
+# (possibly stronger) new wording is still true.
+# ---------------------------------------------------------------------------
+
+@test "check 9: Description text changed since base ref fires an INFO naming the slug and field" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+
+    # Rewritten in the working tree only, never committed — exactly the
+    # shape of the bug check 9 exists to flag: a hedge upgraded to a
+    # confident claim with nothing else in the entry touched.
+    sed -i 's/^- \*\*Description:\*\* A test source\.$/- **Description:** A test source that Grounds the dispatch table directly./' \
+        "$skill/references/sources.md"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "INFO"
+    assert_output --partial "'Description' changed for 'my-source'"
+}
+
+@test "check 9: Contributing files text changed since base ref fires an INFO naming the slug and field" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+
+    # Only an annotation is added. strip_note() in parse_contributing_files()
+    # removes it before checks 4 and 5 compare paths, so those stay clean —
+    # check 9 compares the raw field text, not the parsed path list, and
+    # this is still a real wording change worth a human re-reading it.
+    sed -i 's/^- \*\*Contributing files:\*\* SKILL\.md$/- **Contributing files:** SKILL.md (the dispatch table)/' \
+        "$skill/references/sources.md"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "INFO"
+    assert_output --partial "'Contributing files' changed for 'my-source'"
+    refute_output --partial "does not exist"
+    refute_output --partial "does not list"
+}
+
+@test "check 9: an entry unchanged since base ref produces no check-9 finding" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output ""
+}
+
+@test "check 9: a brand-new entry absent at the base ref is a creation, not a change" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+
+    # Added in the working tree only, after the commit above. It has no
+    # earlier revision to diff against, so check 9 must stay silent about
+    # it — a brand-new entry is a creation, not a rewrite of an existing
+    # claim, and flagging it would be exactly the false-positive shape the
+    # rejected literal-text approaches produced.
+    cat >> "$skill/references/sources.md" <<EOF
+
+## new-source
+
+- **URL:** https://example.com/new-source
+- **Description:** A brand-new source, never committed.
+- **Contributing files:** (none)
+- **Research doc:** (none)
+- **Status:** \`extracted\`
+EOF
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output ""
+}
+
+@test "check 9: no repo root emits the one graceful INFO, not a silent skip or a crash" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    # Deliberately no commit_as_base — $TMPDIR has no ancestor .git, so
+    # find_repo_root() returns None.
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "INFO"
+    assert_output --partial "Check 9 skipped — no repo root above the skill directory"
+}
+
+@test "check 9: an unresolvable base ref emits the one graceful INFO, not a silent skip or a crash" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+    # A repo with no origin/main and no override: `git merge-base HEAD
+    # origin/main` fails outright.
+    git -C "$skill" update-ref -d refs/remotes/origin/main >/dev/null 2>&1
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "INFO"
+    assert_output --partial "Check 9 skipped — no base ref could be resolved"
+}
+
+@test "check 9: --base-ref overrides a default origin/main that resolves to something else" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+    local old_sha
+    old_sha="$(git -C "$skill" rev-parse HEAD)"
+
+    # A SECOND commit carrying the rewritten claim, with origin/main moved onto
+    # it. The default base ref therefore resolves — to a commit that matches the
+    # working tree — so a silent default run proves there was a default here to
+    # override. Deleting origin/main instead, as this test used to, proved only
+    # that the flag works when nothing else does.
+    sed -i 's/^- \*\*Description:\*\* A test source\.$/- **Description:** A rewritten claim./' \
+        "$skill/references/sources.md"
+    git -C "$skill" -c user.email=test@example.com -c user.name=test commit -aqm rewrite >/dev/null 2>&1
+    git -C "$skill" update-ref refs/remotes/origin/main HEAD >/dev/null 2>&1
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output ""
+
+    run bash "$SCRIPT" "$skill" "--base-ref=$old_sha"
+    assert_success
+    assert_output --partial "'Description' changed for 'my-source'"
+}
+
+@test "check 9: VALIDATE_PROVENANCE_BASE_REF sets the base ref when no flag is given" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+    local old_sha
+    old_sha="$(git -C "$skill" rev-parse HEAD)"
+    sed -i 's/^- \*\*Description:\*\* A test source\.$/- **Description:** A rewritten claim./' \
+        "$skill/references/sources.md"
+    git -C "$skill" -c user.email=test@example.com -c user.name=test commit -aqm rewrite >/dev/null 2>&1
+    git -C "$skill" update-ref refs/remotes/origin/main HEAD >/dev/null 2>&1
+
+    run env VALIDATE_PROVENANCE_BASE_REF="$old_sha" bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "'Description' changed for 'my-source'"
+}
+
+@test "check 9: the --base-ref flag wins over the environment variable" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+    local old_sha
+    old_sha="$(git -C "$skill" rev-parse HEAD)"
+    sed -i 's/^- \*\*Description:\*\* A test source\.$/- **Description:** A rewritten claim./' \
+        "$skill/references/sources.md"
+    git -C "$skill" -c user.email=test@example.com -c user.name=test commit -aqm rewrite >/dev/null 2>&1
+    local new_sha
+    new_sha="$(git -C "$skill" rev-parse HEAD)"
+
+    # The environment names the old commit (which would fire), the flag names
+    # the new one (which would not). The usage text promises the flag wins.
+    run env VALIDATE_PROVENANCE_BASE_REF="$old_sha" bash "$SCRIPT" "$skill" "--base-ref=$new_sha"
+    assert_success
+    assert_output ""
+}
+
+@test "check 9: an EMPTY --base-ref is still 'given' and wins over the environment variable" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+    local old_sha
+    old_sha="$(git -C "$skill" rev-parse HEAD)"
+    sed -i 's/^- \*\*Description:\*\* A test source\.$/- **Description:** A rewritten claim./' \
+        "$skill/references/sources.md"
+    git -C "$skill" -c user.email=test@example.com -c user.name=test commit -aqm rewrite >/dev/null 2>&1
+    git -C "$skill" update-ref refs/remotes/origin/main HEAD >/dev/null 2>&1
+
+    # `--base-ref=` selects the DEFAULT resolution (origin/main, which now
+    # matches the working tree), so nothing fires. Under the old `:-` spelling
+    # the empty value read as absent and the environment variable won, firing
+    # the INFO and contradicting the usage text.
+    run env VALIDATE_PROVENANCE_BASE_REF="$old_sha" bash "$SCRIPT" "$skill" "--base-ref="
+    assert_success
+    assert_output ""
+}
+
+# ---------------------------------------------------------------------------
+# Cycle 29 — Check 9: a WRAPPED field value. The parser compared only the first
+# physical line, so a rewrite confined to a continuation line — the exact
+# hedge-to-confident-claim shape #118 exists to catch — produced no finding at
+# all, while a pure re-wrap produced a false one.
+# ---------------------------------------------------------------------------
+
+@test "check 9: a rewrite confined to a wrapped Description's CONTINUATION line fires an INFO" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_wrapped_sources_md "$skill"
+    commit_as_base "$skill"
+
+    # Hedge to confident claim, on the second physical line only. This is the
+    # regression check 9 was written for, and the one it could not see.
+    sed -i "s|^  no forge-specific content drawn directly from it beyond that\.\$|  it grounds Step 2's dispatch table in full.|" \
+        "$skill/references/sources.md"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "'Description' changed for 'my-source'"
+}
+
+@test "check 9: re-wrapping a Description with no wording change produces no finding" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_wrapped_sources_md "$skill"
+    commit_as_base "$skill"
+
+    # Same words, different line breaks. normalize_field_text()'s docstring
+    # promises this is invisible; it was not, because the value was truncated
+    # at its first newline before the whitespace collapse ever ran.
+    python3 - "$skill/references/sources.md" <<'PY'
+import sys
+path = sys.argv[1]
+text = open(path).read()
+old = ("- **Description:** A test source, informing the dispatch table's shape with\n"
+       "  no forge-specific content drawn directly from it beyond that.")
+new = ("- **Description:** A test source, informing the dispatch\n"
+       "  table's shape with no forge-specific content drawn\n"
+       "  directly from it beyond that.")
+assert old in text
+open(path, 'w').write(text.replace(old, new))
+PY
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output ""
+}
+
+@test "check 9: the bullet form of Contributing files is compared, not skipped" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    mkdir -p "$skill/references"
+    cat > "$skill/references/sources.md" <<'EOF'
+# Sources
+
+## my-source
+
+- **URL:** https://example.com/my-source
+- **Description:** A test source.
+
+**Contributing files:**
+- SKILL.md (the dispatch table)
+- references/other.md (the rubric)
+
+- **Research doc:** (none)
+- **Status:** `extracted`
+EOF
+    printf -- '---\nsource_keys:\n  - my-source\n---\n\nnotes\n' > "$skill/references/other.md"
+    commit_as_base "$skill"
+
+    # The change is in the SECOND bullet. The old loop joined bullets in
+    # document order too, but broke on any wrapped one — and no test covered
+    # this branch at all, both existing check-9 tests using the inline form.
+    sed -i 's|^- references/other.md (the rubric)$|- references/other.md (the whole rubric, verbatim)|' \
+        "$skill/references/sources.md"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "'Contributing files' changed for 'my-source'"
+}
+
+@test "check 9: a wrapped bullet does not silently drop the bullets after it" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    mkdir -p "$skill/references"
+    cat > "$skill/references/sources.md" <<'EOF'
+# Sources
+
+## my-source
+
+- **URL:** https://example.com/my-source
+- **Description:** A test source.
+
+**Contributing files:**
+- SKILL.md (the dispatch table, and the gates
+  common to every branch of it)
+- references/other.md (the rubric)
+
+- **Research doc:** (none)
+- **Status:** `extracted`
+EOF
+    printf -- '---\nsource_keys:\n  - my-source\n---\n\nnotes\n' > "$skill/references/other.md"
+    commit_as_base "$skill"
+
+    # The old loop broke at the wrapped continuation line, so everything from
+    # here down was never part of the compared value — a change to the last
+    # bullet was invisible.
+    sed -i 's|^- references/other.md (the rubric)$|- references/other.md (rewritten claim)|' \
+        "$skill/references/sources.md"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "'Contributing files' changed for 'my-source'"
+}
+
+@test "check 9: a field present at the base ref and deleted since is announced" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+
+    # No other check in this script requires a Description, so a deleted one
+    # used to leave no finding anywhere: a claim could be withdrawn as
+    # invisibly as it could be strengthened.
+    sed -i '/^- \*\*Description:\*\*/d' "$skill/references/sources.md"
+
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "'Description' removed for 'my-source'"
+}
+
+@test "check 9: a sources.md untracked at the base ref is announced, not silently skipped" {
+    local repo="$TMPDIR/repo"
+    local skill="$repo/tracked-skill"
+    mkdir -p "$skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$repo"
+
+    # A copy of the same skill at a path git does not know — the everyday case
+    # being an installed, gitignored .claude/skills/ tree. The base ref
+    # resolves fine; `git show <ref>:<path>` does not. Treating that as
+    # "creation, nothing to flag" made the whole check vanish without a word,
+    # so the same directory reported findings at one path and silence at the
+    # other.
+    cp -r "$skill" "$repo/untracked-copy"
+
+    run bash "$SCRIPT" "$repo/untracked-copy"
+    assert_success
+    assert_output --partial "INFO"
+    assert_output --partial "is not tracked at"
+    assert_output --partial "Check 9 did not run for any slug in this skill."
+}
+
+@test "check 9: an invalid --base-ref value is reported as unresolvable, not a crash" {
+    local skill="$TMPDIR/my-skill"
+    make_skill_with_source_keys "$skill"
+    make_sources_md "$skill"
+    commit_as_base "$skill"
+
+    run bash "$SCRIPT" "$skill" "--base-ref=not-a-real-ref"
+    assert_success
+    assert_output --partial "Check 9 skipped — no base ref could be resolved"
+    assert_output --partial "not-a-real-ref"
+}
diff --git a/plugins/kyberforge/.apm/skills/skill-audit/tests/validate.bats b/plugins/kyberforge/.apm/skills/skill-audit/tests/validate.bats
index 3740033..6a8cb97 100755
--- a/plugins/kyberforge/.apm/skills/skill-audit/tests/validate.bats
+++ b/plugins/kyberforge/.apm/skills/skill-audit/tests/validate.bats
@@ -16,6 +16,10 @@ setup() {
     # SUGGESTION-freedom would be asserting the boundary check's absence instead
     # of the thing it names. "anything else" is not hyphenated, so the clause adds
     # a boundary marker without adding a routing target to resolve.
+    #
+    # metadata.version is equally load-bearing: ADR-0022 makes it mandatory and
+    # validate.sh FAILs without it, so a fixture omitting it would not be
+    # "otherwise clean" either.
     make_valid_skill() {
         local dir="$1"
         local name
@@ -25,6 +29,8 @@ setup() {
 ---
 name: $name
 description: A valid skill description that is well within the limit. Do not use for anything else.
+metadata:
+  version: "1.0.0"
 ---
 
 ## Step 1
@@ -59,6 +65,8 @@ PY
             echo "---"
             echo "name: $name"
             echo "description: $desc"
+            echo "metadata:"
+            echo '  version: "1.0.0"'
             echo "---"
             echo ""
             python3 -c "print(' '.join(['word'] * $body_words))"
@@ -294,6 +302,141 @@ EOF
     assert_success
 }
 
+@test "prose inside a usage() here-doc that wraps onto a line starting with 'read' does not fail" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    # The exact shape that made skill-audit hard-FAIL on its own
+    # validate-provenance.sh: a usage() heredoc whose wrapped sentence puts the
+    # English verb "read" in column 0.
+    cat > "$skill/scripts/helper.sh" <<'SH'
+#!/usr/bin/env bash
+usage() {
+  cat <<EOF
+Checks performed:
+  4  A Contributing files block this parser cannot
+     read is reported as an INFO, never skipped silently.
+EOF
+}
+usage
+SH
+    chmod +x "$skill/scripts/helper.sh"
+    run bash "$SCRIPT" "$skill"
+    assert_success
+}
+
+@test "a real interactive read AFTER a here-doc is still caught" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    # Pins that the here-doc exemption ends at its terminator. A body skip that
+    # ran to end-of-file would swallow this read and report the script clean.
+    cat > "$skill/scripts/helper.sh" <<'SH'
+#!/usr/bin/env bash
+cat <<EOF
+read this text
+EOF
+read -r ANSWER
+SH
+    chmod +x "$skill/scripts/helper.sh"
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+}
+
+@test "an unterminated here-doc opener does not disarm the check for the rest of the file" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    # `<<` here is inside a string, not an opener. Treating it as one would skip
+    # every following line — a false negative, the direction this check must
+    # never fail in.
+    cat > "$skill/scripts/helper.sh" <<'SH'
+#!/usr/bin/env bash
+echo "shift left with a << b"
+read -r ANSWER
+SH
+    chmod +x "$skill/scripts/helper.sh"
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+}
+
+@test "a bare input() inside an embedded-python here-doc is still caught" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    # The here-doc exemption is for the `read` heuristic only: these scripts
+    # embed Python in a here-doc as a matter of course, so exempting the body
+    # wholesale would disarm the check across the corpus.
+    cat > "$skill/scripts/helper.sh" <<'SH'
+#!/usr/bin/env bash
+python3 - <<'PY'
+print("press enter")
+input()
+PY
+SH
+    chmod +x "$skill/scripts/helper.sh"
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+}
+
+# ---------------------------------------------------------------------------
+# ADR-0022 — metadata.version is mandatory. FAIL tier, matching the
+# skill-frontmatter pre-commit hook: an audit that graded this lower would
+# report ready-to-ship on a file the commit gate rejects.
+# ---------------------------------------------------------------------------
+
+@test "ADR-0022: a SKILL.md with no metadata block at all FAILs" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('metadata:\n  version: "1.0.0"\n', '')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+    assert_output --partial "metadata.version"
+}
+
+@test "ADR-0022: a metadata block with no version key FAILs" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  category: factory\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+    assert_output --partial "metadata.version"
+}
+
+@test "ADR-0022: a two-part metadata.version FAILs as malformed, not passes as present" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  version: 1.0\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_failure
+    assert_output --partial "three-part semver"
+}
+
+@test "ADR-0022: an unquoted three-part metadata.version passes" {
+    local skill="$TMPDIR/my-skill"
+    make_valid_skill "$skill"
+    python3 - "$skill/SKILL.md" <<'PY'
+import sys
+p = sys.argv[1]
+s = open(p).read().replace('  version: "1.0.0"\n', '  version: 0.1.3\n')
+open(p, 'w').write(s)
+PY
+    run bash "$SCRIPT" "$skill"
+    assert_success
+    assert_output --partial "metadata.version present: '0.1.3'"
+}
+
 @test "fails when name contains consecutive hyphens" {
     local skill="$TMPDIR/my--skill"
     make_valid_skill "$skill"
@@ -608,6 +751,8 @@ make_hand_invoked_skill() {
         echo "name: $name"
         echo "description: $desc"
         echo "disable-model-invocation: true"
+        echo "metadata:"
+        echo '  version: "1.0.0"'
         echo "---"
         echo ""
         python3 -c "print(' '.join(['word'] * $body_words))"
@@ -761,6 +906,8 @@ make_hand_invoked_skill() {
 ---
 name: locale-skill
 description: A valid skill description that is well within the limit.
+metadata:
+  version: "1.0.0"
 ---
 
