v1.71.0.0 feat: token-load reduction — preamble runtime scripts, gated onboarding, 20 skill carves, CLAUDE.md trim (#2691)

* feat(gen): strip gen-time-only frontmatter keys from Claude renders interactive + benefits-from are read from the .tmpl by buildContext at generation time; no runtime, host, or test reader consumes them from the generated SKILL.md (e2e-harness-audit reads .tmpl; benefits-from tests assert rendered prose). gbrain: stays (bin/gstack-brain-context-load reads it from the installed render); hooks: stays (Claude Code host wires PreToolUse from it). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(gen): regenerate SKILL.md — dead frontmatter keys removed Mechanical regen after hosts/claude.ts stripFields change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(test): context-budget ratchet — CI ceilings on always-on + eager token ledgers New free test grades the two ledgers nothing else guards: the full-frontmatter always-on catalog (aggregate) and per-skill eager tokens (SKILL.md + forced-read refs), via checkBudget from lib/context-bill.ts. Ceilings live in test/fixtures/context-budget.json with x1.05/x1.10 headroom; regenerate with bun test/helpers/capture-context-budget.ts. New skills fail until consciously budgeted; removed skills fail until the fixture is refreshed; reductions ratchet the ceilings down so wins lock in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(todos): file output-template carve wave + plan-ceo doctrine revisit; mark preamble-carve P3 in flight Two follow-ups deferred from the approved token-reduction program (CEO review 'NOT in scope' list), filed with full context per TODOS format. The existing P3 preamble-carve entry gets a status update pointing at the program that supersedes it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(test): review findings — Windows path normalization, full totals rebuild, ratchet coverage Pre-landing review (5 specialists) found one critical: the ratchet test runs in the curated Windows lane, where path.relative yields backslash skill names that miss the test/ filter and mismatch every POSIX fixture key. Names are now normalized once in buildRatchetBill (toPosixName) and the fixture filter is tightened to test/fixtures/. All eight Bill.totals fields are rebuilt from the filtered list (no fixture-polluted perInvocation/totalMd numbers for future consumers). New coverage: Windows-separator normalization pins, a captureContextBudget round-trip against tree-a (headroom math exact), a stripFields regression pin (interactive/benefits-from absent from renders, hooks/gbrain preserved), and the ceilings test no longer double-reports stale-fixture entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(test): adversarial findings — stable root key, symlink-alias dedupe, fixture-shape guard Adversarial review (Claude subagent) verified the fixture's root-skill key was the capture machine's checkout dirname: any non-gstack-named clone (every Conductor worktree) failed the free suite, and the documented re-run-the-capture recovery baked the local dirname into the committed fixture — silent corruption through the tool's own protocol. The root skill is now pinned to ROOT_SKILL_KEY ('gstack', its frontmatter name). Symlink aliases are realpath-deduped (census precedent): connect-chrome no longer gets its own ceiling, so Windows checkouts that materialize the symlink as a plain file can't fail the stale-ceiling set-equality test. New guards: fixture-shape validation (a string alwaysOnTotal can no longer silently disable the ceiling), a mutation pin that the filter shrinks the always-on ledger vs the raw bill, an alwaysOnTotal violation test (the branch was load-bearing with only under-budget coverage), and an atomic temp+rename fixture write. Fixture regenerated: 59 ceilings, alwaysOnTotal 6344. Deferred with a TODO: anchoring transformFrontmatter's denylist strip to the frontmatter block (latent, zero live collisions, pre-existing path). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: bump version and changelog (v1.69.1.0) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: update project documentation for v1.69.1.0 CLAUDE.md: Token ceiling section documents the context-budget ratchet as the third guard (test file, fixture, new-skill budgeting, capture command). CONTRIBUTING.md: Tier 1 guard list gains a Context-budget ratchet bullet; the Adding-a-new-skill checklist gains the budget-capture step. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: pin exact guard semantics for the context-budget ratchet in CLAUDE.md Doc-review finding: "a third enforced ceiling" undercounted the guard family (skill-size-budget floors and parity ratios also watch these ledgers, relatively). Rephrased to match the ratchet test's own header: absolute ceilings vs relative floors/ratios. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(changelog): heaviest-skill claim matches the fixture (land-and-deploy edges review by 0.2%) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(bin): gstack-skill-start + gstack-skill-end — the preamble runtime, consolidated Absorbs the ~13KB of bash every tier-2+ SKILL.md inlined twice over (bootstrap fence + artifacts-sync fence) and the skill-end telemetry/sync fences. Same KEY: value STATUS-line contract the prose interprets, plus SKILL_START_PROTO handshake (OV5), SESSION_ID/TEL_START echoes, GSTACK_HOME-normalized state paths (EOV7), --parent-pid session identity (EOV5: $PPID inside the script is the ephemeral tool-call shell), OV4 sanitization of passthrough output, and a receipted daily artifacts pull (_receipted_git, brain-sync class, fail-closed). Per-line || true error style throughout (F3) — a mid-script failure never drops later STATUS lines. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(gen): preamble resolvers emit a script invocation fence instead of inline bash generate-preamble-bash: ~6.3KB fence -> 4-line gstack-skill-start invocation (quoted-tilde pitfall handled: leading ~ interpolates through $HOME; env-var hosts keep $GSTACK_BIN) + degraded-mode prose (F1/EOV8: safe defaults, consent gates deferred-never-lost; OV5: proto rule). generate-brain-sync-block: ~6.8KB bash -> interpretation prose + the privacy stop-gate (stays inline until Phase 2's gated emission). generate-completion-status: telemetry fence -> one gstack-skill-end call with SESSION_ID/TEL_START handoff. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(gen): regenerate all skills + golden fixtures — inline preamble bash removed Mechanical regen after the resolver change: −12,628 lines across 52 renders (corpus 952K -> 806K render tokens; tier-2 skills −11-13KB each). Golden per-host ship fixtures refreshed from the fresh claude/codex/factory renders. