Promote develop to main

.agents/skills/repo-worktree/SKILL.md

@@ -61,6 +61,18 @@ from `develop` unless the task is explicitly about `main`-only content, per `GOV
 "Branching Model". Fetch immediately before creating and base on the remote ref, because a clone
 is whatever it last fetched rather than the branch it names.
 
+The base clone is a fetch source, not a place to do task work. `fetch` and `worktree add` run
+against it for that purpose, and outside "Listing and Cleanup"'s own terminal step below, nothing
+else does: never `checkout`, `pull`, `reset`, `commit`, or any other command that mutates its own
+working tree, index, or HEAD while a task is in progress. That distinction is the one a real
+incident missed, reusing a primary checkout as the working directory itself rather than only as
+the source a worktree is created from. On Claude Code this is also a mechanical stop for most
+of that list. `merge --ff-only`/`pull --ff-only` and a `checkout <ref>`/`switch <ref>` carrying no
+force flag stay exempt even there, matching this skill's own cleanup step below, which needs
+exactly those.
+Prose remains the only enforcement for a non-Claude-Code agent, and for the shapes the hook itself
+exempts.
+
 ## Creating a Worktree
 
 The fleet layout convention keeps every base clone and every in-flight task visible in one
@@ -123,6 +135,13 @@ task branch from `origin/develop`. A standalone clone keeps its worktree and Git
 directory under the same writable root. It therefore supports edits, explicit-path staging,
 commits, and branch updates without sharing the base clone's index.
 
+On Claude Code, a standalone clone is structurally a primary checkout to `gh-write-guard.py`'s own
+rule 6 test (`--git-dir` equals `--git-common-dir` there too, since it is not a linked worktree of
+anything), so the hook denies the very commits/edits this fallback exists to make. Set
+`GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUT` for the session before using one -- the same escape hatch
+`host-setup/agent-safety/README.md`'s requirement 6 already documents -- since this fallback is
+exactly the narrow, already-approval-gated case that grant exists for.
+
 A temporary standalone clone is a degraded handoff, not an equivalent location. The base clone
 does not register it, `git worktree list` does not show it, and an IDE opened on the base clone
 does not discover its changes. The maintainer must navigate to it manually, and the operating

.agents/skills/resync-a-repo/SKILL.md

@@ -37,8 +37,15 @@ anything else. The finding kind names the procedure the repo is owed.
 ## Reach the hub and measure before changing anything
 
 Fetch a hub checkout of your own immediately before reading it, per RESYNC.md section 1, since a
-stale clone answers confidently instead of failing, and verify the host with
-`python3 scripts/host_gate.py --repo <path-to-target-checkout>`. Then run the audit end to end,
+stale clone answers confidently instead of failing. Never operate against an existing checkout
+already present at a known or shared path, the maintainer's own primary checkout included, even
+one that looks current -- always fetch into a private worktree of your own, per `repo-worktree`.
+On Claude Code this is now also a mechanical stop for most such commands (a `PreToolUse` hook
+denies a mutating git operation run directly in a primary checkout), though this prose is still
+the only enforcement for a non-Claude-Code agent, and for the narrow shapes the hook itself
+exempts, so following it here is not optional even where no hook can catch a lapse. Verify the
+host with `python3 scripts/host_gate.py --repo <path-to-target-checkout>`. Then run the audit end
+to end,
 RESYNC.md section 2, against the target's `main` branch, never `develop`. A finding is a snapshot,
 so quote the run stamp in anything derived from it and re-run before acting on a finding read
 earlier in the session.

.claude-plugin/fleet-skills/.source-digest

@@ -1 +1 @@
-7c7db19359804689
+76568e633c063da3

.claude-plugin/fleet-skills/skills/repo-worktree/SKILL.md

@@ -61,6 +61,18 @@ from `develop` unless the task is explicitly about `main`-only content, per `GOV
 "Branching Model". Fetch immediately before creating and base on the remote ref, because a clone
 is whatever it last fetched rather than the branch it names.
 
+The base clone is a fetch source, not a place to do task work. `fetch` and `worktree add` run
+against it for that purpose, and outside "Listing and Cleanup"'s own terminal step below, nothing
+else does: never `checkout`, `pull`, `reset`, `commit`, or any other command that mutates its own
+working tree, index, or HEAD while a task is in progress. That distinction is the one a real
+incident missed, reusing a primary checkout as the working directory itself rather than only as
+the source a worktree is created from. On Claude Code this is also a mechanical stop for most
+of that list. `merge --ff-only`/`pull --ff-only` and a `checkout <ref>`/`switch <ref>` carrying no
+force flag stay exempt even there, matching this skill's own cleanup step below, which needs
+exactly those.
+Prose remains the only enforcement for a non-Claude-Code agent, and for the shapes the hook itself
+exempts.
+
 ## Creating a Worktree
 
 The fleet layout convention keeps every base clone and every in-flight task visible in one
@@ -123,6 +135,13 @@ task branch from `origin/develop`. A standalone clone keeps its worktree and Git
 directory under the same writable root. It therefore supports edits, explicit-path staging,
 commits, and branch updates without sharing the base clone's index.
 