 ## Step 1
diff --git a/plugins/kyberforge/.apm/skills/skill-author/README.md b/plugins/kyberforge/.apm/skills/skill-author/README.md
index f169f44..53e49d7 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/README.md
+++ b/plugins/kyberforge/.apm/skills/skill-author/README.md
@@ -4,7 +4,7 @@ Author and refine skills conforming to the [agentskills.io](https://agentskills.
 
 ## What it does
 
-Routes to one of two flows based on context: if no skill directory exists at the target path, it scaffolds the directory from annotated templates, fills in `SKILL.md` and supporting files, and validates the result. If an existing skill directory and improvement signals are both present, it groups those signals by root cause and applies targeted edits, then re-validates. In both flows, bumps the skill's `metadata.version` when present (minor for create, patch for improve).
+Routes to one of two flows based on context: if no skill directory exists at the target path, it scaffolds the directory from annotated templates, fills in `SKILL.md` and supporting files, and validates the result. If an existing skill directory and improvement signals are both present, it groups those signals by root cause and applies targeted edits, then re-validates. In both flows, bumps the skill's `metadata.version` — minor for create, patch for improve — which every skill carries (ADR-0022).
 
 `SKILL.md` itself carries only the dispatch table, the invocation-axis decision, the contract gates and the shared close; each flow lives in its own self-contained reference file, per ADR-0020.
 
diff --git a/plugins/kyberforge/.apm/skills/skill-author/SKILL.md b/plugins/kyberforge/.apm/skills/skill-author/SKILL.md
index 33228c5..80ecb37 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/skill-author/SKILL.md
@@ -6,6 +6,7 @@ description: >
   Not read-only review -> `skill-audit`. Not agent files -> `agent-author`.
 allowed-tools: Bash Read Write Edit
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - agentskills-home
@@ -33,7 +34,7 @@ metadata:
 
 Signals: grill output, `/skill-audit` findings, inline feedback, eval results, session context describing what went wrong. With none, ask whether the user meant to create a new skill or has feedback to apply.
 
-Read only the reference matching the resolved flow — each is self-contained. If the target sits inside a git worktree, capture `git log --oneline -1` before touching the filesystem; Step 4 needs it.
+Read only the reference matching the resolved flow — each is self-contained. If the target sits inside a git worktree, capture `rtk git log --oneline -1` before touching the filesystem; Step 4 needs it.
 
 ## Step 2 — Invocation axis
 
@@ -56,6 +57,6 @@ Gates `/skill-audit` enforces in both flows:
 
 Run `/skill-audit` on the resolved skill directory; resolve every FAIL before reporting done. It checks name-to-directory match, placeholders, both size budgets, boundary-target resolution and script hygiene — do not hand-check those. Hand-check the one thing it misses: an empty body reports `PASS  SKILL.md body word count 0 (ADR-0020 target: 600)`, so confirm at least one non-empty section exists.
 
-With `metadata.version` present, bump the **minor** version on create (new skills start at `0.1.0`) and the **patch** version on improve.
+Bump `metadata.version`: the **minor** version on create (new skills start at `0.1.0`) and the **patch** version on improve.
 
-**Commit verification.** Inside a git worktree: once the audit is clean, run `git add` and `git commit` — do not stop at staging. Re-run `git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is silently lost if the tree is cleaned up. Report done only once the hash has changed. Outside a worktree (a skill under `~/.claude/skills/`, say) nothing is committable — report done on a clean audit, naming that as the reason.
+**Commit verification.** Inside a git worktree: once the audit is clean, run `rtk git add` and `rtk git commit` — do not stop at staging. Re-run `rtk git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is silently lost if the tree is cleaned up. Report done only once the hash has changed. Outside a worktree (a skill under `~/.claude/skills/`, say) nothing is committable — report done on a clean audit, naming that as the reason.
diff --git a/plugins/kyberforge/.apm/skills/skill-author/assets/templates/SKILL.md b/plugins/kyberforge/.apm/skills/skill-author/assets/templates/SKILL.md
index 81b03d9..7fc910c 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/assets/templates/SKILL.md
+++ b/plugins/kyberforge/.apm/skills/skill-author/assets/templates/SKILL.md
@@ -45,14 +45,18 @@ description: >
 # Optional. 1–500 characters. State tool requirements, runtime versions,
 # and network access needs. Omit for skills with no special environment requirements.
 
-# metadata:
+metadata:
+  version: "0.1.0"
 #   author: your-name
-#   version: "1.0"
 #   category: general
 #   source_keys:
 #     - source-slug-one
 #     - source-slug-two
-# Optional. Arbitrary key-value map. Common keys: author, version, category.
+# `metadata.version` is REQUIRED on every skill (ADR-0022) and is enforced by the
+# `skill-frontmatter` pre-commit hook. Three-component semver. A newly created
+# skill starts at "0.1.0" — leave the seeded value as it is; "1.0.0" is the seed
+# for a pre-existing skill retrofitted into the rule, not for a new one.
+# The rest of the map is optional: author, category, source_keys.
 # source_keys: populated when built from /research output. Lists slugs from references/sources.md.
 # Also add source_keys to each references/*.md file that was informed by research.
 
diff --git a/plugins/kyberforge/.apm/skills/skill-author/references/create.md b/plugins/kyberforge/.apm/skills/skill-author/references/create.md
index 677425b..984a45e 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/references/create.md
+++ b/plugins/kyberforge/.apm/skills/skill-author/references/create.md
@@ -84,8 +84,10 @@ already covers the new skill. Use Read/Edit directly on `apm.yml`; this is not p
 ## Step 3 — Fill in SKILL.md
 
 Open the new skill's `SKILL.md` (the path Step 1 printed) and replace every `FILL IN:`
-placeholder. The scaffold template already carries the compliant frontmatter and body skeleton —
-fill it rather than restructuring it.
+placeholder. The scaffold template carries the ADR-0020 body skeleton and the two frontmatter
+fields that cannot be left as placeholders — `name`, substituted by the script, and
+`metadata.version`, seeded live at `"0.1.0"` — so fill the template in rather than restructuring
+it.
 
 **`name`** — already set by the scaffold script. Must exactly match the directory name. Format:
 1–64 characters, lowercase letters, numbers and hyphens only; no leading, trailing or consecutive
@@ -96,13 +98,18 @@ against `references/contract.md`, which holds the three-part shape, the banned c
 boundary-clause form and the length tiers. A hand-invoked skill (`SKILL.md` Step 2) takes one
 plain sentence and `disable-model-invocation: true` instead.
 
+**`metadata.version`** — required on every skill (ADR-0022), not a per-skill or per-plugin choice,
+and enforced by the `skill-frontmatter` pre-commit hook. The scaffold seeds a new skill at
+`"0.1.0"`; leave that value alone here and let `SKILL.md` Step 4 bump it. (`"1.0.0"` is the seed
+for a pre-existing skill retrofitted into the rule, and never applies to a skill created here.)
+
 **Optional frontmatter** — uncomment and fill in, or remove entirely:
 
 - `license` — include when distributing the skill externally
 - `compatibility` — include if the skill requires specific tools, runtimes, or network access
   (max 500 characters)
-- `metadata` — key-value map; use `author`, `version`, `category`; add `source_keys` now (Step 6)
-  if research sources are in context
+- `metadata` — the rest of the map, all of it optional: `author` and `category`, plus `source_keys`
+  now (Step 6) if research sources are in context
 - `allowed-tools` — space-separated pre-approved tools; reduces permission prompts (experimental —
   support varies by client)
 - `disable-model-invocation` — hand-invoked skills only
diff --git a/plugins/kyberforge/.apm/skills/skill-author/references/improve.md b/plugins/kyberforge/.apm/skills/skill-author/references/improve.md
index ffdf625..feda975 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/references/improve.md
+++ b/plugins/kyberforge/.apm/skills/skill-author/references/improve.md
@@ -85,6 +85,10 @@ improvise the cuts — four dry runs invented six to ten different answers to th
 If a signal points to a script or reference file, edit that file directly rather than adding a
 workaround in SKILL.md.
 
+**A skill carrying no `metadata.version` is seeded at `"1.0.0"`, not bumped** — `SKILL.md` Step 4's
+patch bump presumes a version to bump, and ADR-0022 reserves `"0.1.0"` for a newly created skill.
+`references/retrofit.md` carries the reasoning.
+
 **Check for regressions before handing back.** `SKILL.md` Step 4 tells you to resolve every FAIL,
 which says nothing about a check that passed *before* these edits and no longer does. Compare the
 closing audit against the skill's pre-edit state — a PASS that has become a SUGGESTION, or a
diff --git a/plugins/kyberforge/.apm/skills/skill-author/references/retrofit.md b/plugins/kyberforge/.apm/skills/skill-author/references/retrofit.md
index 37fa55d..0755773 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/references/retrofit.md
+++ b/plugins/kyberforge/.apm/skills/skill-author/references/retrofit.md
@@ -106,6 +106,37 @@ them for you. After every retrofit that adds, removes or renames a file:
 - [ ] Re-run `/skill-audit` and confirm its `### Provenance` dimension does not report the new
       file as missing `source_keys`.
 
+## Compression must not add authority the source text didn't have
+
+This one is **not** part of the checklist above, and deliberately so: it fires on a wording change
+with no file change at all, so a retrofit that adds and removes nothing still owes it.
+
+The `sources.md` bullet above is about an entry going *stale* — Contributing files left uncited
+after content moves. This is a distinct failure: a compression or rewrite pass that upgrades an
+honest hedge in a Description into an unsupported confident claim, without the underlying source
+having changed at all — "no forge-specific content drawn directly from it beyond that" quietly
+becoming "Grounds Step 2's dispatch table."
+
+`/skill-audit`'s provenance script does now notice this class: it diffs each slug's `Description`
+and `Contributing files` text against a base ref and raises an **INFO** when the wording changed.
+That is a prompt, not a verdict — it reports only *that* the claim moved, never whether the new
+claim is true, because a bash script can verify an entry is internally consistent and nothing more.
+Answering it is this flow's job: if a retrofit strengthens or otherwise changes the wording of a
+provenance claim, re-read the upstream research doc first and confirm the stronger wording is
+actually still true before committing it.
+
+## Versioning a retrofitted skill
+
+`SKILL.md` Step 4 says to bump the **patch** version on improve, which presumes there is a version
+to bump. A pre-ADR-0020 skill often carries none — `metadata.version` only became mandatory under
+ADR-0022, and this flow is exactly where those skills surface.
+
+A skill with no `metadata.version` is **seeded at `"1.0.0"`, not bumped**. `"0.1.0"` is reserved
+for a skill created new by the create flow: it means "created and never yet revised", which
+understates a skill that has been through retrofit and audit passes without tracking a version.
+Add the field in this retrofit — the `skill-frontmatter` pre-commit hook blocks the commit without
+it.
+
 ## Worked example — a description retrofit
 
 `gitea-issues` before, 827 characters, the single most common shape in the corpus:
diff --git a/plugins/kyberforge/.apm/skills/skill-author/tests/new-skill.bats b/plugins/kyberforge/.apm/skills/skill-author/tests/new-skill.bats
index dd3a188..5540f28 100644
--- a/plugins/kyberforge/.apm/skills/skill-author/tests/new-skill.bats
+++ b/plugins/kyberforge/.apm/skills/skill-author/tests/new-skill.bats
@@ -156,6 +156,18 @@ EOF
     assert_success
 }
 
+@test "scaffold emits a live metadata.version seeded at 0.1.0 (ADR-0022)" {
+    # The scaffold must clear .pre-commit-config.yaml's `skill-frontmatter` hook
+    # on its first commit: a commented-out metadata block ships a skill with no
+    # version and is blocked. Assert the field is live, not a comment.
+    bash "$SCRIPT" my-tool "$DEST"
+    run grep -E '^metadata:$' "$DEST/my-tool/SKILL.md"
+    assert_success
+    run grep -E '^  version: "[0-9]+\.[0-9]+\.[0-9]+"$' "$DEST/my-tool/SKILL.md"
+    assert_success
+    assert_output --partial '0.1.0'
+}
+
 @test "walk-up skips a type-less apm.yml (marketplace-only) and finds a real package root further up" {
     mkdir -p "$DEST/mid/sub"
     cat > "$DEST/apm.yml" <<'EOF'
diff --git a/plugins/kyberforge/.claude-plugin/plugin.json b/plugins/kyberforge/.claude-plugin/plugin.json
index b68cafa..935e448 100644
--- a/plugins/kyberforge/.claude-plugin/plugin.json
+++ b/plugins/kyberforge/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "kyberforge",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/kyberforge/.github/plugin/plugin.json b/plugins/kyberforge/.github/plugin/plugin.json
index b68cafa..935e448 100644
--- a/plugins/kyberforge/.github/plugin/plugin.json
+++ b/plugins/kyberforge/.github/plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "kyberforge",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.",
   "author": {
     "name": "Defame1297",
diff --git a/plugins/kyberforge/apm.yml b/plugins/kyberforge/apm.yml
index fc1e122..f71b811 100644
--- a/plugins/kyberforge/apm.yml
+++ b/plugins/kyberforge/apm.yml
@@ -1,5 +1,5 @@
 name: kyberforge
-version: 1.6.1
+version: 1.6.2
 description: Skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace.
 author:
   name: Defame1297
diff --git a/plugins/kyberforge/skills/agent-audit/SKILL.md b/plugins/kyberforge/skills/agent-audit/SKILL.md
index 19abac3..67396dc 100644
--- a/plugins/kyberforge/skills/agent-audit/SKILL.md
+++ b/plugins/kyberforge/skills/agent-audit/SKILL.md
@@ -7,6 +7,7 @@ description: >
   directory -> skill-audit.
 allowed-tools: Bash Read
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - context7-websites-code-claude
diff --git a/plugins/kyberforge/skills/agent-audit/references/description-quality.md b/plugins/kyberforge/skills/agent-audit/references/description-quality.md
index eac9c27..4083917 100644
--- a/plugins/kyberforge/skills/agent-audit/references/description-quality.md
+++ b/plugins/kyberforge/skills/agent-audit/references/description-quality.md
@@ -27,15 +27,22 @@ where the body's flowchart specified two.
 