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: skill-start contract suite + preamble A/B eval + touchfiles registration test/gstack-skill-start.test.ts (11 free tests): STATUS-key contract vs the prose (F2), per-host fence resolution shapes (E1), proto-first, OV4 marker sanitization, --parent-pid identity, headless suppression, skill-end duration math + pending cleanup. test/skill-e2e-preamble-script-ab.test.ts (gate tier, OV7): inline-bash render (pinned from 29785978) vs script render with the fence redirected at the worktree bin (EOV2 — hermetic evals otherwise resolve the operator install and silently exercise degraded mode). 21 touchfiles dep lists gain the two bin scripts (EOV9) so future script edits select the preamble evals; selection-count pin updated 23->24. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: repin ~70 assertions to the script contract — every literal gets a successor Assertions that pinned inline-bash internals (update-check guard, _SESSIONS reaping, telemetry start/end blocks, routing probe, repo-strip producer, first-task gating, EXPLAIN_LEVEL/QUESTION_TUNING echoes, #2499 jq scope resolution, Issue-8 CONDUCTOR gate) now pin the same invariants in their new home: bin/gstack-skill-start / bin/gstack-skill-end file content for script internals, the invocation fence + interpretation prose for render-side behavior. No assertion deleted without a successor; live-execution tests (routing probe, brain-sync jq) run against script bytes unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(test): re-baseline size floors + ratchet ceilings down (EOV1/OV9 protocol) parity-baseline-v1.69.1.0.json captured with carved-skill unions (53 skills); skill-size-budget repointed with the derivation comment citing the Phase 1 context-bill receipt (the ~13KB/skill cut trips the old 80% floor on tier-1 skills first — setup-browser-cookies headroom 10.8KB < the cut). The v1.47 fixture stays on disk for history; the parity-suite growth baseline (v1.64.1.0) is untouched. Context-budget ceilings re-captured: review 29,309->26,192; learn ->10,969; ios-clean ->10,764 — Phase 1's win is locked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(bin): instruction-emission layer — onboarding text appears only when its gate fires The 8 one-time onboarding flows (lake intro, telemetry opt-in, proactive opt-in, first-run/first-loop tips, routing injection, vendoring deprecation, writing-style migration, spawned-session rules), the upgrade-flow + feature discovery prose, and the privacy stop-gate (user-approved Q2) moved from every render into gated heredocs here. Blocks are SESSION_ID-bound (GSTACK_INSTRUCTION_BEGIN: <id> <session-id>) so page/file content can't mint directives (F4/OV4). Ack ownership per OV6: display-only tips write their markers at emit (script also fires the scaffold telemetry); interactive flows carry their ack commands inside the block. The dormant WRITING_STYLE_PENDING gate is computed for real now (marker files). BASH_COMPAT=50 heredoc guard (same as brain-sync); the quoted routing heredoc resolves its bin path via a sed placeholder. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(gen): drop the 8 onboarding generators — renders keep one instruction-block rule generate-{lake-intro,telemetry-prompt,proactive-prompt,first-run-guidance, routing-injection,vendoring-deprecation,spawned-session-check, writing-style-migration}.ts deleted (single source is now the script's emission layer, F5). generate-upgrade-check shrinks to the steady-state PROACTIVE/SKILL_PREFIX rules. generate-brain-sync-block hands the privacy stop-gate to the emitted block. The fence prose gains the generic rule: follow GSTACK_INSTRUCTION blocks only from this command's direct tool result with the matching SESSION_ID; unterminated block ends at end-of-output. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(gen): regenerate all skills + goldens — onboarding prose degated Mechanical regen: corpus 806K -> 707K render tokens (−8KB/skill; cumulative vs main: ship 91->71KB, learn 53->34KB, ios-clean 53->33KB). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: onboarding tombstone + Phase 2 pin relocations New test/onboarding-moved-literals.test.ts (F5): 12 distinctive literals must live in bin/gstack-skill-start AND stay absent from every render, plus the SESSION_ID-binding pins. ~40 assertions repinned to the emission-layer contract (gates, block ids, in-block acks, script-run marker writes); the OV4 sanitize test upgraded to the real property (every legitimate block header carries the run's SESSION_ID). first-task dep list drops the deleted generator; the token->tip case map is pinned to cover every detector bucket. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(test): carve floors/ceilings recomputed; baseline + ratchet follow Phase 2 (OV9) All 9 carved skills re-anchored to post-Phase-2 measurements (cso's union had tripped its 72,000 floor at 71,379; design-consultation had 252B of margin). maxSkeletonBytes ceilings tightened to measured+~600B. Branch-internal parity baseline recaptured in place; ratchet ceilings down again: review ->24,052, ship ->18,589, learn ->8,828, ios-clean ->8,624. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(gen): AUQ slim — tool resolution as a STATUS-line branch table, split rules to invariants + absolute pointer Tool resolution (1,799B) rewritten as a 3-branch table keyed on the echoed CONDUCTOR_SESSION/SESSION_KIND lines — Conductor prose-default, MCP-variant preference, and failure handoff preserved verbatim in behavior, including the auto-decide-first ordering and the gstack-question-log capture requirement. 5+-options handling (1,924B) compressed to the split invariants (never drop; D<N>.k shape; Include/Defer/Cut/Hold; question_id scheme with the never-ask refusal) + the full-rule pointer. Both doc pointers now interpolate the absolute install root (Codex outside-voice #7 convention) instead of the bare 'in the gstack repo'. Failure-fallback, Format, and self-check sections are byte-identical — all 14 MANDATORY always-loaded pins pass with zero test edits. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(gen): regenerate all skills + goldens — AUQ slim Mechanical regen: −1.3KB per tier-2+ skill (ship 69.9KB, learn 32.5KB). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(test): baseline + ratchet follow Phase 3 (OV9); OV8 evaluated — shrink floor stays Branch-internal baseline recaptured; ratchet ceilings down again. OV8's floor-retirement question, evaluated as planned after Phase 3: the 80% shrink floor stays — it uniquely catches accidental body deletion in non-carved skills BETWEEN ratchet recaptures, and the capture command has amortized the fixture-refresh cost that motivated retiring it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(review): carve adversarial, plan-completion, and review-army into sections The three resolver macros ship already carves as siblings now load on demand for /review too: skeleton 100.2KB -> 55.0KB (-45%), union 93.4KB. Resolvers stay the single source of truth (sections wrap the macros). Step 0/1, scope drift, critical pass, confidence calibration, and fix-first stay always-loaded. Fixtures and pins follow the moved content (codex-hardening wrapped-sites, review-army E2E fixture builds skeleton+sections with an empty-fixture guard). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(codex): carve the three mutually exclusive modes into sections Review/Challenge/Consult mode bodies (34.7KB where at most one ever runs) load on demand: skeleton 81.0KB -> 55.2KB, union 1.04x the monolith. The mode dispatch, filesystem boundary, and a new always-loaded 'Synthesis recommendation (REQUIRED) — all modes' block stay skeleton-side (the AUQ per-skill pins pass unchanged); the plan-file report + exit gate render after the last section pointer per the gateAfterStop pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(land-and-deploy): carve first-run validation, readiness gate, and merge/deploy into sections The once-per-repo dry-run validation, the pre-merge readiness gate, and the merge + deploy-strategy steps (37.8KB) load on demand: skeleton 91.1KB -> 55.7KB. Step 1.5 keeps its detection bash as the dispatch; the first-run section's fingerprint-save block gained {{SLUG_EVAL}} so it is self-contained. Zero content lost (line-coverage checked against HEAD). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ios): demote the four ios skills to preamble-tier 2 (Phase 5) They never consume the tier-3 sections (repo-mode ownership, search-before- building) but do fire AskUserQuestion, which tier >=2 provides — verified by grep before the plan review. -2.2KB per skill. Render assertions pin the demotion (tier-3 sections absent, AUQ format present). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(guards): register wave-1 carves; monolith invariants retire; baselines + ratchet follow CARVE_GUARDS gains review/codex/land-and-deploy (12 carved skills total); their MONOLITH_INVARIANTS entries retire (invariants now generate from the registry, cso precedent). Touchfiles: carve-section-loading covers the three new carves; the codex + land-and-deploy LLM-judge dep lists widen to their sections. Regen + goldens + branch-internal baseline + ratchet ceilings recaptured (review 24,052 -> skeleton-based ceiling; union floors hold). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(gen-skill-docs): review render pins read the carved union The review carve's readSkillUnion conversions (same pattern its neighbor carved-skill pins already use). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(autoplan): carve the four review phases + tasks aggregator into sections Phase bodies (CEO/Design/Eng/DX consensus flows) and the Implementation Tasks aggregator load on demand; Design and DX stay separate sections because each is independently conditional on scope. Skeleton 83.7KB -> 58.7KB (-30% always-loaded); the 6 decision principles, classification, sequencing, and explicit skip-condition dispatch stay always-loaded. The chain E2E's phase-complete markers now live only in sections, so its assertions double as section-read proof (behavioral: external). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(spec): carve the post-confirmation gate-and-file tail into one section Phases 1-4 are the turn-1 conversational spine — carving them would force the Read on the first user message for zero real savings. The mechanical tail (4.5/4.5a/4.5b redaction gates + Phase 5 filing + TTHW telemetry) fires only after draft confirmation: a genuine lazy boundary, kept as ONE section so the gh-issue-create bash can never load without the fail-closed redaction gate that precedes it. Skeleton 65.4KB -> 50.7KB; all ~85 phase-structure invariants migrated location-aware plus a new carve-shape suite (56 tests). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(setup-gbrain): carve the branch-exclusive install paths into sections Brain-init (Paths 1/2/3/4 bodies), engine remediation, transcript gate, and CLAUDE.md persist load on demand — at most one install route ever runs. Skeleton 75.3KB -> 57.0KB; the Step 1 detect and Step 2 path dispatch stay always-loaded. New buildSetupGbrainFixture helper gives the periodic E2Es extract-don't-copy fixtures with a non-empty guard; the voyage-code-3 gate counts scan the tmpl union (the third init site lives in engine-remediation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(guards): register wave-2 carves (15 carved skills); autoplan monolith retires; baselines follow CARVE_GUARDS gains autoplan (behavioral: external via the chain eval), spec, and setup-gbrain; autoplan's MONOLITH_INVARIANTS entry retires. Touchfiles: setup-gbrain periodic dep lists gain the section tmpls + fixture helper; the stale-brain-refs scan covers setup-gbrain/sections. Regen + goldens + branch baseline + ratchet recaptured. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(qa): carve QA patterns + health rubric into on-demand sections (68→48KB skeleton) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(browse): carve full command list + snapshot flags into sections/command-list.md (39→27KB skeleton) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(retro): absorb inline git/awk metrics into bin/gstack-retro-metrics + carve report format RETRO_METRICS_PROTO: 1 contract, local git reads only (fetch stays in the skill prose), degraded path documented in the skeleton. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: register wave-3 carves (qa, browse, retro) — guards, touchfiles, pins, baselines CARVE_GUARDS gains the three entries; qa's monolith invariant retires. auq-format carve-safety now keys on the skeleton+sections union shipping the AUQ block (first tier-1 carve: browse never renders it by design). Baselines: parity v1.69.1.0 at 18 sectioned skills; ratchet recaptured. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(test): drop stale generate-lake-intro import (generator deleted in the emission-layer move) Sol scope discipline stays pinned via the model overlay + completeness section; the lake intro is now a single script-emitted blurb. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(office-hours): carve Phase 2A/2B into mode-exclusive sections (81→67KB skeleton) A session runs exactly one mode, so a builder session never loads the 13KB startup diagnostic. Mode mapping and the vibe-shift upgrade rule stay in the skeleton. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(design): carve UX doctrine + Pretext patterns into read-on-demand sections design-html 57→49KB, design-shotgun 53→50KB. Sections wrap {{UX_PRINCIPLES}} so scripts/resolvers/design.ts stays the source of truth; the pretext-patterns STOP sits at the top of Step 3 so the read provably precedes the Write. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: register wave-4 carves (office-hours ext, design-html, design-shotgun) — 20 carved skills Both design entries carry requiredReads + loading-eval scenarios (D3A condition). office-hours phase sections are mode-exclusive, so only the always-reached design/handoff section is a deterministic requiredRead. Baselines and ratchet recaptured. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: trim CLAUDE.md 66.4→44.9KB — verbatim moves to docs/, pointers stay inline Moved: browser/sidebar/server internals, CHANGELOG release-summary format spec, project tree, hermetic-E2E detail, slop-scan reference, OpenClaw publishing. Kept inline: every hard behavioral rule (dist/ ban, redaction scan-at-sink, egress receipts, bisect commits, eval detach, CHANGELOG entry rules), the machine-managed GBrain block (byte-identical), and the '## Deploying to the active skill' header with gbrain-refresh in range (pinned by test/gbrain-refresh-install-render.test.ts). No voice rewrites. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(test): seed onboarding markers into the hermetic child GSTACK_HOME EOV7 made bin/gstack-skill-start honor GSTACK_HOME, so the operator-HOME seeding in e2e-helpers.ts no longer reaches hermetic children — the emission layer fired lake-intro/telemetry prompts that burned turns and stalled PTY tests waiting on an answer (observed: plan-mode-no-op derailed by the telemetry question). Onboarding-specific tests pin their own GSTACK_HOME per-test, which merges over this seed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: raise carve-section-loading wall clock to 480s SDK / 540s bun The heavy full-workflow scenarios satisfy their required section reads inside 60s but need 300-450s to finish the report on slower sandboxes; the 300s default read as a loading failure when the carve invariant held (traces: plan-eng-review read its section at 8s, office-hours all three at 24s, design-html both at 50s — all timed out mid-report). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(security): harden the skill-start trust boundary — review-army findings Session ID gains a urandom suffix (block binding unforgeable by reflected content); _sanitize also neutralizes spoofed SESSION_ID: lines; branch names are charset-clamped before JSON embedding (skill-start + skill-end); .brain-last-push reads first line only with a charset clamp; the artifacts URL echo routes through _sanitize; the privacy consent gate fires in interactive sessions only (spawned auto-choose could accept consent no human gave — emission order is not a safety property); the daily pull gets non-interactive + slow-network git guards and stamps only when the receipted path ran; ~/.claude.json gets a grep pre-filter before the jq parse. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(resolvers): question-log session_id becomes a substitution placeholder + stale-comment sweep The question-log block bound $_SESSION_ID, a shell variable the consolidated fence never sets — hook-less hosts logged empty session_id, breaking /plan-tune per-session grouping. It now uses the same substitute-from-the-skill-start-echoes contract as the telemetry block. Also: retired the pre-Phase-2 stop-gate docstring, repointed the gbrain-local-status cross-reference at the script's inline jq, dropped an orphaned section comment, documented retro-metrics' suffix-only census. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: regenerate renders for the question-log placeholder; goldens + baselines follow Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: hermetic update-check, onboarding gate sequencing, seeding parity The contract test's child did a live git ls-remote + curl to github.com on every bun run test (update_check config now gates it off); the headless test gets a fresh GSTACK_HOME so the suppression is actually exercised; a new OV6 test drives the script three times to pin ack-at-emit and gate sequencing; hermetic seeding covers the config-keyed privacy gate; the EVALS_HERMETIC=0 debug seeding reaches marker parity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(ci): demote the preamble A/B to periodic (OV7) and add it to the periodic matrix Post-Phase-3 demotion per the plan; the eval needs fetch-depth 0 (it git shows a pre-Phase-1 sha), which only the periodic workflow provides — and a static matrix entry so it can't silently never run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: bump version and changelog (v1.70.0.0) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: update project documentation for v1.70.0.0 ARCHITECTURE.md: the preamble section now describes the v1.70 runtime — the rendered {{PREAMBLE}} block invokes bin/gstack-skill-start and reads STATUS lines, gstack-skill-end logs telemetry, and one-time onboarding text arrives as gated GSTACK_INSTRUCTION blocks instead of riding in every render. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: doc-review fixes — repair moved-file links, drop unbacked session-count claim docs/BROWSER_INTERNALS.md: the two ARCHITECTURE.md anchor links broke when the section moved from repo-root CLAUDE.md into docs/ — now ../ARCHITECTURE.md. ARCHITECTURE.md: the preamble's session-tracking item claimed an active-session count and an "ELI16 mode" that no shipped code implements (the count computation was deleted with the inline preamble); describe the real touch-and-prune behavior instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(changelog): correct numeric claims against measured counts 50 of 62 installed skills dropped (fixture/alias entries have no preamble); 11 new carves + a deeper office-hours carve = 9→20; test counts match the files (13 / 11 / 3 / 7). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: repoint the preamble-runtime version reference after the queue rebump (v1.71.0.0) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(e2e-design): widen the Aesthetic synonym set — vocabulary variance, not a regression Both attempts in run 33090283032 produced judge-praised DESIGN.md files phrased as 'design principles'/'design language' without any of the four original literals; inputs were identical to the prior passing run 32899975845 (design-consultation untouched by the intervening merge). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(test): stage design-consultation's sections/ into the E2E fixture The skill has been carved since v1.57.0.0 — the DESIGN.md structure prescription (the AESTHETIC proposal template) lives in sections/proposal-and-preview.md behind a STOP-read. The fixture only copied SKILL.md, so the agent improvised structure from the skeleton and the section-synonym check has been a coin flip since the carve (CI run 33090283032 trace shows 'no sections dir'; the local eval store has the same failure on 2026-08-25 while that day's CI run passed on lucky vocabulary). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-29 09:20:39 +02:00 · 2026-08-27 09:50:31 -07:00
parent a3749bfa4b
commit 394db326f2
