merge: origin/main into garrytan/multi-checkpoint-resume

Catches up 7 commits from main:
- c6e6a21d refactor: AI slop reduction with cross-model quality review (v0.16.3.0)
- 7e96fe29 fix: security wave 3 — 12 fixes, 7 contributors (v0.16.4.0)
- 23000672 feat: UX behavioral foundations + ux-audit command (v0.17.0.0)
- b805aa01 feat: Confusion Protocol, Hermes + GBrain hosts, brain-first resolver (v0.18.0.0)
- 6a785c57 fix: ngrok Windows build + close CI error-swallowing gap (v0.18.0.1)
- 0cc830b6 fix: avoid tilde-in-assignment to silence Claude Code permission prompts
- cc42f14a docs: gstack compact design doc (tabled pending Anthropic API)

Conflict resolution:
- ship/SKILL.md.tmpl line 402: HEAD had "## Step 12: Version bump" from
  the renumber refactor; origin/main added {{GBRAIN_SAVE_RESULTS}} above
  "## Step 4: Version bump". Resolved by keeping origin/main's new
  placeholder AND my branch's "Step 12" heading.
- ship/SKILL.md: regenerated from resolved template (per CLAUDE.md
  policy: never resolve generated files manually).

All skill docs regenerated for all 9 hosts (claude, kiro, opencode,
slate, cursor, openclaw, factory, hermes, gbrain) to reflect the
merged template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

qa/SKILL.md

@@ -21,6 +21,10 @@ allowed-tools:
   - Grep
   - AskUserQuestion
   - WebSearch
+triggers:
+  - qa test this
+  - find bugs on site
+  - test the site
 ---
 <!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly -->
 <!-- Regenerate: bun run gen:skill-docs -->
@@ -264,6 +268,8 @@ AI orchestrator (e.g., OpenClaw). In spawned sessions:
 - Focus on completing the task and reporting results via prose output.
 - End with a completion report: what shipped, decisions made, anything uncertain.
 
+
+
 ## Voice
 
 You are GStack, an open source AI builder framework shaped by Garry Tan's product, startup, and engineering judgment. Encode how he thinks, not his biography.
@@ -382,6 +388,19 @@ AI makes completeness near-free. Always recommend the complete option over short
 
 Include `Completeness: X/10` for each option (10=all edge cases, 7=happy path, 3=shortcut).
 
+## Confusion Protocol
+
+When you encounter high-stakes ambiguity during coding:
+- Two plausible architectures or data models for the same requirement
+- A request that contradicts existing patterns and you're unsure which to follow
+- A destructive operation where the scope is unclear
+- Missing context that would change your approach significantly
+
+STOP. Name the ambiguity in one sentence. Present 2-3 options with tradeoffs.
+Ask the user. Do not guess on architectural or data model decisions.
+
+This does NOT apply to routine coding, small features, or obvious changes.
+
 ## Repo Ownership — See Something, Say Something
 
 `REPO_MODE` controls how to handle issues outside your branch:
@@ -596,6 +615,8 @@ branch name wherever the instructions say "the base branch" or `<default>`.
 
 ---
 
+
+
 # /qa: Test → Fix → Verify
 
 You are a QA engineer AND a bug-fix engineer. Test web applications like a real user — click everything, fill every form, check every state. When you find bugs, fix them in source code with atomic commits, then re-verify. Produce a structured report with before/after evidence.
@@ -652,7 +673,7 @@ After the user chooses, execute their choice (commit or stash), then continue wi
 _ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
 B=""
 [ -n "$_ROOT" ] && [ -x "$_ROOT/.claude/skills/gstack/browse/dist/browse" ] && B="$_ROOT/.claude/skills/gstack/browse/dist/browse"
-[ -z "$B" ] && B=~/.claude/skills/gstack/browse/dist/browse
+[ -z "$B" ] && B="$HOME/.claude/skills/gstack/browse/dist/browse"
 if [ -x "$B" ]; then
   echo "READY: $B"
 else
@@ -1410,6 +1431,8 @@ staleness detection: if those files are later deleted, the learning can be flagg
 **Only log genuine discoveries.** Don't log obvious things. Don't log things the user
 already knows. A good test: would this insight save time in a future session? If yes, log it.
 
+
+
 ## Additional Rules (qa-specific)
 
 11. **Clean working tree required.** If dirty, use AskUserQuestion to offer commit/stash/abort before proceeding.

qa/SKILL.md.tmpl

@@ -24,12 +24,18 @@ allowed-tools:
   - Grep
   - AskUserQuestion
   - WebSearch
+triggers:
+  - qa test this
+  - find bugs on site
+  - test the site
 ---
 
 {{PREAMBLE}}
 
 {{BASE_BRANCH_DETECT}}
 
+{{GBRAIN_CONTEXT_LOAD}}
+
 # /qa: Test → Fix → Verify
 
 You are a QA engineer AND a bug-fix engineer. Test web applications like a real user — click everything, fill every form, check every state. When you find bugs, fix them in source code with atomic commits, then re-verify. Produce a structured report with before/after evidence.
@@ -323,6 +329,8 @@ If the repo has a `TODOS.md`:
 
 {{LEARNINGS_LOG}}
 
+{{GBRAIN_SAVE_RESULTS}}
+
 ## Additional Rules (qa-specific)
 
 11. **Clean working tree required.** If dirty, use AskUserQuestion to offer commit/stash/abort before proceeding.