 Read the frontmatter before judging a single word.
 
-- **`disable-model-invocation: true` or `user-invocable: false`** — the agent is hand-invoked. Its
-  description is never matched against user intent, so it is not a routing string. It carries **one
-  plain human-facing sentence** stating what the agent does. Audit it for that and nothing else.
-  Reporting a missing trigger clause, a missing boundary clause or absent indirect triggers on a
-  hand-invoked agent is a wrong finding, not a strict one. Both fields are Copilot-only and neither
-  is on the vendor-neutral APM allowlist, so this case arises in a Copilot `.agent.md` at
-  project/user scope and nowhere else. Its Claude Code counterpart has no equivalent field and stays
-  model-invoked, so the two halves of the pair carrying differently shaped descriptions is expected
-  there rather than a pair-consistency finding.
+- **`disable-model-invocation: true`** — the agent is hand-invoked. Its description is never
+  matched against user intent, so it is not a routing string. It carries **one plain human-facing
+  sentence** stating what the agent does. Audit it for that and nothing else. Reporting a missing
+  trigger clause, a missing boundary clause or absent indirect triggers on a hand-invoked agent is a
+  wrong finding, not a strict one. The field is Copilot-only and not on the vendor-neutral APM
+  allowlist, so this case arises in a Copilot `.agent.md` at project/user scope and nowhere else.
+  Its Claude Code counterpart has no equivalent field and stays model-invoked, so the two halves of
+  the pair carrying differently shaped descriptions is expected there rather than a
+  pair-consistency finding.
+  `user-invocable: false` does not belong in this bullet. The two are separate fields with opposite
+  defaults — `disable-model-invocation` (default `false`) governs runtime auto-selection,
+  `user-invocable` (default `true`) governs manual invocation, and the retired `infer` field was
+  replaced by the pair rather than by either one. So `user-invocable: false` says nothing about
+  whether the agent is model-routed: judge that from `disable-model-invocation` alone, and where
+  that is absent the three-part shape below still applies. `user-invocable` carries no
+  description-quality contract of its own and is out of this file's scope entirely.
 - **No such flag** — the agent is model-invoked and the rest of this file applies.
 
 ## The three-part shape
diff --git a/plugins/kyberforge/skills/agent-audit/references/scope-project-user.md b/plugins/kyberforge/skills/agent-audit/references/scope-project-user.md
index d91a5ad..642c128 100644
--- a/plugins/kyberforge/skills/agent-audit/references/scope-project-user.md
+++ b/plugins/kyberforge/skills/agent-audit/references/scope-project-user.md
@@ -41,8 +41,8 @@ those same sections, so any restatement is a copy that can disagree with the che
   If it carries one, it still has to be kebab-case.
 - `Use proactively` is meaningful in a CC description and steers the runtime to offer the agent
   unprompted. In a Copilot description it does nothing; `KyberforgeCopilot.ProactivePhrase` flags
-  it. The Copilot equivalent is `disable-model-invocation` / `user-invocable`, which changes the
-  description contract entirely — see `references/description-quality.md`, Step 0.
+  it. The Copilot equivalent is `disable-model-invocation`, which changes the description contract
+  entirely — see `references/description-quality.md`, Step 0.
 
 ## Pair consistency
 
diff --git a/plugins/kyberforge/skills/agent-author/SKILL.md b/plugins/kyberforge/skills/agent-author/SKILL.md
index c6ca310..c399ffa 100644
--- a/plugins/kyberforge/skills/agent-author/SKILL.md
+++ b/plugins/kyberforge/skills/agent-author/SKILL.md
@@ -6,6 +6,7 @@ description: >
   Not read-only review -> `agent-audit`. Not skills -> `skill-author`.
 allowed-tools: Bash Read Write Edit
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - context7-websites-code-claude
@@ -30,7 +31,7 @@ metadata:
 
 Signals: grill output, `agent-audit` findings, inline feedback, session context describing what went wrong. With none, ask: "No improvement signals found. Did you mean to create a new agent, or do you have feedback to apply?"
 
-Read only the reference for the resolved flow. Capture `git log --oneline -1` before touching the filesystem; Step 4 needs it.
+Read only the reference for the resolved flow. Capture `rtk git log --oneline -1` before touching the filesystem; Step 4 needs it.
 
 ## Step 2 — Scope
 
@@ -61,4 +62,4 @@ Invoke `agent-audit` on each file written and resolve every FAIL before reportin
 
 At plugin/APM scope bump the resolved package's `apm.yml` `version` — **minor** on create, **patch** on improve — because consumers compare it to detect updates. Project and user scope have no manifest.
 
-**Commit verification.** Once the audit is clean, run `git add` and `git commit` — do not stop at staging. Re-run `git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is lost if the tree is cleaned up. Report done only once the hash has changed.
+**Commit verification.** Once the audit is clean, run `rtk git add` and `rtk git commit` — do not stop at staging. Re-run `rtk git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is lost if the tree is cleaned up. Report done only once the hash has changed.
diff --git a/plugins/kyberforge/skills/apm-install/SKILL.md b/plugins/kyberforge/skills/apm-install/SKILL.md
index 054d161..d576504 100644
--- a/plugins/kyberforge/skills/apm-install/SKILL.md
+++ b/plugins/kyberforge/skills/apm-install/SKILL.md
@@ -6,6 +6,7 @@ description: >
   authoring, publishing, auditing, or dependency installation for an apm
   package -> `apm-workflow`.
 metadata:
+  version: "1.0.0"
   category: apm
   source_keys:
     - context7-microsoft-apm
diff --git a/plugins/kyberforge/skills/apm-workflow/SKILL.md b/plugins/kyberforge/skills/apm-workflow/SKILL.md
index cd258b4..85e2f30 100644
--- a/plugins/kyberforge/skills/apm-workflow/SKILL.md
+++ b/plugins/kyberforge/skills/apm-workflow/SKILL.md
@@ -5,6 +5,7 @@ description: >
   the dependencies it declares, or an apm marketplace — even when the user does
   not say "apm". Not the apm binary or an agent runtime -> `apm-install`.
 metadata:
+  version: "1.0.0"
   category: apm
   source_keys:
     - context7-microsoft-apm
diff --git a/plugins/kyberforge/skills/forge/SKILL.md b/plugins/kyberforge/skills/forge/SKILL.md
index 860e9db..f63242a 100644
--- a/plugins/kyberforge/skills/forge/SKILL.md
+++ b/plugins/kyberforge/skills/forge/SKILL.md
@@ -8,6 +8,7 @@ description: >
   already named — invoke `skill-author`, `agent-author` or `apm-workflow`
   directly.
 metadata:
+  version: "1.0.0"
   category: factory
   source_keys:
     - claude-code-subagents-docs
diff --git a/plugins/kyberforge/skills/skill-audit/README.md b/plugins/kyberforge/skills/skill-audit/README.md
index 277c836..468be43 100644
--- a/plugins/kyberforge/skills/skill-audit/README.md
+++ b/plugins/kyberforge/skills/skill-audit/README.md
@@ -11,7 +11,7 @@ Audit a skill directory against the agentskills.io specification and the house c
 
 `validate.sh` enforces two independent length families that must not be conflated: the agentskills.io spec conformance ceilings (500 lines, 2,770 words, both counting the whole file) and the ADR-0020 context budget (250/400 description characters, 600/900 body-only words).
 
-Alongside those it runs four shape checks that are not length measurements at all. Two are FAILs: every routing target named in the description — in the compressed `Not <thing> -> <name>` arrow **and** in the prose form — must resolve to a real skill or agent, and every `references/<file>.md` the body names must exist on disk. Three are SUGGESTIONs: a missing boundary clause, a Gotchas section over five entries, and a Gotchas section over 25% of the body. The resolution universe for boundary targets is derived by walking up from the audited `SKILL.md` — the authoring root above it, its own apm package, and that package's declared `apm.yml` dependencies — so a fresh clone and a machine that has run `apm install` return the same verdict. When no universe can be determined the check prints `INFO ... DID NOT RUN` and does not silently pass.
+Alongside those it runs shape checks that are not length measurements at all. Three are FAILs: every routing target named in the description — in the compressed `Not <thing> -> <name>` arrow **and** in the prose form — must resolve to a real skill or agent; every `references/<file>.md` the body names must exist on disk; and `metadata.version` must be present and three-part semver (ADR-0022). That last one is FAIL rather than SUGGESTION because the `skill-frontmatter` pre-commit hook rejects the file without it — an audit grading it lower would report ready-to-ship on a file the commit gate refuses. Three are SUGGESTIONs: a missing boundary clause, a Gotchas section over five entries, and a Gotchas section over 25% of the body. The resolution universe for boundary targets is derived by walking up from the audited `SKILL.md` — the authoring root above it, its own apm package, and that package's declared `apm.yml` dependencies — so a fresh clone and a machine that has run `apm install` return the same verdict. When no universe can be determined the check prints `INFO ... DID NOT RUN` and does not silently pass.
 
 ## Usage
 
@@ -26,8 +26,8 @@ Provide the path to the skill directory to audit when invoking.
 | File | Purpose |
 |------|---------|
 | `SKILL.md` | Skill instructions for agents |
-| `scripts/validate.sh` | Structural validator — checks name format, name matches directory, description presence and length, body-only word count, line and whole-file word ceilings, boundary-clause presence, boundary-target resolution, `references/` pointer existence, Gotchas entry count and body share, placeholder detection, script executable bit, and interactive-prompt detection |
-| `scripts/validate-provenance.sh` | Provenance validator — checks sources.md completeness, source_keys/slug consistency, Contributing files existence, bidirectional linkage, Research doc: fields, and upstream research doc alignment |
+| `scripts/validate.sh` | Structural validator — checks name format, name matches directory, description presence and length, `metadata.version` presence and semver shape (ADR-0022), body-only word count, line and whole-file word ceilings, boundary-clause presence, boundary-target resolution, `references/` pointer existence, Gotchas entry count and body share, placeholder detection, script executable bit, and interactive-prompt detection |
+| `scripts/validate-provenance.sh` | Provenance validator — checks sources.md completeness, source_keys/slug consistency, Contributing files existence, bidirectional linkage, Research doc: fields, upstream research doc alignment, and (check 9, INFO only) whether a slug's `Description` or `Contributing files` text has changed since a base ref — `--base-ref=<ref>` or `VALIDATE_PROVENANCE_BASE_REF`, defaulting to the merge base with `origin/main` |
 | `scripts/vale-wrap.sh` | Vale prefilter wrapper — runs the bundled `Kyberforge` Vale styles against SKILL.md and reports alerts as deterministic FAILs ahead of Step 3's qualitative review |
 | `assets/vale/.vale.ini` | Vale configuration — points Vale at the bundled `Kyberforge` style path, self-located relative to `vale-wrap.sh` |
 | `assets/vale/styles/Kyberforge/CompositionNote.yml` | Vale rule — flags composition and architecture notes in a description (e.g. "cross-cutting", "entry point", "rather than duplicating") |
@@ -41,7 +41,7 @@ Provide the path to the skill directory to audit when invoking.
 | `references/patterns.md` | Rubric for the patterns dimension — which instruction construct fits which job, and how each is correctly formed |
 | `references/file-structure.md` | Rubric for the file-structure and internal-consistency dimensions — permitted directories, cross-plugin path rules and their two structural exemptions, README drift |
 | `references/formatting-and-scripts.md` | Rubric for the formatting and scripts dimensions — heading and fencing conventions, and the agentic-use criteria for bundled scripts |
-| `references/validation-scripts.md` | Step 1 troubleshooting — the manual structural fallback when `validate.sh` cannot run, and the script exit codes that are easy to misread (loaded only on a script failure) |
+| `references/validation-scripts.md` | Step 1 troubleshooting — the manual structural fallback when `validate.sh` cannot run, and the script exit codes that are easy to misread (loaded on a script failure, and on any exit-0 run that printed something — `validate-provenance.sh`'s check 9 is INFO-only, so its findings arrive that way) |
 | `references/sources.md` | Provenance record — agentskills.io sources that informed this skill and which files each contributed to |
 | `tests/validate.bats` | (source-only) Bats test suite for validate.sh |
 | `tests/validate-provenance.bats` | (source-only) Bats test suite for validate-provenance.sh |
diff --git a/plugins/kyberforge/skills/skill-audit/SKILL.md b/plugins/kyberforge/skills/skill-audit/SKILL.md
index 1a66612..8f093d9 100644
--- a/plugins/kyberforge/skills/skill-audit/SKILL.md
+++ b/plugins/kyberforge/skills/skill-audit/SKILL.md
@@ -7,6 +7,7 @@ description: >
   skill-author.
 allowed-tools: Bash Read
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - agentskills-home
@@ -35,9 +36,9 @@ bash scripts/vale-wrap.sh <skill-dir>/SKILL.md
 
 `validate.sh` findings become the `### Structure` dimension — its FAILs and its SUGGESTIONs both, at the tier the script assigned. Report each once; never re-grade one under another dimension. Unresolved boundary targets are where this bites, because their tier turns on notation.
 
-If any of the three cannot run, or exits non-zero for a reason other than findings, read `references/validation-scripts.md` — it carries the manual fallback and the misleading exit codes. Ordinary content FAILs are the expected outcome here and need no fallback.
+Read `references/validation-scripts.md` when any of the three cannot run or exits non-zero for a reason other than findings, **and whenever `validate-provenance.sh` exits 0 having printed anything**. Ordinary content FAILs are the expected outcome here and need no fallback.
 
-`validate-provenance.sh` prints nothing on success, so read its exit code before you read its silence. **0** is a genuine pass. **1** means real findings: its FAILs and INFOs become a separate `### Provenance` dimension, and it emits Why and Fix itself — surface those verbatim. **2** means the check never ran — a usage or environment error, reason on stderr, no findings and often no stdout at all. On a 2, report `### Provenance` as unverified and quote the stderr reason. Never grade an exit 2 as a clean pass: empty stdout there means nothing was checked, not that nothing was wrong.
+`validate-provenance.sh` reports through exit code **and** output; neither alone is the verdict. **0, silent** is a genuine pass. **0 with output** is INFO-only findings — still a `### Provenance` dimension; `references/validation-scripts.md` says what each obliges — for a check-9 INFO, reading rather than relaying. **1** is FAILs plus any INFOs; it emits Why and Fix itself — surface those verbatim. **2** means it never ran — a usage or environment error, reason on stderr, often no stdout — so report `### Provenance` unverified and quote that reason. Never grade an exit 2, or an exit 0 that printed, as a clean pass.
 