227 changed files with 16814 additions and 34123 deletions
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://gstack.dev/schemas/section-manifest.json",
+  "skill": "qa",
+  "version": 1,
+  "note": "PASSIVE registry (v2 plan T9 / CM2). Fields are IDs, file paths, human titles, and human-readable trigger text ONLY. The skeleton's decision-tree prose is the ONLY place that decides WHEN to read a section; required-reads live in the E2E fixtures. No machine predicate here — see docs/designs/v2_PLAN.md:663.",
+  "sections": [
+    {
+      "id": "test-bootstrap",
+      "file": "test-bootstrap.md",
+      "title": "Test Framework Bootstrap",
+      "trigger": "checking the project's test framework during Setup — ecosystem-marker detection, the bootstrap offer, framework install, CI pipeline generation, and first real tests (also needed at Phase 8e.5 if you skipped it and a regression test now requires a framework)"
+    },
+    {
+      "id": "qa-patterns",
+      "file": "qa-patterns.md",
+      "title": "Core QA patterns — modes, Phases 1-6 workflow, health rubric, framework guidance, testing rules",
+      "trigger": "running the QA baseline (Phases 1-6) — mode selection (Diff-aware/Full/Quick/Regression), the phase-by-phase browser workflow, the Health Score Rubric, framework-specific guidance, and the browser-testing Important Rules"
+    }
+  ]
+}
@@ -0,0 +1,279 @@
+<!-- AUTO-GENERATED from qa-patterns.md.tmpl — do not edit directly -->
+<!-- Regenerate: bun run gen:skill-docs -->
+## Modes
+
+### Diff-aware (automatic when on a feature branch with no URL)
+
+This is the **primary mode** for developers verifying their work. When the user says `/qa` without a URL and the repo is on a feature branch, automatically:
+
+1. **Analyze the branch diff** to understand what changed:
+   ```bash
+   git diff main...HEAD --name-only
+   git log main..HEAD --oneline
+   ```
+
+2. **Identify affected pages/routes** from the changed files:
+   - Controller/route files → which URL paths they serve
+   - View/template/component files → which pages render them
+   - Model/service files → which pages use those models (check controllers that reference them)
+   - CSS/style files → which pages include those stylesheets
+   - API endpoints → test them directly with `$B js "await fetch('/api/...')"`
+   - Static pages (markdown, HTML) → navigate to them directly
+
+   **If no obvious pages/routes are identified from the diff:** Do not skip browser testing. The user invoked /qa because they want browser-based verification. Fall back to Quick mode — navigate to the homepage, follow the top 5 navigation targets, check console for errors, and test any interactive elements found. Backend, config, and infrastructure changes affect app behavior — always verify the app still works.
+
+3. **Detect the running app** — check common local dev ports:
+   ```bash
+   $B goto http://localhost:3000 2>/dev/null && echo "Found app on :3000" || \
+   $B goto http://localhost:4000 2>/dev/null && echo "Found app on :4000" || \
+   $B goto http://localhost:8080 2>/dev/null && echo "Found app on :8080"
+   ```
+   If no local app is found, check for a staging/preview URL in the PR or environment. If nothing works, ask the user for the URL.
+
+4. **Test each affected page/route:**
+   - Navigate to the page
+   - Take a screenshot
+   - Check console for errors
+   - If the change was interactive (forms, buttons, flows), test the interaction end-to-end
+   - Use `snapshot -D` before and after actions to verify the change had the expected effect
+
+5. **Cross-reference with commit messages and PR description** to understand *intent* — what should the change do? Verify it actually does that.
+
+6. **Check TODOS.md** (if it exists) for known bugs or issues related to the changed files. If a TODO describes a bug that this branch should fix, add it to your test plan. If you find a new bug during QA that isn't in TODOS.md, note it in the report.
+
+7. **Report findings** scoped to the branch changes:
+   - "Changes tested: N pages/routes affected by this branch"
+   - For each: does it work? Screenshot evidence.
+   - Any regressions on adjacent pages?
+
+**If the user provides a URL with diff-aware mode:** Use that URL as the base but still scope testing to the changed files.
+
+### Full (default when URL is provided)
+Systematic exploration. Visit every reachable page. Document 5-10 well-evidenced issues. Produce health score. Takes 5-15 minutes depending on app size.
+
+### Quick (`--quick`)
+30-second smoke test. Visit homepage + top 5 navigation targets. Check: page loads? Console errors? Broken links? Produce health score. No detailed issue documentation.
+
+### Regression (`--regression <baseline>`)
+Run full mode, then load `baseline.json` from a previous run. Diff: which issues are fixed? Which are new? What's the score delta? Append regression section to report.
+
+---
+
+## Workflow
+
+### Phase 1: Initialize
+
+1. Find browse binary (see Setup above)
+2. Create output directories
+3. Copy report template from `qa/templates/qa-report-template.md` to output dir
+4. Start timer for duration tracking
+
+### Phase 2: Authenticate (if needed)
+
+**If the user specified auth credentials:**
+
+```bash
+$B goto <login-url>
+$B snapshot -i                    # find the login form
+$B fill @e3 "user@example.com"
+$B fill @e4 "[REDACTED]"         # NEVER include real passwords in report
+$B click @e5                      # submit
+$B snapshot -D                    # verify login succeeded
+```
+
+**If the user provided a cookie file:**
+
+```bash
+$B cookie-import cookies.json
+$B goto <target-url>
+```
+
+**If 2FA/OTP is required:** Ask the user for the code and wait.
+
+**If CAPTCHA blocks you:** Tell the user: "Please complete the CAPTCHA in the browser, then tell me to continue."
+
+### Phase 3: Orient
+
+Get a map of the application:
+
+```bash
+$B goto <target-url>
+$B snapshot -i -a -o "$REPORT_DIR/screenshots/initial.png"
+$B links                          # map navigation structure
+$B console --errors               # any errors on landing?
+```
+
+**Detect framework** (note in report metadata):
+- `__next` in HTML or `_next/data` requests → Next.js
+- `csrf-token` meta tag → Rails
+- `wp-content` in URLs → WordPress
+- Client-side routing with no page reloads → SPA
+
+**For SPAs:** The `links` command may return few results because navigation is client-side. Use `snapshot -i` to find nav elements (buttons, menu items) instead.
+
+### Phase 4: Explore
+
+Visit pages systematically. At each page:
+
+```bash
+$B goto <page-url>
+$B snapshot -i -a -o "$REPORT_DIR/screenshots/page-name.png"
+$B console --errors
+```
+
+Then follow the **per-page exploration checklist** (see `qa/references/issue-taxonomy.md`):
+
+1. **Visual scan** — Look at the annotated screenshot for layout issues
+2. **Interactive elements** — Click buttons, links, controls. Do they work?