 `vale-wrap.sh` applies the bundled `Kyberforge` style as a prefilter. Pass no `--config`; the wrapper locates its own. Every rule is graded `error`, so every alert is a FAIL. Report each one citing its rule ID, filed under the dimension it belongs to, and do not re-derive it by judgment:
 
diff --git a/plugins/kyberforge/skills/skill-audit/references/validation-scripts.md b/plugins/kyberforge/skills/skill-audit/references/validation-scripts.md
index a1ddb24..24b138f 100644
--- a/plugins/kyberforge/skills/skill-audit/references/validation-scripts.md
+++ b/plugins/kyberforge/skills/skill-audit/references/validation-scripts.md
@@ -6,8 +6,9 @@ source_keys:
 
 # Validation Scripts Reference
 
-Read this when a Step 1 script fails, cannot run, or reports something that needs interpreting.
-Nothing here is needed on a clean run.
+Read this when a Step 1 script fails, cannot run, or reports something that needs interpreting —
+including `validate-provenance.sh` exiting **0 having printed something**, which is INFO findings,
+not a clean run. Its silent exit 0 is the only outcome that needs nothing here.
 
 ## Report the gap, do not guess
 
@@ -105,6 +106,34 @@ Three ways to read the result wrong:
   is not a directory, a directory holding no `SKILL.md`, a missing or extra argument, and an absent
   `python3` all exit **2** with a message on stderr. Exit 2 means the script never ran — report it
   as an unaudited dimension, never as a pass and never as a finding. Exit 1 is findings.
+- **A check-9 INFO — `'<field>' changed for '<slug>' since <ref>` — means go read, not just relay.**
+  Check 9 diffs the current `references/sources.md` against a base ref and flags a slug whose
+  `Description` or `Contributing files` text differs. It is structurally incapable of telling you
+  whether the new wording is still *true* — it only detects that the text changed — so when this
+  INFO fires, open that slug's own entry: the document named in its `Research doc:` field, and the
+  files its `Contributing files` list names. Read whichever the changed field is a claim *about* —
+  a Description-only change often leaves the file list untouched, so "open the Contributing files"
+  is where to look, not proof that they are what moved. Confirm by reading whether the (possibly
+  strengthened) claim genuinely holds. This is the one provenance finding this script cannot verify
+  for you: every other check here is a structural fact you can relay as-is, but check 9's job is
+  only to tell you *where* to spend that reading effort, not to replace it. Acknowledging the INFO
+  without opening those files is not auditing it. Its companion — `'<field>' removed for '<slug>'
+  since <ref>` — is the same obligation in the other direction: a claim withdrawn rather than
+  rewritten. No other check here requires the field, so confirm the removal was deliberate.
+- **The check-9 base ref defaults to `git merge-base HEAD origin/main`, and there are two ways to
+  override it.** `--base-ref=<ref>` on the command line, or the `VALIDATE_PROVENANCE_BASE_REF`
+  environment variable; the flag wins when both are given, including when it is given empty
+  (`--base-ref=`), which selects the default resolution and ignores the environment. Reach for one
+  on a fork, a long-lived branch, or a mirror whose remote is not called `origin` — and when a
+  review asks what changed since a specific commit rather than since the branch point.
+- **A single check-9 INFO naming a whole-check skip is an unaudited dimension, not a finding about
+  the skill.** There are three: "no repo root above the skill directory", "no base ref could be
+  resolved", and "`<path>` is not tracked at `<ref>`". The third is the one to read carefully — it
+  fires when the base ref resolved but `git show <ref>:<path>` did not, which covers both a
+  genuinely new `sources.md` (nothing to flag) and a path git does not know under that name: a
+  renamed skill directory, or an installed, gitignored copy such as a deployed `.claude/skills/`
+  tree. Auditing the deployed copy silently checks nothing; re-run against the authoring path under
+  `plugins/*/.apm/skills/`.
 - **`vale` reports `0 files`.** Treat the pass as NOT RUN, not as clean, and fall back to full
   Step 3 judgment for the dimensions it would have covered. The bundled `Kyberforge` style is
   scoped by glob in `assets/vale/.vale.ini`; a file outside those globs is silently not linted.
diff --git a/plugins/kyberforge/skills/skill-audit/scripts/validate-provenance.sh b/plugins/kyberforge/skills/skill-audit/scripts/validate-provenance.sh
index 4ed3629..4b720b4 100755
--- a/plugins/kyberforge/skills/skill-audit/scripts/validate-provenance.sh
+++ b/plugins/kyberforge/skills/skill-audit/scripts/validate-provenance.sh
@@ -3,12 +3,20 @@ set -euo pipefail
 
 usage() {
   cat <<EOF
-Usage: validate-provenance.sh <skill-dir>
+Usage: validate-provenance.sh <skill-dir> [--base-ref=<ref>]
 
 Validate that a skill's sources provenance chain is complete and internally consistent.
 
 Arguments:
-  skill-dir  Path to the skill directory to validate.
+  skill-dir       Path to the skill directory to validate.
+  --base-ref=REF  Git ref to diff references/sources.md against for check 9.
+                  Defaults to \`git merge-base HEAD origin/main\`. Override this
+                  when origin/main is not the right comparison point (a fork,
+                  a long-lived branch, a mirror with a different remote name).
+                  The VALIDATE_PROVENANCE_BASE_REF environment variable is an
+                  equivalent, lower-precedence way to set it — the flag wins
+                  if both are given, including when the flag is given empty
+                  (\`--base-ref=\`), which selects the default resolution.
 
 Exit codes:
   0  All checks passed (or nothing to validate)
@@ -38,6 +46,15 @@ Checks performed:
      resolved; a path that still does not resolve is reported as an INFO saying
      checks 7 and 8 did not run, never skipped silently.
   8  Extracted non-(none) slug in research doc present in sources.md
+  9  Description or Contributing files text changed since --base-ref (INFO
+     only — a bash script cannot verify the claim is still TRUE, only that it
+     changed; the auditor reads the named files to check that). Wrapped values
+     are joined before comparison, so a re-wrap alone is not a change and a
+     rewrite of any line of one is. A slug absent at the base ref is a
+     creation, not a change, and is not flagged; a field that WAS there and is
+     now gone is announced as a removal. When the base ref cannot be resolved,
+     or references/sources.md is not tracked under this path at that ref, this
+     is announced as ONE INFO for the whole check, never a silent skip.
 
   Checks 7 and 8 apply ONLY when the Research doc value names a research SOURCE
   INDEX — a file whose basename is sources.md, whose H2 headings ARE source
@@ -52,13 +69,38 @@ if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
   exit 0
 fi
 
+# --base-ref=<ref> is the only recognised flag, for check 9's base-ref
+# override. It is pulled out before the positional-count checks below so it
+# never counts against them — a caller passing it alongside skill-dir sees
+# the same argument-count behaviour as one who does not pass it at all, and a
+# genuinely extra positional argument is still rejected.
+#
+# BASE_REF_OVERRIDE is deliberately left UNSET here rather than initialised to
+# the empty string. `--base-ref=` (given, but empty) and "no flag at all" are
+# different instructions — the first says "use the default resolution, ignoring
+# the environment", the second says "fall back to the environment" — and an
+# empty-string initialiser collapsed them: `${BASE_REF_OVERRIDE:-$ENV}` treats
+# an empty flag value as absent, so the environment variable won and the usage
+# text's "the flag wins if both are given" was false for exactly that spelling.
+declare -a POSITIONAL_ARGS=()
+for arg in "$@"; do
+  case "$arg" in
+    --base-ref=*)
+      BASE_REF_OVERRIDE="${arg#--base-ref=}"
+      ;;
+    *)
+      POSITIONAL_ARGS+=("$arg")
+      ;;
+  esac
+done
+
 # Usage and environment problems exit 2, findings exit 1. See the usage text
 # above for why the two must not share a code. This is a deliberate divergence
 # from validate.sh, which has no 2 tier: validate.sh always prints PASS lines,
 # so a usage error there is visibly not a findings report. This script prints
 # NOTHING on a clean run, so exit 1 plus empty stdout was the only signal a
 # caller got either way.
-if [[ $# -lt 1 ]]; then
+if [[ ${#POSITIONAL_ARGS[@]} -lt 1 ]]; then
   echo "Error: skill-dir is required." >&2
   echo "" >&2
   usage >&2
@@ -67,13 +109,25 @@ fi
 
 # Extra positional arguments were silently dropped, so a typo'd flag or a second
 # path looked like it had been honoured.
-if [[ $# -gt 1 ]]; then
-  echo "Error: expected exactly one argument, got $#: $*" >&2
+if [[ ${#POSITIONAL_ARGS[@]} -gt 1 ]]; then
+  echo "Error: expected exactly one argument, got ${#POSITIONAL_ARGS[@]}: ${POSITIONAL_ARGS[*]}" >&2
   echo "" >&2
   usage >&2
   exit 2
 fi
 
+SKILL_DIR_ARG="${POSITIONAL_ARGS[0]}"
+
+# The flag wins over the environment variable whenever the flag was GIVEN —
+# `+x` tests for presence, not for a non-empty value, which is the distinction
+# `:-` could not make. An empty result either way tells the Python body to fall
+# back to `git merge-base HEAD origin/main`.
+if [[ -n "${BASE_REF_OVERRIDE+x}" ]]; then
+  BASE_REF="$BASE_REF_OVERRIDE"
+else
+  BASE_REF="${VALIDATE_PROVENANCE_BASE_REF:-}"
+fi
+
 # python3 is a HARD dependency. Without this preflight a missing interpreter
 # produced 'line NN: python3: command not found' and exit 127 — an exit code no
 # caller maps to anything, from a message that names this script's line number
@@ -91,24 +145,25 @@ fi
 # references/validation-scripts.md explicitly told the auditor to read as a
 # pass. A typo'd target was therefore indistinguishable from a clean skill.
 # vale-wrap.sh hard-errors on a nonexistent path for exactly this reason.
-if [[ ! -d "$1" ]]; then
-  echo "Error: not a directory: $1" >&2
+if [[ ! -d "$SKILL_DIR_ARG" ]]; then
+  echo "Error: not a directory: $SKILL_DIR_ARG" >&2
   echo "  Why: a nonexistent target would otherwise report a silent pass." >&2
   echo "  Fix: pass the path of the skill directory to validate." >&2
   exit 2
 fi
 
-if [[ ! -f "$1/SKILL.md" ]]; then
-  echo "Error: not a skill directory (no SKILL.md): $1" >&2
+if [[ ! -f "$SKILL_DIR_ARG/SKILL.md" ]]; then
+  echo "Error: not a skill directory (no SKILL.md): $SKILL_DIR_ARG" >&2
   echo "  Why: a directory with no SKILL.md has no provenance chain to validate, and reporting that as a pass hides the wrong-target mistake." >&2
   echo "  Fix: pass the skill directory itself, not its parent or its references/ subdirectory." >&2
   exit 2
 fi
 
-python3 -u - "$1" <<'PYTHON'
+python3 -u - "$SKILL_DIR_ARG" "$BASE_REF" <<'PYTHON'
 import sys
 import os
 import re
+import subprocess
 
 # Output is UTF-8 for the same reason input is: under LC_ALL=C the streams
 # default to ASCII, and every finding this script prints contains an em dash.
@@ -125,6 +180,11 @@ skill_dir = os.path.abspath(sys.argv[1])
 sources_md_path = os.path.join(skill_dir, "references", "sources.md")
 refs_dir = os.path.join(skill_dir, "references")
 
+# Empty string (the shell side passes "" when neither --base-ref nor
+# VALIDATE_PROVENANCE_BASE_REF was given) means: resolve the default via
+# `git merge-base HEAD origin/main` at check-9 time, below.
+base_ref_override = sys.argv[2] if len(sys.argv) > 2 else ""
+
 # --- Helpers ---
 
 # The trailing character class used to be CONSUMING — `[^`\n]` — so a
@@ -444,6 +504,143 @@ def find_repo_root(start_dir):
             return None
         current = parent
 
+# --- Check 9 helpers ---------------------------------------------------
+# Check 9 needs a raw field VALUE (as text, to diff against an earlier
+# version), not the parsed structure parse_contributing_files() and
+# parse_status() return. The ONE normalization applied is whitespace
+# collapsing, which is what makes a re-wrap or a re-indent invisible; nothing
+# else is normalized away.
+#
+# In particular a REORDERED Contributing files list DOES fire this check, and
+# that is deliberate — the header here used to claim the opposite, which the
+# code never did. Order-insensitivity cannot be had for one field without
+# distorting the other: the two fields share this parser, and the only way to
+# ignore order is to split the value into items and sort them, which for a
+# prose Description means splitting on commas and would then hide a genuine
+# rewrite that merely permuted its clauses. Check 9 is always an INFO whose
+# whole job is to point a human at a place to read; a reordered list costs
+# that human one glance to dismiss, whereas a hidden rewrite is the exact
+# failure #118 exists to catch. False positive over false negative, on this
+# check, on purpose.
+
+def run_git(args, cwd):
+    """Run `git <args>` in cwd. Returns (returncode, stdout, stderr) — never
+    raises, so a missing git binary or an unexpected OSError is just another
+    non-zero result the caller folds into "could not run", not a crash."""
+    try:
+        result = subprocess.run(
+            ["git"] + args, cwd=cwd, capture_output=True, text=True,
+            encoding="utf-8", errors="replace"
+        )
+        return result.returncode, result.stdout, result.stderr
+    except OSError as exc:
+        return 1, "", str(exc)
+
+def ref_exists(ref, cwd):
+    """True when ref resolves to a commit in the repo at cwd."""
+    rc, _out, _err = run_git(["rev-parse", "--verify", "--quiet", ref + "^{commit}"], cwd)
+    return rc == 0
+
+def find_slug_block(content, slug):
+    """The raw text of a '## <slug>' entry's body, or None if no such H2."""
+    pattern = re.compile(
+        r'^## ' + re.escape(slug) + r'\s*\n(.*?)(?=^## |\Z)',
+        re.MULTILINE | re.DOTALL
+    )
+    m = pattern.search(content)
+    return m.group(1) if m else None
+
+# A field value ENDS at the next field, the next heading, or a blank line.
+# Every other non-blank line is a continuation of the value the author wrapped
+# across physical lines.
+#
+# This boundary is what the old `(.+)$` regex did not have. `.` does not cross
+# a newline, so only the FIRST physical line of a wrapped value was ever
+# compared — and a rewrite confined to a continuation line produced no finding
+# at all. That is verbatim the hedge-to-confident-claim regression #118 exists
+# to catch, invisible to the check written to catch it. The bullet branch had
+# the same defect one level down: a wrapped bullet's continuation does not
+# start with '- ', so the loop broke there and silently dropped every
+# remaining bullet.
+#
+# A continuation line that itself opens with bold text ('**note** — ...') is
+# read as a boundary and truncates the value. That is a known, narrow
+# false-negative, accepted because the alternative — no boundary at all —
+# is what produced the wide one above.
+FIELD_BOUNDARY_RE = re.compile(r'^(?:- )?\*\*|^#{1,6} ')
+
+
+def _is_field_boundary(stripped_line):
+    """True when a stripped line starts a new field, bullet-less heading or H2."""
+    return bool(FIELD_BOUNDARY_RE.match(stripped_line))
+
+
+def parse_field_raw(content, slug, field_name):
+    """Raw text of a '**<field_name>:**' field under a slug H2, wrapping joined.
+
+    Mirrors the two authored shapes parse_contributing_files() and
+    parse_status() already handle (inline value on the same line, or a
+    bare heading followed by '- ' bullets), but returns text rather than a
+    parsed structure, because check 9 diffs wording, not semantics.
+
+    Continuation lines are joined into the value they belong to before the
+    caller normalizes and compares, so a value wrapped across two lines and
+    the same value on one line are the same text — and a change made on any
+    line of a wrapped value is visible, not just one made on the first.
+
+    Returns None when the H2 itself is absent (the slug did not exist at
+    this content's revision) or the field is absent — both read as "no
+    earlier claim to compare against" to the caller, which is deliberate:
+    a field appearing for the first time is a creation, not a change.
+    """
+    block = find_slug_block(content, slug)
+    if block is None:
+        return None
+    lines = block.splitlines()
+    inline_re = re.compile(r'^\- \*\*' + re.escape(field_name) + r':\*\*[ \t]*(.*)$')
+    heading_re = re.compile(r'^\*\*' + re.escape(field_name) + r':\*\*[ \t]*$')
+
+    for idx, line in enumerate(lines):
+        im = inline_re.match(line)
+        if im:
+            parts = [im.group(1).strip()]
+            for cont in lines[idx + 1:]:
+                stripped = cont.strip()
+                if not stripped or stripped.startswith("- ") or _is_field_boundary(stripped):
+                    break
+                parts.append(stripped)
+            joined = " ".join(p for p in parts if p).strip()
+            return joined or None
+        if heading_re.match(line):
+            entries = []
+            for cont in lines[idx + 1:]:
+                stripped = cont.strip()
+                if not stripped:
+                    if entries:
+                        break
+                    continue
+                if _is_field_boundary(stripped):
+                    break
+                if stripped.startswith("- "):
+                    entries.append(stripped[2:].strip())
+                elif entries:
+                    # A wrapped bullet: fold it back into the bullet it
+                    # continues rather than ending the list here.
+                    entries[-1] = (entries[-1] + " " + stripped).strip()
+                else:
+                    break
+            return ", ".join(e for e in entries if e) or None
+    return None
+
+def normalize_field_text(value):
+    """Collapse whitespace so reformatting alone never registers as a change.
+
+    True only because parse_field_raw() joins wrapped continuation lines
+    first: collapsing whitespace inside a value that had already been
+    truncated at its first newline normalized nothing a re-wrap could change.
+    """
+    return re.sub(r'\s+', ' ', value).strip()
+
 findings = []
 has_fail = False
 
@@ -859,6 +1056,143 @@ for rd_abs, (rd_rel, known_slugs, rd_content) in research_docs_seen.items():
                 f"Add '## {rd_slug}' to references/sources.md or mark it as '(none)' in the research doc's Contributing files."
             )
 
+# --- Check 9: Description / Contributing files changed since --base-ref ---
+# A structural fact — the field's TEXT differs from an earlier revision — is
+# all git can tell us. Whether the (possibly stronger) new wording is still
+# TRUE is a semantic question no parser here can answer; that is what sent
+# the earlier literal-text approaches (flagging a named-but-missing filename)
+# to 3/3 false positives against the real corpus without even catching the
+# bug that motivated this check. So check 9 does the one thing git reliably
+# can: detect the change, and hand the auditor the slug and field to go read,
+# never a verdict on the claim itself. Always INFO, never FAIL.
+if repo_root is None:
+    emit_info(
+        "Check 9 skipped — no repo root above the skill directory",
+        "references/sources.md",
+        "No ancestor of the skill directory contains a .git entry, so there is no git history to diff "
+        "references/sources.md against. Check 9 did not run for any slug in this skill. "
+        "Run this script against a skill inside a checkout to get this check."
+    )
+else:
+    resolved_base_ref = base_ref_override.strip()
+    resolve_error = None
+    if not resolved_base_ref:
+        rc, mb_out, mb_err = run_git(["merge-base", "HEAD", "origin/main"], repo_root)
+        if rc == 0 and mb_out.strip():
+            resolved_base_ref = mb_out.strip()
+        else:
+            resolve_error = (
+                "`git merge-base HEAD origin/main` could not resolve a base ref"
+                + (f" ({mb_err.strip()})" if mb_err.strip() else "")
+                + " — there may be no origin/main remote, HEAD may be detached, or the clone may be shallow."
+            )
+    elif not ref_exists(resolved_base_ref, repo_root):
+        resolve_error = f"--base-ref value '{resolved_base_ref}' does not resolve to a commit in this repository."
+
+    if resolve_error:
+        emit_info(
+            "Check 9 skipped — no base ref could be resolved",
+            "references/sources.md",
+            resolve_error + " Check 9 did not run for any slug in this skill. "
+            "Pass --base-ref=<ref>, or set the VALIDATE_PROVENANCE_BASE_REF environment variable, "
+            "to compare against something other than origin/main."
+        )
+    else:
+        sources_md_relpath = os.path.relpath(sources_md_path, repo_root)
+        rc, old_sources_content, show_err = run_git(
+            ["show", f"{resolved_base_ref}:{sources_md_relpath}"], repo_root
+        )
+        if rc != 0:
+            # The base ref resolved fine but `git show <ref>:<path>` did not.
+            # That single return code covers two situations this check cannot
+            # tell apart, and only one of them is harmless:
+            #
+            #   the file genuinely did not exist at the base ref — the whole
+            #   sources.md is new, every entry in it is a creation, and there
+            #   is nothing check 9 could have flagged;
+            #
+            #   the path is not TRACKED under that name at the base ref — a
+            #   renamed skill directory, or a copy of the skill living
+            #   somewhere untracked or gitignored (an installed .claude/skills
+            #   tree is the everyday case).
+            #
+            # Treating both as "creation, nothing to flag" made the second one
+            # a silent, whole-skill skip: the same directory audited at its
+            # authoring path reported changed claims and at its deployed path
+            # reported nothing, with no way to tell that from a clean run.
+            # That is the exact fail-open this script's own header forbids —
+            # "never a silent skip" — so announce it once for the whole check
+            # and hand over git's own stderr, which is the only diagnostic
+            # that separates the two cases.
+            detail = show_err.strip().splitlines()
+            detail = detail[0] if detail else "git gave no reason"
+            emit_info(
+                f"Check 9 skipped — '{sources_md_relpath}' is not tracked at {resolved_base_ref}",
+                "references/sources.md",
+                f"`git show {resolved_base_ref}:{sources_md_relpath}` failed ({detail}). "
+                f"Either the file did not exist at that ref — in which case every entry is a "
+                f"creation and there was nothing to flag — or this path is not tracked under "
+                f"that name there: a renamed skill directory, or an untracked or gitignored copy "
+                f"of the skill such as a deployed .claude/skills/ tree. "
+                f"Check 9 did not run for any slug in this skill. "
+                f"Re-run against the tracked authoring path, or pass --base-ref=<ref> naming a "
+                f"commit where this path exists."
+            )
+            old_sources_content = None
+
+        if old_sources_content is not None:
+            for slug in unique_slugs:
+                changed_fields = []
+                removed_fields = []
+                for field_name in ("Description", "Contributing files"):
+                    old_value = parse_field_raw(old_sources_content, slug, field_name)
+                    new_value = parse_field_raw(sources_content, slug, field_name)
+                    if old_value is None and new_value is None:
+                        continue
+                    if old_value is None:
+                        # No earlier claim to compare against — a brand-new
+                        # entry, or a field that did not exist yet at the
+                        # base ref. That is a creation, not a change, and is
+                        # never flagged.
+                        continue
+                    if new_value is None:
+                        # The field existed at the base ref and is gone now.
+                        # This was folded into the creation skip above, which
+                        # justified only the other half: deleting a whole
+                        # '- **Description:**' line left NO finding anywhere —
+                        # no other check in this script requires the field, so
+                        # a claim could be removed as invisibly as it could be
+                        # strengthened. Announce it; the auditor decides
+                        # whether the removal was intended.
+                        removed_fields.append(field_name)
+                        continue
+                    if normalize_field_text(old_value) != normalize_field_text(new_value):
+                        changed_fields.append(field_name)
+                if removed_fields:
+                    removed_list = " and ".join(removed_fields)
+                    emit_info(
+                        f"'{removed_list}' removed for '{slug}' since {resolved_base_ref}",
+                        f"references/sources.md (## {slug})",
+                        f"The '## {slug}' entry had {removed_list} at {resolved_base_ref} and has "
+                        f"none now. Nothing else in this script requires the field, so the removal "
+                        f"is otherwise invisible. Confirm it was deliberate — a provenance claim "
+                        f"withdrawn is as much a change to the chain as one rewritten — and "
+                        f"restore the field if it was lost to an edit."
+                    )
+                if changed_fields:
+                    field_list = " and ".join(changed_fields)
+                    emit_info(
+                        f"'{field_list}' changed for '{slug}' since {resolved_base_ref}",
+                        f"references/sources.md (## {slug})",
+                        f"The '## {slug}' entry's {field_list} text differs from the version at "
+                        f"{resolved_base_ref}. This script can confirm the entry is internally "
+                        f"consistent, but it cannot verify whether the claim itself is still true — a "
+                        f"retrofit once turned an honest hedge into an unsupported confident claim and "
+                        f"every structural check here passed it silently. Re-read the upstream research "
+                        f"doc named in this entry's Research doc field and the Contributing files it "
+                        f"lists, and confirm by hand that the wording still holds."
+                    )
+
 print_findings()
 sys.exit(1 if has_fail else 0)
 PYTHON
diff --git a/plugins/kyberforge/skills/skill-audit/scripts/validate.sh b/plugins/kyberforge/skills/skill-audit/scripts/validate.sh
index e5ce8f3..d6f9b98 100755
--- a/plugins/kyberforge/skills/skill-audit/scripts/validate.sh
+++ b/plugins/kyberforge/skills/skill-audit/scripts/validate.sh
@@ -1289,6 +1289,50 @@ else:
     if desc:
         ok("description has no unfilled placeholders")
 
+# --- ADR-0022: metadata.version is mandatory -------------------------------
+# FAIL, not SUGGESTION, and the tier is set by the gate rather than by taste.
+# `.pre-commit-config.yaml`'s `skill-frontmatter` hook REJECTS a SKILL.md with
+# no `metadata.version`, and rejects a value that is not three-part semver.
+# skill-author's Step 4 says to run this audit and "resolve every FAIL", so any
+# tier below FAIL lets that step report done on a skill the commit gate then
+# refuses — the same audit-disagrees-with-the-gate failure the MAX_LINES note
+# below warns about, arrived at from the other direction. Verified before this
+# check existed: a SKILL.md with no `metadata:` block at all reported "All
+# checks passed".
+#
+# The rule is DUPLICATED from that hook for the same cache-isolation reason as
+# every other constant here — an installed plugin's scripts cannot read the
+# repo-root config. Keep the two in step: this check must accept exactly what
+# the hook accepts.
+SEMVER_RE = re.compile(r'^\d+\.\d+\.\d+$')
+
+try:
+    fm_data = yaml.safe_load(fm)
+except Exception:
+    # Unreachable in practice: description_value() above parses the same text
+    # and hard-exits on a YAML error, so anything arriving here already parsed.
+    fm_data = None
+metadata_block = fm_data.get('metadata') if isinstance(fm_data, dict) else None
+
+if not isinstance(metadata_block, dict) or metadata_block.get('version') is None:
+    fail("frontmatter has no metadata.version — ADR-0022 makes it mandatory for "
+         "every skill, and the skill-frontmatter pre-commit hook rejects the file "
+         "without it. Add `metadata:` / `  version: \"1.0.0\"` (new skills start "
+         "at \"0.1.0\")")
+else:
+    version_value = metadata_block['version']
+    # NOT str()-coerced blind: `version: 1.0` is a YAML float, and its "1.0"
+    # spelling is exactly the two-part value the hook rejects — coercing and
+    # then matching keeps this check and the hook agreeing on that case.
+    version_text = version_value if isinstance(version_value, str) else str(version_value)
+    version_text = version_text.strip()
+    if SEMVER_RE.match(version_text):
+        ok(f"metadata.version present: '{version_text}' (ADR-0022)")
+    else:
+        fail(f"metadata.version '{version_text}' is not three-part semver — the "
+             f"skill-frontmatter pre-commit hook rejects it. Use MAJOR.MINOR.PATCH, "
+             f"e.g. \"1.0.0\"")
+
 # SKILL.md size ceilings (agentskills.io skill-authoring.md: 500 lines,
 # ~5,000 tokens). Both constants are DUPLICATED from the repo-root pre-commit
 # hook scripts/skill-size-check.sh — a plugin skill's scripts cannot read files
@@ -1515,11 +1559,66 @@ def stdin_redirected(line, prev_line):
     unquoted = re.sub(r'"[^"]*"|\'[^\']*\'', '', line)
     return '<' in unquoted or prev_line.rstrip().endswith('|')
 
+# A here-doc body is DATA, not command position. Every script in this corpus
+# carries a `usage() { cat <<EOF ... EOF; }`, and prose wrapped inside one puts
+# ordinary English at the start of a line — "read is reported as an INFO ..."
+# in this skill's own validate-provenance.sh, which made skill-audit hard-FAIL
+# on its own script. Reflowing that one sentence would have cleared the finding
+# and left the cause: every future usage text is one wrap away from the same
+# false positive, and the remedy an author reaches for is contorting working
+# source, which the note above records has already happened twice.
+#
+# Detection is deliberately conservative in the direction that matters. A
+# here-doc body is skipped only when its terminator is actually found further
+# down the file; an opener with no terminator — the shape a stray `<<` inside a
+# string would produce — is ignored rather than allowed to swallow the tail,
+# because swallowing the tail is a false NEGATIVE and this check exists to fail
+# closed. `<<<` here-strings open nothing and are excluded by the lookbehind.
+HEREDOC_START_RE = re.compile(r'(?<!<)<<-?\s*(["\']?)([A-Za-z_][A-Za-z0-9_]*)\1')
+
+
+def heredoc_delimiter(line):
+    """The here-doc terminator this line opens, or None."""
+    m = HEREDOC_START_RE.search(line)
+    return m.group(2) if m else None
+
+
+def heredoc_body_indices(lines):
+    """Line indices that are here-doc BODY (plus its terminator), not code."""
+    skip = set()
+    i, n = 0, len(lines)
+    while i < n:
+        stripped = lines[i].strip()
+        delim = None if stripped.startswith('#') else heredoc_delimiter(lines[i])
+        if delim:
+            # `<<-` allows an indented terminator, so compare stripped.
+            for j in range(i + 1, n):
+                if lines[j].strip() == delim:
+                    skip.update(range(i + 1, j + 1))
+                    i = j
+                    break
+        i += 1
+    return skip
+
+
+# The here-doc exemption applies to the `read` heuristic ONLY, and the
+# asymmetry is the point. `read` is an ordinary English verb, so any prose a
+# script prints is one line-wrap away from opening with it. `input(` is not a
+# word — a line beginning `input(` inside a here-doc is an embedded Python
+# program pausing for a keypress, which is exactly what this check is for, and
+# these scripts embed Python in a here-doc as a matter of course. Exempting the
+# whole body would have disarmed the check across every script in the corpus.
 def interactive_reads(source):
     hits = []
     prev_line = ''
-    for line in source.splitlines():
+    lines = source.splitlines()
+    in_heredoc = heredoc_body_indices(lines)
+    for idx, line in enumerate(lines):
         stripped = line.strip()
+        if idx in in_heredoc:
+            if re.match(r'input\(', stripped):
+                hits.append(stripped)
+            continue
         if re.match(r'read(\s|$)', stripped):
             if not stdin_redirected(line, prev_line):
                 hits.append(stripped)
diff --git a/plugins/kyberforge/skills/skill-author/README.md b/plugins/kyberforge/skills/skill-author/README.md
index f169f44..53e49d7 100644
--- a/plugins/kyberforge/skills/skill-author/README.md
+++ b/plugins/kyberforge/skills/skill-author/README.md
@@ -4,7 +4,7 @@ Author and refine skills conforming to the [agentskills.io](https://agentskills.
 