+3. **Forms** — Fill and submit. Test empty, invalid, edge cases
+4. **Navigation** — Check all paths in and out
+5. **States** — Empty state, loading, error, overflow
+6. **Console** — Any new JS errors after interactions?
+7. **Responsiveness** — Check mobile viewport if relevant:
+   ```bash
+   $B viewport 375x812
+   $B screenshot "$REPORT_DIR/screenshots/page-mobile.png"
+   $B viewport 1280x720
+   ```
+
+**Depth judgment:** Spend more time on core features (homepage, dashboard, checkout, search) and less on secondary pages (about, terms, privacy).
+
+**Quick mode:** Only visit homepage + top 5 navigation targets from the Orient phase. Skip the per-page checklist — just check: loads? Console errors? Broken links visible?
+
+### Phase 5: Document
+
+Document each issue **immediately when found** — don't batch them.
+
+**Two evidence tiers:**
+
+**Interactive bugs** (broken flows, dead buttons, form failures):
+1. Take a screenshot before the action
+2. Perform the action
+3. Take a screenshot showing the result
+4. Use `snapshot -D` to show what changed
+5. Write repro steps referencing screenshots
+
+```bash
+$B screenshot "$REPORT_DIR/screenshots/issue-001-step-1.png"
+$B click @e5
+$B screenshot "$REPORT_DIR/screenshots/issue-001-result.png"
+$B snapshot -D
+```
+
+**Static bugs** (typos, layout issues, missing images):
+1. Take a single annotated screenshot showing the problem
+2. Describe what's wrong
+
+```bash
+$B snapshot -i -a -o "$REPORT_DIR/screenshots/issue-002.png"
+```
+
+**Write each issue to the report immediately** using the template format from `qa/templates/qa-report-template.md`.
+
+### Phase 6: Wrap Up
+
+1. **Compute health score** using the rubric below
+2. **Write "Top 3 Things to Fix"** — the 3 highest-severity issues
+3. **Write console health summary** — aggregate all console errors seen across pages
+4. **Update severity counts** in the summary table
+5. **Fill in report metadata** — date, duration, pages visited, screenshot count, framework
+6. **Save baseline** — write `baseline.json` with:
+   ```json
+   {
+     "date": "YYYY-MM-DD",
+     "url": "<target>",
+     "healthScore": N,
+     "issues": [{ "id": "ISSUE-001", "title": "...", "severity": "...", "category": "..." }],
+     "categoryScores": { "console": N, "links": N, ... }
+   }
+   ```
+
+**Regression mode:** After writing the report, load the baseline file. Compare:
+- Health score delta
+- Issues fixed (in baseline but not current)
+- New issues (in current but not baseline)
+- Append the regression section to the report
+
+---
+
+## Health Score Rubric
+
+Compute each category score (0-100), then take the weighted average.
+
+### Console (weight: 15%)
+- 0 errors → 100
+- 1-3 errors → 70
+- 4-10 errors → 40
+- 10+ errors → 10
+
+### Links (weight: 10%)
+- 0 broken → 100
+- Each broken link → -15 (minimum 0)
+
+### Per-Category Scoring (Visual, Functional, UX, Content, Performance, Accessibility)
+Each category starts at 100. Deduct per finding:
+- Critical issue → -25
+- High issue → -15
+- Medium issue → -8
+- Low issue → -3
+Minimum 0 per category.
+
+### Weights
+| Category | Weight |
+|----------|--------|
+| Console | 15% |
+| Links | 10% |
+| Visual | 10% |
+| Functional | 20% |
+| UX | 15% |
+| Performance | 10% |
+| Content | 5% |
+| Accessibility | 15% |
+
+### Final Score
+`score = Σ (category_score × weight)`
+
+---
+
+## Framework-Specific Guidance
+
+### Next.js
+- Check console for hydration errors (`Hydration failed`, `Text content did not match`)
+- Monitor `_next/data` requests in network — 404s indicate broken data fetching
+- Test client-side navigation (click links, don't just `goto`) — catches routing issues
+- Check for CLS (Cumulative Layout Shift) on pages with dynamic content
+
+### Rails
+- Check for N+1 query warnings in console (if development mode)
+- Verify CSRF token presence in forms
+- Test Turbo/Stimulus integration — do page transitions work smoothly?
+- Check for flash messages appearing and dismissing correctly
+
+### WordPress
+- Check for plugin conflicts (JS errors from different plugins)
+- Verify admin bar visibility for logged-in users
+- Test REST API endpoints (`/wp-json/`)
+- Check for mixed content warnings (common with WP)
+
+### General SPA (React, Vue, Angular)
+- Use `snapshot -i` for navigation — `links` command misses client-side routes
+- Check for stale state (navigate away and back — does data refresh?)
+- Test browser back/forward — does the app handle history correctly?
+- Check for memory leaks (monitor console after extended use)
+
+---
+
+## Important Rules
+
+1. **Repro is everything.** Every issue needs at least one screenshot. No exceptions.
+2. **Verify before documenting.** Retry the issue once to confirm it's reproducible, not a fluke.
+3. **Never include credentials.** Write `[REDACTED]` for passwords in repro steps.
+4. **Write incrementally.** Append each issue to the report as you find it. Don't batch.
+5. **Never read source code.** Test as a user, not a developer.
+6. **Check console after every interaction.** JS errors that don't surface visually are still bugs.
+7. **Test like a user.** Use realistic data. Walk through complete workflows end-to-end.
+8. **Depth over breadth.** 5-10 well-documented issues with evidence > 20 vague descriptions.
+9. **Never delete output files.** Screenshots and reports accumulate — that's intentional.
+10. **Use `snapshot -C` for tricky UIs.** Finds clickable divs that the accessibility tree misses.
+11. **Show screenshots to the user.** After every `$B screenshot`, `$B snapshot -a -o`, or `$B responsive` command, use the Read tool on the output file(s) so the user can see them inline. For `responsive` (3 files), Read all three. This is critical — without it, screenshots are invisible to the user.