 ## What it does
 
-Routes to one of two flows based on context: if no skill directory exists at the target path, it scaffolds the directory from annotated templates, fills in `SKILL.md` and supporting files, and validates the result. If an existing skill directory and improvement signals are both present, it groups those signals by root cause and applies targeted edits, then re-validates. In both flows, bumps the skill's `metadata.version` when present (minor for create, patch for improve).
+Routes to one of two flows based on context: if no skill directory exists at the target path, it scaffolds the directory from annotated templates, fills in `SKILL.md` and supporting files, and validates the result. If an existing skill directory and improvement signals are both present, it groups those signals by root cause and applies targeted edits, then re-validates. In both flows, bumps the skill's `metadata.version` — minor for create, patch for improve — which every skill carries (ADR-0022).
 
 `SKILL.md` itself carries only the dispatch table, the invocation-axis decision, the contract gates and the shared close; each flow lives in its own self-contained reference file, per ADR-0020.
 
diff --git a/plugins/kyberforge/skills/skill-author/SKILL.md b/plugins/kyberforge/skills/skill-author/SKILL.md
index 33228c5..80ecb37 100644
--- a/plugins/kyberforge/skills/skill-author/SKILL.md
+++ b/plugins/kyberforge/skills/skill-author/SKILL.md
@@ -6,6 +6,7 @@ description: >
   Not read-only review -> `skill-audit`. Not agent files -> `agent-author`.
 allowed-tools: Bash Read Write Edit
 metadata:
+  version: "1.0.1"
   category: factory
   source_keys:
     - agentskills-home
@@ -33,7 +34,7 @@ metadata:
 
 Signals: grill output, `/skill-audit` findings, inline feedback, eval results, session context describing what went wrong. With none, ask whether the user meant to create a new skill or has feedback to apply.
 
-Read only the reference matching the resolved flow — each is self-contained. If the target sits inside a git worktree, capture `git log --oneline -1` before touching the filesystem; Step 4 needs it.
+Read only the reference matching the resolved flow — each is self-contained. If the target sits inside a git worktree, capture `rtk git log --oneline -1` before touching the filesystem; Step 4 needs it.
 
 ## Step 2 — Invocation axis
 
@@ -56,6 +57,6 @@ Gates `/skill-audit` enforces in both flows:
 
 Run `/skill-audit` on the resolved skill directory; resolve every FAIL before reporting done. It checks name-to-directory match, placeholders, both size budgets, boundary-target resolution and script hygiene — do not hand-check those. Hand-check the one thing it misses: an empty body reports `PASS  SKILL.md body word count 0 (ADR-0020 target: 600)`, so confirm at least one non-empty section exists.
 
-With `metadata.version` present, bump the **minor** version on create (new skills start at `0.1.0`) and the **patch** version on improve.
+Bump `metadata.version`: the **minor** version on create (new skills start at `0.1.0`) and the **patch** version on improve.
 
-**Commit verification.** Inside a git worktree: once the audit is clean, run `git add` and `git commit` — do not stop at staging. Re-run `git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is silently lost if the tree is cleaned up. Report done only once the hash has changed. Outside a worktree (a skill under `~/.claude/skills/`, say) nothing is committable — report done on a clean audit, naming that as the reason.
+**Commit verification.** Inside a git worktree: once the audit is clean, run `rtk git add` and `rtk git commit` — do not stop at staging. Re-run `rtk git log --oneline -1` and confirm the hash changed from Step 1's. A non-empty `git diff --stat` is not proof: staged-but-uncommitted work is part of no commit and is silently lost if the tree is cleaned up. Report done only once the hash has changed. Outside a worktree (a skill under `~/.claude/skills/`, say) nothing is committable — report done on a clean audit, naming that as the reason.
diff --git a/plugins/kyberforge/skills/skill-author/assets/templates/SKILL.md b/plugins/kyberforge/skills/skill-author/assets/templates/SKILL.md
index 81b03d9..7fc910c 100644
--- a/plugins/kyberforge/skills/skill-author/assets/templates/SKILL.md
+++ b/plugins/kyberforge/skills/skill-author/assets/templates/SKILL.md
@@ -45,14 +45,18 @@ description: >
 # Optional. 1–500 characters. State tool requirements, runtime versions,
 # and network access needs. Omit for skills with no special environment requirements.
 
-# metadata:
+metadata:
+  version: "0.1.0"
 #   author: your-name
-#   version: "1.0"
 #   category: general
 #   source_keys:
 #     - source-slug-one
 #     - source-slug-two
-# Optional. Arbitrary key-value map. Common keys: author, version, category.
+# `metadata.version` is REQUIRED on every skill (ADR-0022) and is enforced by the
+# `skill-frontmatter` pre-commit hook. Three-component semver. A newly created
+# skill starts at "0.1.0" — leave the seeded value as it is; "1.0.0" is the seed
+# for a pre-existing skill retrofitted into the rule, not for a new one.
+# The rest of the map is optional: author, category, source_keys.
 # source_keys: populated when built from /research output. Lists slugs from references/sources.md.
 # Also add source_keys to each references/*.md file that was informed by research.
 
diff --git a/plugins/kyberforge/skills/skill-author/references/create.md b/plugins/kyberforge/skills/skill-author/references/create.md
index 677425b..984a45e 100644
--- a/plugins/kyberforge/skills/skill-author/references/create.md
+++ b/plugins/kyberforge/skills/skill-author/references/create.md
@@ -84,8 +84,10 @@ already covers the new skill. Use Read/Edit directly on `apm.yml`; this is not p
 ## Step 3 — Fill in SKILL.md
 
 Open the new skill's `SKILL.md` (the path Step 1 printed) and replace every `FILL IN:`
-placeholder. The scaffold template already carries the compliant frontmatter and body skeleton —
-fill it rather than restructuring it.
+placeholder. The scaffold template carries the ADR-0020 body skeleton and the two frontmatter
+fields that cannot be left as placeholders — `name`, substituted by the script, and
+`metadata.version`, seeded live at `"0.1.0"` — so fill the template in rather than restructuring
+it.
 
 **`name`** — already set by the scaffold script. Must exactly match the directory name. Format:
 1–64 characters, lowercase letters, numbers and hyphens only; no leading, trailing or consecutive
@@ -96,13 +98,18 @@ against `references/contract.md`, which holds the three-part shape, the banned c
 boundary-clause form and the length tiers. A hand-invoked skill (`SKILL.md` Step 2) takes one
 plain sentence and `disable-model-invocation: true` instead.
 
+**`metadata.version`** — required on every skill (ADR-0022), not a per-skill or per-plugin choice,
+and enforced by the `skill-frontmatter` pre-commit hook. The scaffold seeds a new skill at
+`"0.1.0"`; leave that value alone here and let `SKILL.md` Step 4 bump it. (`"1.0.0"` is the seed
+for a pre-existing skill retrofitted into the rule, and never applies to a skill created here.)
+
 **Optional frontmatter** — uncomment and fill in, or remove entirely:
 
 - `license` — include when distributing the skill externally
 - `compatibility` — include if the skill requires specific tools, runtimes, or network access
   (max 500 characters)
-- `metadata` — key-value map; use `author`, `version`, `category`; add `source_keys` now (Step 6)
-  if research sources are in context
+- `metadata` — the rest of the map, all of it optional: `author` and `category`, plus `source_keys`
+  now (Step 6) if research sources are in context
 - `allowed-tools` — space-separated pre-approved tools; reduces permission prompts (experimental —
   support varies by client)
 - `disable-model-invocation` — hand-invoked skills only
diff --git a/plugins/kyberforge/skills/skill-author/references/improve.md b/plugins/kyberforge/skills/skill-author/references/improve.md
index ffdf625..feda975 100644
--- a/plugins/kyberforge/skills/skill-author/references/improve.md
+++ b/plugins/kyberforge/skills/skill-author/references/improve.md
@@ -85,6 +85,10 @@ improvise the cuts — four dry runs invented six to ten different answers to th
 If a signal points to a script or reference file, edit that file directly rather than adding a
 workaround in SKILL.md.
 
+**A skill carrying no `metadata.version` is seeded at `"1.0.0"`, not bumped** — `SKILL.md` Step 4's
+patch bump presumes a version to bump, and ADR-0022 reserves `"0.1.0"` for a newly created skill.
+`references/retrofit.md` carries the reasoning.
+
 **Check for regressions before handing back.** `SKILL.md` Step 4 tells you to resolve every FAIL,
 which says nothing about a check that passed *before* these edits and no longer does. Compare the
 closing audit against the skill's pre-edit state — a PASS that has become a SUGGESTION, or a
diff --git a/plugins/kyberforge/skills/skill-author/references/retrofit.md b/plugins/kyberforge/skills/skill-author/references/retrofit.md
index 37fa55d..0755773 100644
--- a/plugins/kyberforge/skills/skill-author/references/retrofit.md
+++ b/plugins/kyberforge/skills/skill-author/references/retrofit.md
@@ -106,6 +106,37 @@ them for you. After every retrofit that adds, removes or renames a file:
 - [ ] Re-run `/skill-audit` and confirm its `### Provenance` dimension does not report the new
       file as missing `source_keys`.
 
+## Compression must not add authority the source text didn't have
+
+This one is **not** part of the checklist above, and deliberately so: it fires on a wording change
+with no file change at all, so a retrofit that adds and removes nothing still owes it.
+
+The `sources.md` bullet above is about an entry going *stale* — Contributing files left uncited
+after content moves. This is a distinct failure: a compression or rewrite pass that upgrades an
+honest hedge in a Description into an unsupported confident claim, without the underlying source
+having changed at all — "no forge-specific content drawn directly from it beyond that" quietly
+becoming "Grounds Step 2's dispatch table."
+
+`/skill-audit`'s provenance script does now notice this class: it diffs each slug's `Description`
+and `Contributing files` text against a base ref and raises an **INFO** when the wording changed.
+That is a prompt, not a verdict — it reports only *that* the claim moved, never whether the new
+claim is true, because a bash script can verify an entry is internally consistent and nothing more.
+Answering it is this flow's job: if a retrofit strengthens or otherwise changes the wording of a
+provenance claim, re-read the upstream research doc first and confirm the stronger wording is
+actually still true before committing it.
+
+## Versioning a retrofitted skill
+
+`SKILL.md` Step 4 says to bump the **patch** version on improve, which presumes there is a version
+to bump. A pre-ADR-0020 skill often carries none — `metadata.version` only became mandatory under
+ADR-0022, and this flow is exactly where those skills surface.
+
+A skill with no `metadata.version` is **seeded at `"1.0.0"`, not bumped**. `"0.1.0"` is reserved
+for a skill created new by the create flow: it means "created and never yet revised", which
+understates a skill that has been through retrofit and audit passes without tracking a version.
+Add the field in this retrofit — the `skill-frontmatter` pre-commit hook blocks the commit without
+it.
+
 ## Worked example — a description retrofit
 
 `gitea-issues` before, 827 characters, the single most common shape in the corpus:
diff --git a/scripts/check-rtk-prefix.sh b/scripts/check-rtk-prefix.sh
new file mode 100755
index 0000000..7b2ca2c
--- /dev/null
+++ b/scripts/check-rtk-prefix.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ADR-0023 clause 1, and ONLY clause 1: an executable, instructed local git
+# command in plugin skill or agent content is written `rtk git`, never bare
+# `git`.
+#
+# WHY THIS IS NARROW ON PURPOSE. ADR-0023 has three clauses, and only the first
+# is machine-decidable:
+#
+#   1. executable + instructed  -> `rtk git`     <- this hook
+#   2. illustrative/referential -> bare `git`    <- undecidable, not gated
+#   3. machine-parsed or interactive -> bare `git`, marked <- opt-out, below
+#
+# Clause 2 is a judgement about what a sentence is doing, not a pattern. "`git
+# switch` refuses rather than clobbering conflicting local edits" and "run `git
+# switch <branch>`" are the same token sequence in prose. A gate that guessed
+# would fire on every doc paragraph in the corpus, and a gate that fires on
+# correct content gets disabled. So this hook looks only at the two places where
+# a `git` mention is unambiguously an instruction to execute:
+#
+#   (a) a line inside a fenced code block whose info string names a shell
+#       (bash / sh / shell / zsh / console);
+#   (b) the OPENING backticked span of a "Run" column cell in a markdown
+#       dispatch table -- and only the opening span.
+#
+# (b) is that narrow because a Run cell routinely carries a command followed by
+# prose about it, and that prose is clause 2. git-worktrees/SKILL.md has both
+# shapes on adjacent rows: a cell reading `rtk git worktree add --track ...` --
+# always correct. `git worktree add <path> <branch>` expands to exactly this
+# (instruction first, reference second), and a `**Never** ...` row whose Run cell
+# is entirely explanatory prose containing a bare `git push`. Checking every span
+# flags both; checking only a leading span flags neither, and still catches the
+# ordinary `| List | `git worktree list -v` |` case this gate exists for.
+#
+# Prose bullets, prose-leading Run cells, table cells outside a Run column, and
+# fences tagged `text`, `yaml`, `json` etc. are NOT checked. That is a real
+# coverage gap, recorded in docs/spec/gates.md rather than papered over.
+#
+# CLAUSE-3 OPT-OUT. A site that is deliberately bare because rtk rewrites the
+# output the skill parses, or because the command is interactive, is exempted by
+# putting the literal string `ADR-0023` on the SAME LINE — in a shell comment for
+# a code line, in the cell text for a table row. Per-line, never per-block: a
+# fenced block routinely mixes `rtk git` steps with one deliberately-bare
+# command (references/push.md does exactly that), and a block-level marker would
+# silently disarm the checked lines around the marked one.
+#
+# The marker is a bare substring match, so a line that merely *mentions*
+# ADR-0023 for an unrelated reason is also exempt. That is accepted: the marker
+# is an author's deliberate opt-out, not a security boundary, and a stricter
+# form would only move the same trust to a different string.
+
+if [[ $# -eq 0 ]]; then
+  exit 0
+fi
+
+if ! command -v python3 > /dev/null 2>&1; then
+  echo "ERROR: python3 is required for the ADR-0023 rtk-prefix gate but was not found on PATH." >&2
+  echo "  Fix: install python3 (pre-commit itself is a Python application, so it is almost certainly already present)." >&2
+  exit 1
+fi
+
+# No PyYAML here, unlike skill-size-check.sh: this gate never reads frontmatter,
+# only the markdown body, so it has no folded scalar to measure.
+exec python3 -u - "$@" <<'PY'
+import re
+import sys
+
+MARKER = "ADR-0023"
+SHELL_INFO = {"bash", "sh", "shell", "zsh", "console", "shell-session"}
+
+FENCE_OPEN = re.compile(r"^\s*(?P<f>`{3,}|~{3,})\s*(?P<info>[^\s`]*)")
+ASSIGNMENT = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=\S*\s+")
+# Shell separators that begin a fresh command word.
+SPLIT = re.compile(r"(?:\|\||&&|[;|&\n]|\$\(|`|\()")
+BACKTICKED = re.compile(r"`([^`]+)`")
+
+
+def strip_shell_comment(line: str) -> str:
+    """Drop a trailing `#` comment, ignoring `#` inside single/double quotes."""
+    out = []
+    quote = None
+    prev = ""
+    for ch in line:
+        if quote:
+            if ch == quote and prev != "\\":
+                quote = None
+        elif ch in "'\"":
+            quote = ch
+        elif ch == "#" and (not out or out[-1].isspace()):
+            break
+        out.append(ch)
+        prev = ch
+    return "".join(out)
+
+
+def bare_git_in_shell(code: str) -> bool:
+    for segment in SPLIT.split(code):
+        seg = segment.lstrip()
+        if seg.startswith("$ "):          # a copied prompt
+            seg = seg[2:].lstrip()
+        while True:                        # VAR=x VAR2=y git ...
+            m = ASSIGNMENT.match(seg)
+            if not m:
+                break
+            seg = seg[m.end():]
+        if re.match(r"git(\s|$)", seg):
+            return True
+    return False
+
+
+def run_column(header: str):
+    """Index of the 'Run' column in a markdown header row, or None."""
+    cells = [c.strip().strip("`*_ ").lower() for c in header.strip().strip("|").split("|")]
+    return cells.index("run") if "run" in cells else None
+
+
+def check(path: str):
+    problems = []
+    try:
+        lines = open(path, encoding="utf-8").read().splitlines()
+    except (OSError, UnicodeDecodeError) as exc:
+        # Unreadable is an error, never a silent pass.
+        return [(0, f"could not read file: {exc}")]
+
+    fence = None          # closing marker of the open fence, or None
+    fence_is_shell = False
+    run_col = None        # active Run-column index, or None
+    pending_header = None
+
+    for n, raw in enumerate(lines, start=1):
+        if fence is not None:
+            if re.match(r"^\s*" + re.escape(fence) + r"\s*$", raw):
+                fence, fence_is_shell = None, False
+                continue
+            if fence_is_shell and MARKER not in raw:
+                if bare_git_in_shell(strip_shell_comment(raw)):
+                    problems.append((n, raw.strip()))
+            continue
+
+        m = FENCE_OPEN.match(raw)
+        if m:
+            fence = m.group("f")
+            fence_is_shell = m.group("info").lower() in SHELL_INFO
+            run_col, pending_header = None, None
+            continue
+
+        stripped = raw.strip()
+        if not stripped.startswith("|"):
+            run_col, pending_header = None, None
+            continue
+
+        # A markdown table: header row, delimiter row, then data rows.
+        if run_col is None:
+            if pending_header is not None and set(stripped) <= set("|-: "):
+                run_col = run_column(pending_header)
+                pending_header = None
+            else:
+                pending_header = stripped
+                run_col = None
+            continue
+
+        if MARKER in raw:
+            continue
+        cells = stripped.strip("|").split("|")
+        if run_col >= len(cells):
+            continue
+        cell = cells[run_col].strip()
+        # Only a cell that OPENS with a backticked command is a dispatch entry.
+        # A cell opening with prose is explanation, and explanation is clause 2.
+        if not cell.startswith("`"):
+            continue
+        opening = BACKTICKED.match(cell)
+        if opening and re.match(r"git(\s|$)", opening.group(1).strip()):
+            problems.append((n, opening.group(1).strip()))
+
+    return problems
+
+
+failed = False
+for path in sys.argv[1:]:
+    for line_no, text in check(path):
+        failed = True
+        print(
+            f"ADR-0023: {path}:{line_no}: executable git command is not prefixed with `rtk`: {text}",
+            file=sys.stderr,
+        )
+
+if failed:
+    print("", file=sys.stderr)
+    print(
+        "Fix: write `rtk git <subcommand>` (ADR-0023 clause 1). If this command must stay bare\n"
+        "because rtk rewrites output the skill parses, or because it is interactive (clause 3),\n"
+        "say so inline and put the literal string ADR-0023 on the same line to record the opt-out.",
+        file=sys.stderr,
+    )
+    sys.exit(1)
+PY
diff --git a/tests/test-adr0020-contract.sh b/tests/test-adr0020-contract.sh
index 1a2dc36..abfd603 100755
--- a/tests/test-adr0020-contract.sh
+++ b/tests/test-adr0020-contract.sh
@@ -224,6 +224,8 @@ cat > "$SUBJECT_SKILL_DIR/SKILL.md" <<'EOF'
 ---
 name: my-skill
 description: A short valid description. Do not use for anything else.
+metadata:
+  version: "1.0.0"
 ---
 
 Do the thing.
diff --git a/tests/test-check-rtk-prefix.sh b/tests/test-check-rtk-prefix.sh
new file mode 100644
index 0000000..580bc4f
--- /dev/null
+++ b/tests/test-check-rtk-prefix.sh
@@ -0,0 +1,224 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Tests for scripts/check-rtk-prefix.sh — ADR-0023 clause 1.
+#
+# Case 1 is the one that earns the rest: it runs the gate against the corpus as
+# it stood on `main` BEFORE the #113 sweep, and asserts it fails there. A gate
+# that only passes on the already-fixed tree proves nothing about whether it
+# would have caught the drift it was written for.
+#
+# Everything after that is synthetic. The false-NEGATIVE cases (a bare command
+# the gate must catch) and the false-POSITIVE cases (correct content the gate
+# must leave alone) carry equal weight: this hook's failure mode is not missing
+# a violation, it is firing on deliberately-bare clause-2 and clause-3 content
+# until someone adds it to SKIP.
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCRIPT="$REPO_ROOT/scripts/check-rtk-prefix.sh"
+PASS=0
+FAIL=0
+
+pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+if ! command -v python3 >/dev/null 2>&1; then
+  echo "SKIP: python3 is not installed — the script under test fails closed on it, so every case here would only re-assert the missing-dependency guard"
+  exit 77
+fi
+
+RUN_TMP="$(mktemp -d)"
+trap 'rm -rf "$RUN_TMP"' EXIT
+
+# Writes $2 to a .md file and asserts the gate's verdict. $1 is "clean" or
+# "dirty"; $3 is the case description.
+expect() {
+  local want="$1" body="$2" desc="$3"
+  local f="$RUN_TMP/case.md"
+  printf '%s\n' "$body" > "$f"
+  local rc=0
+  bash "$SCRIPT" "$f" > "$RUN_TMP/out" 2>&1 || rc=$?
+  if [[ "$want" == "dirty" && $rc -eq 0 ]]; then
+    fail "$desc — expected a violation, exited 0"
+  elif [[ "$want" == "clean" && $rc -ne 0 ]]; then
+    fail "$desc — expected no violation, exited $rc"
+    sed 's/^/    /' "$RUN_TMP/out"
+  else
+    pass "$desc"
+  fi
+}
+
+echo "--- the pre-#113 corpus on main trips the gate ---"
+
+# Derived from git, not hardcoded: the point is "the drift this gate exists for",
+# and a hardcoded path list goes stale the moment a file is renamed.
+if ! git -C "$REPO_ROOT" rev-parse --verify -q main >/dev/null; then
+  echo "SKIP: no local 'main' ref — the historical-corpus case cannot be reconstructed"
+  exit 77
+fi
+
+PRE="$RUN_TMP/pre"
+# A read loop, not the bash-4 array builtin: tests/test-vale-wrap.sh scans every
+# script under tests/ for bash-4-only constructs, because these run on macOS's
+# bash 3.2. Same reason for the `[@]+` guards on every array expansion below.
+PRE_FILES=()
+PRE_PATHS=()
+while IFS= read -r PRE_REL; do
+  PRE_FILES+=("$PRE_REL")
+  PRE_PATHS+=("$PRE/$PRE_REL")
+done < <(
+  git -C "$REPO_ROOT" ls-tree -r --name-only main -- 'plugins' \
+    | grep -E '^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$' \
+    | grep -v '/README\.md$'
+)
+if [[ ${#PRE_FILES[@]} -eq 0 ]]; then
+  fail "no plugin skill/agent files found on main — the historical case checked nothing"
+else
+  for f in ${PRE_FILES[@]+"${PRE_FILES[@]}"}; do
+    mkdir -p "$PRE/$(dirname "$f")"
+    git -C "$REPO_ROOT" show "main:$f" > "$PRE/$f"
+  done
+  if bash "$SCRIPT" ${PRE_PATHS[@]+"${PRE_PATHS[@]}"} > "$RUN_TMP/pre.out" 2>&1; then
+    fail "the pre-sweep corpus passed — the gate would not have caught the #113 drift"
+  else
+    hits="$(grep -c '^ADR-0023: ' "$RUN_TMP/pre.out" || true)"
+    if [[ "$hits" -lt 20 ]]; then
+      fail "the pre-sweep corpus produced only $hits findings — too few to be the known drift"
+    elif ! grep -q 'gitea-issues/SKILL.md.*git remote get-url origin' "$RUN_TMP/pre.out"; then
+      fail "the pre-sweep corpus failed, but not on the known gitea drift"
+      sed 's/^/    /' "$RUN_TMP/pre.out" | head -5
+    else
+      pass "the pre-sweep corpus fails with $hits findings, including the gitea sweep gap"
+    fi
+  fi
+fi
+
+echo ""
+echo "--- shell fences: what must fail ---"
+
+expect dirty '```bash
+git commit -m "x"
+```' "a bare git command in a bash fence"
+
+expect dirty '```sh
+rtk git add -u && git commit -m "x"
+```' "a bare git after && on a line that starts with rtk git"
+
+expect dirty '```bash
+SKIP=check-yaml git commit -m "x"
+```' "a bare git behind an environment-variable prefix"
+
+expect dirty '```bash
+url=$(git config remote.origin.url)
+```' "a bare git inside a command substitution"
+
+expect dirty '```console
+$ git status
+```' "a bare git behind a copied shell prompt"
+
+echo ""
+echo "--- shell fences: what must NOT fail ---"
+
+expect clean '```bash
+rtk git commit -m "x"
+rtk git push
+```' "prefixed commands"
+
+expect clean '```bash
+git stash list   # bare per ADR-0023: rtk prints "No stashes" where git prints nothing
+```' "a bare command carrying the ADR-0023 opt-out marker"
+
+expect clean '```text
+git worktree list --porcelain -z
+```' "a non-shell fence (text) is out of scope"
+
+expect clean '```yaml
+entry: git
+```' "a yaml fence is out of scope"
+
+expect clean '```bash
+# never reach for git commit --no-verify here
+rtk git commit
+```' "a bare git inside a shell comment"
+
+expect clean 'Run `git switch <branch>` — no wait, this is prose, not a fence.' \
+  "a bare git in a prose line outside any fence"
+
+echo ""
+echo "--- dispatch tables ---"
+
+expect dirty '| Operation | Run |
+|---|---|
+| List | `git worktree list -v` |' "a bare command opening a Run cell"
+
+expect clean '| Operation | Run |
+|---|---|
+| List | `rtk git worktree list -v` |' "a prefixed command in a Run cell"
+
+expect clean '| Operation | Run |
+|---|---|
+| List | `git worktree list -v` — bare per ADR-0023 |' \
+  "a bare Run cell carrying the opt-out marker"
+
+# The clause-2 shapes that made an every-span check unusable. Both are real rows
+# from git-worktrees/SKILL.md.
+expect clean '| Operation | Run |
+|---|---|
+| Track | `rtk git worktree add --track -b <b> <p> <r>/<b>` — always correct. `git worktree add <p> <b>` expands to exactly this |' \
+  "a referential bare mention AFTER the instructed command in a Run cell"
+
+expect clean '| Operation | Run |
+|---|---|
+| **Never** `git worktree add <p> <r>/<b>` | That ref resolves, so `git push` needs an explicit refspec |' \
+  "an anti-pattern row whose Run cell opens with prose"
+
+expect clean '| Flag | Meaning |
+|---|---|
+| `-L` | as in `git log -L` |' "a table with no Run column is out of scope"
+
+echo ""
+echo "--- degenerate inputs ---"
+
+expect clean '' "an empty file"
+
+expect clean '```bash
+rtk git status' "an unterminated fence does not crash the parser"
+
+if bash "$SCRIPT" > "$RUN_TMP/noargs.out" 2>&1; then
+  pass "no filenames exits 0 rather than erroring"
+else
+  fail "no filenames should exit 0 — pre-commit calls hooks with an empty file list"
+fi
+
+if bash "$SCRIPT" "$RUN_TMP/does-not-exist.md" > "$RUN_TMP/missing.out" 2>&1; then
+  fail "an unreadable file exited 0 — unreadable must be an error, never a silent pass"
+elif ! grep -q 'could not read file' "$RUN_TMP/missing.out"; then
+  fail "an unreadable file failed for the wrong reason"
+  sed 's/^/    /' "$RUN_TMP/missing.out"
+else
+  pass "an unreadable file exits 1 and says so"
+fi
+
+echo ""
+echo "--- the live corpus is clean ---"
+
+LIVE=()
+while IFS= read -r LIVE_REL; do
+  LIVE+=("$LIVE_REL")
+done < <(
+  git -C "$REPO_ROOT" ls-files -- 'plugins' \
+    | grep -E '^plugins/[^/]+/\.apm/(skills/.*\.md|agents/.*\.agent\.md)$' \
+    | grep -v '/README\.md$'
+)
+if [[ ${#LIVE[@]} -eq 0 ]]; then
+  fail "no plugin skill/agent files matched the hook's files: pattern"
+elif (cd "$REPO_ROOT" && bash "$SCRIPT" ${LIVE[@]+"${LIVE[@]}"} > "$RUN_TMP/live.out" 2>&1); then
+  pass "the ${#LIVE[@]} in-scope corpus files pass"
+else
+  fail "the live corpus has ADR-0023 clause-1 violations"
+  sed 's/^/    /' "$RUN_TMP/live.out"
+fi
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[[ $FAIL -eq 0 ]]
diff --git a/tests/test-skill-frontmatter.sh b/tests/test-skill-frontmatter.sh
new file mode 100644
index 0000000..f9de65c
--- /dev/null
+++ b/tests/test-skill-frontmatter.sh
@@ -0,0 +1,366 @@
+#!/usr/bin/env bash
+# Regression test for the `skill-frontmatter` pre-commit hook.
+#
+# The hook is `entry: bash` with `args: ['-c', <script>, <arg0>]`, and this file
+# drives that exact call shape -- read out of .pre-commit-config.yaml, never
+# re-implemented here. That is the whole point. `grep -rn skill-frontmatter
+# tests/` returned nothing before this file existed, and the two defect classes
+# below are both invisible to a test that copies the script body and calls it
+# some other way:
+#
+#   1. THE POSITIONAL DROP. `bash -c <script> fileA fileB` puts fileA in $0, not
+#      in "$@". The hook had no arg0 placeholder, so pre-commit's FIRST filename
+#      was swallowed -- and a single-file commit, the normal case, ran the loop
+#      body zero times and reported Passed having checked nothing. A test that
+#      sources or inlines the script never sees this; only the real invocation
+#      shape does. Cases 2 and 3 below are that regression.
+#
+#   2. THE UNSCOPED GREP. The checks used to run over the WHOLE file, and the
+#      version check was `grep -A10 "^metadata:" | grep -q "  version:"`. Four
+#      confirmed ways to pass while measuring nothing, all pinned below:
+#        * `metadata:` in a BODY code fence satisfies it (skill-author's own
+#          docs quote exactly such a block);
+#        * `-A10` runs past the end of the metadata block, so a `version:`
+#          belonging to a following `source:` list entry satisfies it
+#          (write-docs and research both have `source:` right after `metadata:`);
+#        * `"  version:"` is an unanchored substring, so `    version:` at a
+#          deeper nesting satisfies it;
+#        * and the mirror image, a false NEGATIVE: a metadata block with more
+#          than 10 lines before `version:` was reported missing.
+#
+# Plus the semver assertion, which is not redundant with presence: write-docs
+# carried `version: "1.0"` -- present, well-nested, and not a version -- through
+# an entire PR under a check that only ever asked whether the key was there.
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CONFIG="$REPO_ROOT/.pre-commit-config.yaml"
+PASS=0
+FAIL=0
+
+pass() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+fail() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+# Same guard shape as tests/test-check-executables-allow-sync.sh: the hook
+# definition is YAML and reading it any other way is guessing. README.md lists
+# python3/PyYAML as a pre-push prerequisite, and `run-tests.sh --strict` turns
+# this skip into a failure, which is the correct reading when it runs as a gate.
+command -v python3 > /dev/null 2>&1 || { echo "SKIP: python3 is required to read the hook definition out of .pre-commit-config.yaml"; exit 77; }
+python3 -c 'import yaml' > /dev/null 2>&1 || { echo "SKIP: PyYAML is required to read the hook definition out of .pre-commit-config.yaml"; exit 77; }
+
+TMPDIR_T="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_T"' EXIT
+
+# ---------------------------------------------------------------------------
+# The hook, as pre-commit will run it
+# ---------------------------------------------------------------------------
+# ENTRY and ARGS come straight out of the config. run_hook() then reproduces
+# pre-commit's own composition -- entry, then args, then the filenames appended
+# LAST -- so the positional handling under test is the real one.
+HOOK_JSON="$TMPDIR_T/hook.json"
+python3 - "$CONFIG" "$HOOK_JSON" <<'PY'
+import json
+import sys
+
+import yaml
+
+config_path, out_path = sys.argv[1:3]
+with open(config_path, encoding='utf-8') as fh:
+    cfg = yaml.safe_load(fh) or {}
+
+found = None
+for repo in cfg.get('repos') or []:
+    for hook in repo.get('hooks') or []:
+        if hook.get('id') == 'skill-frontmatter':
+            found = hook
+
+if found is None:
+    sys.exit("skill-frontmatter hook not found in " + config_path)