+12. **Never refuse to use the browser.** When the user invokes /qa or /qa-only, they are requesting browser-based testing. Never suggest evals, unit tests, or other alternatives as a substitute. Even if the diff appears to have no UI changes, backend changes affect app behavior — always open the browser and test.
@@ -0,0 +1 @@
+{{QA_METHODOLOGY}}
@@ -0,0 +1,186 @@
+<!-- AUTO-GENERATED from test-bootstrap.md.tmpl — do not edit directly -->
+<!-- Regenerate: bun run gen:skill-docs -->
+## Test Framework Bootstrap
+
+**Read the project's CLAUDE.md (and TESTING.md if present) FIRST.** If it documents a test command, the project already told you: no detection, no bootstrap. Skip the rest of bootstrap and use that command in Step 5.
+
+**Otherwise gather markers. Every marker below is EVIDENCE for the question you ask — never a command to run blind.** A marker tells you which ecosystem you're in and which command to OFFER. It does not tell you the command works. Do not execute a candidate test command to "check" it: a probe on a project that never had that runner fails loudly and teaches you nothing, and installing a second framework over a working one is worse.
+
+```bash
+setopt +o nomatch 2>/dev/null || true  # zsh compat
+# Definitive ecosystem markers (presence = ecosystem, NOT a command to run)
+[ -f manage.py ] && echo "RUNTIME:python FRAMEWORK:django MARKER:manage.py"
+{ [ -f pyproject.toml ] || [ -f pytest.ini ] || [ -f tox.ini ] || [ -f setup.cfg ] || [ -f requirements.txt ]; } && echo "RUNTIME:python"
+[ -f Gemfile ] || [ -f Rakefile ] || [ -f .rspec ] && echo "RUNTIME:ruby"
+[ -f package.json ] && echo "RUNTIME:node"
+[ -f go.mod ] && echo "RUNTIME:go"
+[ -f Cargo.toml ] && echo "RUNTIME:rust"
+[ -f composer.json ] && echo "RUNTIME:php"
+[ -f mix.exs ] && echo "RUNTIME:elixir"
+[ -f pom.xml ] && echo "RUNTIME:jvm BUILD:maven"
+{ [ -f build.gradle ] || [ -f build.gradle.kts ]; } && echo "RUNTIME:jvm BUILD:gradle"
+# Detect sub-frameworks
+[ -f Gemfile ] && grep -q "rails" Gemfile 2>/dev/null && echo "FRAMEWORK:rails"
+[ -f package.json ] && grep -q '"next"' package.json 2>/dev/null && echo "FRAMEWORK:nextjs"
+# Existing test path — config files, declared scripts, AND test FILES.
+# A project with real tests and no config file is the common miss.
+ls jest.config.* vitest.config.* playwright.config.* .rspec pytest.ini tox.ini phpunit.xml* 2>/dev/null
+[ -f package.json ] && grep -q '"test"[[:space:]]*:' package.json && echo "SCRIPT:package.json test"
+[ -f Makefile ] && grep -qE '^(test|check):' Makefile && echo "TARGET:make test"
+[ -f pyproject.toml ] && grep -q "pytest" pyproject.toml && echo "CONFIG:pyproject pytest"
+git ls-files | grep -cE '(^|/)(tests?|spec|__tests__)/|(^|/)tests?\.py$|(^|/)test_[^/]+\.py$|_test\.(go|py|rb|ts|js|exs)$|\.(test|spec)\.[jt]sx?$|_spec\.rb$|Test\.(java|kt)$' | sed 's/^/TESTFILES:/'
+# Rust keeps unit tests inside src/, so file names alone miss them
+[ -f Cargo.toml ] && git grep -lF '#[test]' -- 'src' >/dev/null 2>&1 && echo "TESTS:rust in-source"
+# Check opt-out marker
+[ -f .gstack/no-test-bootstrap ] && echo "BOOTSTRAP_DECLINED"
+```
+
+Map the markers to the command you will OFFER — never to one you run on a guess:
+
+| Marker | Ecosystem | Candidate command to offer |
+|--------|-----------|----------------------------|
+| `manage.py` | Django | `python manage.py test` (or `pytest` when pytest-django is in the deps) |
+| `pytest.ini` / `tox.ini` / pytest in `pyproject.toml` / `test_*.py` | Python | `pytest` |
+| `go.mod` (+ any `*_test.go`) | Go | `go test ./...` |
+| `Cargo.toml` | Rust | `cargo test` |
+| `pom.xml` | JVM (Maven) | `mvn test` |
+| `build.gradle` / `build.gradle.kts` | JVM (Gradle) | `./gradlew test` |
+| `Gemfile` / `Rakefile` / `.rspec` | Ruby | `bundle exec rspec`, `bin/rails test`, or `rake test` |
+| `mix.exs` | Elixir | `mix test` |
+| `composer.json` | PHP | `composer test` or `./vendor/bin/phpunit` |
+| `package.json` with a `test` script | Node | that script, run with the package manager the lockfile names |
+| `Makefile` with a `test:` target | any | `make test` |
+
+**If ANY existing-test evidence appears** (a config file, a declared test script or make target, a nonzero `TESTFILES:` count, or `TESTS:rust in-source`): the project has tests. **Do NOT bootstrap.** Print "Existing tests detected: {the evidence}." Then get the command the same way Step 5 does — CLAUDE.md/TESTING.md if documented, otherwise AskUserQuestion offering the candidates from the table above plus "Other", and persist the answer to CLAUDE.md's `## Testing` section so it is never asked again. When the ecosystem ships a runner (Django, Go, Rust, Elixir, Maven/Gradle), that runner is the candidate — never install a second framework beside a working one.
+Read 2-3 existing test files to learn conventions (naming, imports, assertion style, setup patterns).
+Store conventions as prose context for use in Phase 8e.5 or Step 7. **Skip the rest of bootstrap.**
+
+Absent config files and absent `tests/` directories are NOT evidence of "no tests": Django keeps tests in `<app>/tests.py`, Go in `*_test.go` beside the source, Rust in `#[test]` blocks inside `src/`. A green `python manage.py test` with no `pytest.ini` is a tested project, not a bootstrap candidate.
+
+**If BOOTSTRAP_DECLINED** appears: Print "Test bootstrap previously declined — skipping." **Skip the rest of bootstrap.**
+
+**If NO ecosystem marker matched:** Use AskUserQuestion:
+"I couldn't detect your project's language. What runtime are you using?"
+Options: A) Node.js/TypeScript B) Ruby/Rails C) Python D) Go E) Rust F) PHP G) Elixir H) This project doesn't need tests.
+If the runtime you need isn't listed, offer "Other" and take the runtime plus the test command as free text.
+If user picks H → write `.gstack/no-test-bootstrap` and continue without tests.
+
+**If an ecosystem matched but there is no existing-test evidence at all — bootstrap:**
+
+### B2. Research best practices
+
+Use WebSearch to find current best practices for the detected runtime:
+- `"[runtime] best test framework 2025 2026"`
+- `"[framework A] vs [framework B] comparison"`
+
+If WebSearch is unavailable, use this built-in knowledge table:
+
+| Runtime | Primary recommendation | Alternative |
+|---------|----------------------|-------------|
+| Ruby/Rails | minitest + fixtures + capybara | rspec + factory_bot + shoulda-matchers |
+| Node.js | vitest + @testing-library | jest + @testing-library |
+| Next.js | vitest + @testing-library/react + playwright | jest + cypress |
+| Python | pytest + pytest-cov | unittest |
+| Django | pytest + pytest-django | Django's built-in `manage.py test` (unittest) |
+| Go | stdlib testing + testify | stdlib only |
+| JVM (Maven/Gradle) | JUnit 5 + AssertJ | JUnit 5 only |
+| Rust | cargo test (built-in) + mockall | — |
+| PHP | phpunit + mockery | pest |
+| Elixir | ExUnit (built-in) + ex_machina | — |
+
+### B3. Framework selection
+
+Use AskUserQuestion:
+"I detected this is a [Runtime/Framework] project with no test framework. I researched current best practices. Here are the options:
+A) [Primary] — [rationale]. Includes: [packages]. Supports: unit, integration, smoke, e2e
+B) [Alternative] — [rationale]. Includes: [packages]
+C) Skip — don't set up testing right now
+RECOMMENDATION: Choose A because [reason based on project context]"
+
+If user picks C → write `.gstack/no-test-bootstrap`. Tell user: "If you change your mind later, delete `.gstack/no-test-bootstrap` and re-run." Continue without tests.
+
+If multiple runtimes detected (monorepo) → ask which runtime to set up first, with option to do both sequentially.
+
+### B4. Install and configure
+
+1. Install the chosen packages (npm/bun/gem/pip/etc.)
+2. Create minimal config file
+3. Create directory structure (test/, spec/, etc.)
+4. Create one example test matching the project's code to verify setup works
+
+If package installation fails → debug once. If still failing → revert with `git checkout -- package.json package-lock.json` (or equivalent for the runtime). Warn user and continue without tests.
+
+### B4.5. First real tests
+
+Generate 3-5 real tests for existing code:
+
+1. **Find recently changed files:** `git log --since=30.days --name-only --format="" | sort | uniq -c | sort -rn | head -10`
+2. **Prioritize by risk:** Error handlers > business logic with conditionals > API endpoints > pure functions
+3. **For each file:** Write one test that tests real behavior with meaningful assertions. Never `expect(x).toBeDefined()` — test what the code DOES.
+4. Run each test. Passes → keep. Fails → fix once. Still fails → delete silently.
+5. Generate at least 1 test, cap at 5.
+
+Never import secrets, API keys, or credentials in test files. Use environment variables or test fixtures.
+
+### B5. Verify
+
+```bash
+# Run the full test suite to confirm everything works
+{detected test command}
+```
+
+If tests fail → debug once. If still failing → revert all bootstrap changes and warn user.
+
+### B5.5. CI/CD pipeline
+
+```bash
+# Check CI provider
+ls -d .github/ 2>/dev/null && echo "CI:github"
+ls .gitlab-ci.yml .circleci/ bitrise.yml 2>/dev/null
+```
+
+If `.github/` exists (or no CI detected — default to GitHub Actions):
+Create `.github/workflows/test.yml` with:
+- `runs-on: ubuntu-latest`
+- Appropriate setup action for the runtime (setup-node, setup-ruby, setup-python, etc.)
+- The same test command verified in B5
+- Trigger: push + pull_request
+
+If non-GitHub CI detected → skip CI generation with note: "Detected {provider} — CI pipeline generation supports GitHub Actions only. Add test step to your existing pipeline manually."
+
+### B6. Create TESTING.md
+
+First check: If TESTING.md already exists → read it and update/append rather than overwriting. Never destroy existing content.
+
+Write TESTING.md with:
+- Philosophy: "100% test coverage is the key to great vibe coding. Tests let you move fast, trust your instincts, and ship with confidence — without them, vibe coding is just yolo coding. With tests, it's a superpower."
+- Framework name and version
+- How to run tests (the verified command from B5)
+- Test layers: Unit tests (what, where, when), Integration tests, Smoke tests, E2E tests
+- Conventions: file naming, assertion style, setup/teardown patterns
+
+### B7. Update CLAUDE.md
+
+First check: If CLAUDE.md already has a `## Testing` section → skip. Don't duplicate.
+
+Append a `## Testing` section:
+- Run command and test directory
+- Reference to TESTING.md
+- Test expectations:
+  - 100% test coverage is the goal — tests make vibe coding safe
+  - When writing new functions, write a corresponding test
+  - When fixing a bug, write a regression test
+  - When adding error handling, write a test that triggers the error
+  - When adding a conditional (if/else, switch), write tests for BOTH paths
+  - Never commit code that makes existing tests fail
+
+### B8. Commit
+
+```bash
+git status --porcelain
+```
+
+Only commit if there are changes. Stage all bootstrap files (config, test directory, TESTING.md, CLAUDE.md, .github/workflows/test.yml if created):
+`git commit -m "chore: bootstrap test framework ({framework name})"`
+
+---
@@ -0,0 +1 @@
+{{TEST_BOOTSTRAP}}