+
+with open(out_path, 'w', encoding='utf-8') as fh:
+    json.dump(
+        {
+            'entry': found.get('entry'),
+            'args': found.get('args') or [],
+            'files': found.get('files'),
+            'pass_filenames': found.get('pass_filenames', True),
+            'always_run': found.get('always_run', False),
+        },
+        fh,
+    )
+PY
+
+# Reads NUL-delimited fields on stdin into the named array. bash 3.2 (macOS) has
+# no `mapfil[e]`/`readarra[y]` builtin, and tests/test-vale-wrap.sh's static scan
+# rejects both — the bracket classes above match what a bare spelling would while
+# keeping one out of this file, the same trick that file uses for `npro[c]`.
+read_nul_array() {
+  local __var="$1"
+  shift
+  local __item
+  eval "$__var=()"
+  while IFS= read -r -d '' __item; do
+    eval "$__var+=(\"\$__item\")"
+  done
+}
+
+ENTRY="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["entry"])' "$HOOK_JSON")"
+ARGS=()
+read_nul_array ARGS < <(python3 -c '
+import json
+import sys
+
+data = json.load(open(sys.argv[1]))
+for arg in data["args"]:
+    sys.stdout.write(arg + "\0")
+' "$HOOK_JSON")
+
+RUN_OUT=""
+RUN_RC=0
+# run_hook <file>... -- exactly `entry args... files...`, pre-commit's ordering.
+run_hook() {
+  RUN_RC=0
+  RUN_OUT="$("$ENTRY" ${ARGS[@]+"${ARGS[@]}"} "$@" 2>&1)" || RUN_RC=$?
+}
+
+# write_skill <path> <frontmatter-body> [markdown-body]
+write_skill() {
+  local path="$1" frontmatter="$2" body="${3:-# Heading
+
+Body text.}"
+  mkdir -p "$(dirname "$path")"
+  {
+    printf -- '---\n'
+    printf '%s\n' "$frontmatter"
+    printf -- '---\n\n'
+    printf '%s\n' "$body"
+  } > "$path"
+}
+
+VALID_FM='name: valid-skill
+description: A skill whose frontmatter is complete and well formed.
+metadata:
+  version: "1.0.0"'
+
+assert_passes() { # <label> <file>...
+  local label="$1"
+  shift
+  run_hook "$@"
+  if [[ $RUN_RC -eq 0 ]]; then
+    pass "$label"
+  else
+    fail "$label -- expected exit 0, got $RUN_RC. Output: $RUN_OUT"
+  fi
+}
+
+assert_fails_with() { # <label> <needle> <file>...
+  local label="$1" needle="$2"
+  shift 2
+  run_hook "$@"
+  if [[ $RUN_RC -eq 0 ]]; then
+    fail "$label -- exited 0, so the hook reported Passed having checked nothing. Output: $RUN_OUT"
+  elif [[ "$RUN_OUT" != *"$needle"* ]]; then
+    fail "$label -- exited $RUN_RC but the message lacked '$needle'. Output: $RUN_OUT"
+  else
+    pass "$label"
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# 1. The call shape itself
+# ---------------------------------------------------------------------------
+# Asserted as a contract as well as behaviourally, because the behavioural
+# symptom of losing arg0 is a GREEN run -- the least likely thing to be noticed.
+echo "--- the hook passes an arg0 placeholder so pre-commit's filenames land in \"\$@\" ---"
+if [[ "$ENTRY" != "bash" ]]; then
+  fail "entry is '$ENTRY', not bash -- the arg0 reasoning below assumes bash -c"
+elif [[ ${#ARGS[@]} -lt 3 ]]; then
+  fail "args has ${#ARGS[@]} entries; a 'bash -c <script>' hook needs a third, the arg0 placeholder, or the first filename is dropped from \"\$@\""
+elif [[ "${ARGS[0]}" != "-c" ]]; then
+  fail "args[0] is '${ARGS[0]}', not -c"
+elif [[ "${ARGS[2]}" == -* ]]; then
+  fail "args[2] is '${ARGS[2]}', which bash will read as a flag rather than as \$0"
+else
+  pass "args is [-c, <script>, '${ARGS[2]}'] -- the third entry becomes \$0 and every filename reaches \"\$@\""
+fi
+
+FILES_PATTERN="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["files"] or "")' "$HOOK_JSON")"
+PASS_FILENAMES="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["pass_filenames"])' "$HOOK_JSON")"
+echo ""
+echo "--- the hook is filename-driven, so the loop is the only thing that ever runs ---"
+if [[ "$PASS_FILENAMES" != "True" ]]; then
+  fail "pass_filenames is $PASS_FILENAMES; with no filenames the loop body never executes and the hook is a permanent no-op"
+elif [[ "$FILES_PATTERN" != '^plugins/[^/]+/\.apm/skills/[^/]+/SKILL\.md$' ]]; then
+  fail "files: is '$FILES_PATTERN', not the .apm/ skill scope -- ADR-0020's gates and this one must agree on scope"
+else
+  pass "pass_filenames is on and files: is the .apm/ skill scope"
+fi
+
+# ---------------------------------------------------------------------------
+# 2. A single bad file, on its own -- THE regression
+# ---------------------------------------------------------------------------
+# This is the shipped bug in one line: one file, which is what a commit
+# touching one skill hands the hook. Before the arg0 fix the file landed in $0,
+# "$@" was empty, and this exited 0.
+echo ""
+echo "--- a SINGLE bad file fails (before the arg0 fix this exited 0 having read nothing) ---"
+write_skill "$TMPDIR_T/single/SKILL.md" 'name: single
+description: Missing its metadata block entirely.'
+assert_fails_with "one file with no metadata block is rejected" "missing required frontmatter fields" "$TMPDIR_T/single/SKILL.md"
+
+echo ""
+echo "--- and a single GOOD file still passes, so the case above is not failing for some other reason ---"
+write_skill "$TMPDIR_T/single-ok/SKILL.md" "$VALID_FM"
+assert_passes "one valid file passes" "$TMPDIR_T/single-ok/SKILL.md"
+
+# ---------------------------------------------------------------------------
+# 3. Position within the argument list must not matter
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- the bad file is caught wherever it sits in the argument list ---"
+write_skill "$TMPDIR_T/ok-a/SKILL.md" "$VALID_FM"
+write_skill "$TMPDIR_T/ok-b/SKILL.md" "$VALID_FM"
+write_skill "$TMPDIR_T/bad/SKILL.md" 'name: bad
+description: No metadata block.'
+
+assert_fails_with "bad file FIRST is caught" "$TMPDIR_T/bad/SKILL.md" \
+  "$TMPDIR_T/bad/SKILL.md" "$TMPDIR_T/ok-a/SKILL.md" "$TMPDIR_T/ok-b/SKILL.md"
+assert_fails_with "bad file LAST is caught (the loop reaches the end of \"\$@\")" "$TMPDIR_T/bad/SKILL.md" \
+  "$TMPDIR_T/ok-a/SKILL.md" "$TMPDIR_T/ok-b/SKILL.md" "$TMPDIR_T/bad/SKILL.md"
+assert_passes "three valid files pass" "$TMPDIR_T/ok-a/SKILL.md" "$TMPDIR_T/ok-b/SKILL.md" "$TMPDIR_T/single-ok/SKILL.md"
+
+# ---------------------------------------------------------------------------
+# 4. The four grep defects
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- defect 1: a \`metadata:\` block in a BODY code fence is documentation, not frontmatter ---"
+# skill-author's docs quote a metadata block verbatim. Under the old whole-file
+# grep that quotation satisfied the check for the file quoting it.
+write_skill "$TMPDIR_T/fence/SKILL.md" 'name: fence
+description: Frontmatter has no metadata block; the body quotes one.' '# Fence
+
+Skills declare their version like this:
+
+```yaml
+metadata:
+  version: "1.0.0"
+```'
+assert_fails_with "a quoted metadata block in the body does not satisfy metadata.version" "missing required frontmatter fields" "$TMPDIR_T/fence/SKILL.md"
+
+echo ""
+echo "--- ... and the same for name: and description: quoted in the body ---"
+write_skill "$TMPDIR_T/fence-keys/SKILL.md" 'metadata:
+  version: "1.0.0"' '# Fence keys
+
+```yaml
+name: not-the-real-name
+description: not the real description
+```'
+assert_fails_with "body-fenced name:/description: do not satisfy the presence checks" "name: description:" "$TMPDIR_T/fence-keys/SKILL.md"
+
+echo ""
+echo "--- defect 2: a \`version:\` under a following \`source:\` list is not metadata.version ---"
+# `-A10` ran ten lines past `metadata:` regardless of where the block ended.
+# write-docs and research both carry a `source:` list immediately after it.
+write_skill "$TMPDIR_T/source-list/SKILL.md" 'name: source-list
+description: metadata has no version; the next top-level key does.
+metadata:
+  author: someone
+source:
+  - name: upstream
+    version: "2.3.4"'
+assert_fails_with "a version: belonging to source[] does not satisfy metadata.version" "missing required frontmatter fields" "$TMPDIR_T/source-list/SKILL.md"
+
+echo ""
+echo "--- defect 3: a deeper-nested \`    version:\` is not metadata.version ---"
+# `grep -q "  version:"` was an unanchored substring match, so any indentation
+# of two spaces or more matched.
+write_skill "$TMPDIR_T/deep-indent/SKILL.md" 'name: deep-indent
+description: The only version: key sits one level too deep.
+metadata:
+  provenance:
+    version: "1.0.0"'
+assert_fails_with "a four-space-indented version: does not satisfy metadata.version" "missing required frontmatter fields" "$TMPDIR_T/deep-indent/SKILL.md"
+
+echo ""
+echo "--- defect 4: a version: more than ten lines into the metadata block is FOUND ---"
+# The mirror image: the old check reported this one missing.
+write_skill "$TMPDIR_T/long-metadata/SKILL.md" 'name: long-metadata
+description: A long metadata block whose version sits well past line ten.
+metadata:
+  a: 1
+  b: 2
+  c: 3
+  d: 4
+  e: 5
+  f: 6
+  g: 7
+  h: 8
+  i: 9
+  j: 10
+  k: 11
+  version: "1.0.0"'
+assert_passes "a version: 13 lines into the metadata block is found" "$TMPDIR_T/long-metadata/SKILL.md"
+
+# ---------------------------------------------------------------------------
+# 5. Present is not the same as well formed
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- a present-but-non-semver version is rejected, with its own message ---"
+# plugins/bin/.apm/skills/write-docs/SKILL.md carried exactly this through a
+# whole PR: the key was present, so a presence-only check had nothing to say.
+write_skill "$TMPDIR_T/two-part/SKILL.md" 'name: two-part
+description: Its version is two-part, which is a float in YAML, not a version.
+metadata:
+  version: "1.0"'
+assert_fails_with "\"1.0\" is rejected as malformed, not reported as missing" "malformed frontmatter metadata.version" "$TMPDIR_T/two-part/SKILL.md"
+
+echo ""
+echo "--- ... and the malformed message quotes the offending value ---"
+run_hook "$TMPDIR_T/two-part/SKILL.md"
+if [[ "$RUN_OUT" == *'"1.0"'* ]]; then
+  pass "the message names the value it rejected"
+else
+  fail "the message did not quote the rejected value. Output: $RUN_OUT"
+fi
+
+echo ""
+echo "--- other non-semver shapes ---"
+write_skill "$TMPDIR_T/empty-version/SKILL.md" 'name: empty-version
+description: The key is present with no value at all.
+metadata:
+  version:'
+assert_fails_with "a valueless version: is rejected" "metadata.version" "$TMPDIR_T/empty-version/SKILL.md"
+
+write_skill "$TMPDIR_T/word-version/SKILL.md" 'name: word-version
+description: A non-numeric version.
+metadata:
+  version: latest'
+assert_fails_with "version: latest is rejected" "malformed frontmatter metadata.version" "$TMPDIR_T/word-version/SKILL.md"
+
+echo ""
+echo "--- an unquoted three-part version is accepted (both YAML spellings are legal) ---"
+write_skill "$TMPDIR_T/unquoted/SKILL.md" 'name: unquoted
+description: An unquoted semver, which YAML reads as a string.
+metadata:
+  version: 0.1.4'
+assert_passes "version: 0.1.4 unquoted passes" "$TMPDIR_T/unquoted/SKILL.md"
+
+# ---------------------------------------------------------------------------
+# 6. A file that cannot be read as frontmatter must not report green
+# ---------------------------------------------------------------------------
+echo ""
+echo "--- a file with no frontmatter block fails loudly rather than passing vacuously ---"
+printf '# Just a document\n\nname: not-frontmatter\ndescription: nor this\n' > "$TMPDIR_T/no-fm.md"
+assert_fails_with "a file with no --- block is an error" "no closing YAML frontmatter block" "$TMPDIR_T/no-fm.md"
+
+printf -- '---\nname: unterminated\ndescription: the block is never closed\nmetadata:\n  version: "1.0.0"\n' > "$TMPDIR_T/unterminated.md"
+assert_fails_with "an unterminated frontmatter block is an error" "no closing YAML frontmatter block" "$TMPDIR_T/unterminated.md"
+
+echo ""
+echo "--- a path that does not exist is skipped, not crashed on ---"
+assert_passes "a nonexistent path is ignored" "$TMPDIR_T/nope/SKILL.md"
+
+echo ""
+echo "Results: $PASS passed, $FAIL failed"
+[[ $FAIL -eq 0 ]]