+On Claude Code, a standalone clone is structurally a primary checkout to `gh-write-guard.py`'s own
+rule 6 test (`--git-dir` equals `--git-common-dir` there too, since it is not a linked worktree of
+anything), so the hook denies the very commits/edits this fallback exists to make. Set
+`GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUT` for the session before using one -- the same escape hatch
+`host-setup/agent-safety/README.md`'s requirement 6 already documents -- since this fallback is
+exactly the narrow, already-approval-gated case that grant exists for.
+
 A temporary standalone clone is a degraded handoff, not an equivalent location. The base clone
 does not register it, `git worktree list` does not show it, and an IDE opened on the base clone
 does not discover its changes. The maintainer must navigate to it manually, and the operating

.claude-plugin/fleet-skills/skills/resync-a-repo/SKILL.md

@@ -37,8 +37,15 @@ anything else. The finding kind names the procedure the repo is owed.
 ## Reach the hub and measure before changing anything
 
 Fetch a hub checkout of your own immediately before reading it, per RESYNC.md section 1, since a
-stale clone answers confidently instead of failing, and verify the host with
-`python3 scripts/host_gate.py --repo <path-to-target-checkout>`. Then run the audit end to end,
+stale clone answers confidently instead of failing. Never operate against an existing checkout
+already present at a known or shared path, the maintainer's own primary checkout included, even
+one that looks current -- always fetch into a private worktree of your own, per `repo-worktree`.
+On Claude Code this is now also a mechanical stop for most such commands (a `PreToolUse` hook
+denies a mutating git operation run directly in a primary checkout), though this prose is still
+the only enforcement for a non-Claude-Code agent, and for the narrow shapes the hook itself
+exempts, so following it here is not optional even where no hook can catch a lapse. Verify the
+host with `python3 scripts/host_gate.py --repo <path-to-target-checkout>`. Then run the audit end
+to end,
 RESYNC.md section 2, against the target's `main` branch, never `develop`. A finding is a snapshot,
 so quote the run stamp in anything derived from it and re-run before acting on a finding read
 earlier in the session.

.github/actions/validate/action.yml

@@ -33,8 +33,8 @@ runs:
         uvx coverage@latest run --source=scripts,spec,host-setup -m unittest discover -s scripts/tests
         uvx coverage@latest run --source=scripts,spec,host-setup --append spec/audit.py --selftest
         uvx coverage@latest run --source=scripts,spec,host-setup --append spec/workflow_reuse.py --selftest
-        uvx coverage@latest run --source=scripts,spec,host-setup --append host-setup/agent-safety/gh-write-guard.py --selftest
-        uvx coverage@latest run --source=scripts,spec,host-setup --append host-setup/agent-safety/test_install.py
+        uvx coverage@latest run --source=scripts,spec,host-setup --append host-setup/agent-safety/claude/gh-write-guard.py --selftest
+        uvx coverage@latest run --source=scripts,spec,host-setup --append host-setup/agent-safety/claude/test_install.py
         uvx coverage@latest report
 
     # Read-only: fails if a generated skill distribution differs from .agents/skills/.

.github/skills/repo-worktree/SKILL.md

@@ -61,6 +61,18 @@ from `develop` unless the task is explicitly about `main`-only content, per `GOV
 "Branching Model". Fetch immediately before creating and base on the remote ref, because a clone
 is whatever it last fetched rather than the branch it names.
 
+The base clone is a fetch source, not a place to do task work. `fetch` and `worktree add` run
+against it for that purpose, and outside "Listing and Cleanup"'s own terminal step below, nothing
+else does: never `checkout`, `pull`, `reset`, `commit`, or any other command that mutates its own
+working tree, index, or HEAD while a task is in progress. That distinction is the one a real
+incident missed, reusing a primary checkout as the working directory itself rather than only as
+the source a worktree is created from. On Claude Code this is also a mechanical stop for most
+of that list. `merge --ff-only`/`pull --ff-only` and a `checkout <ref>`/`switch <ref>` carrying no
+force flag stay exempt even there, matching this skill's own cleanup step below, which needs
+exactly those.
+Prose remains the only enforcement for a non-Claude-Code agent, and for the shapes the hook itself
+exempts.
+
 ## Creating a Worktree
 
 The fleet layout convention keeps every base clone and every in-flight task visible in one
@@ -123,6 +135,13 @@ task branch from `origin/develop`. A standalone clone keeps its worktree and Git
 directory under the same writable root. It therefore supports edits, explicit-path staging,
 commits, and branch updates without sharing the base clone's index.
 
+On Claude Code, a standalone clone is structurally a primary checkout to `gh-write-guard.py`'s own
+rule 6 test (`--git-dir` equals `--git-common-dir` there too, since it is not a linked worktree of
+anything), so the hook denies the very commits/edits this fallback exists to make. Set
+`GH_WRITE_GUARD_ALLOW_PRIMARY_CHECKOUT` for the session before using one -- the same escape hatch
+`host-setup/agent-safety/README.md`'s requirement 6 already documents -- since this fallback is
+exactly the narrow, already-approval-gated case that grant exists for.
+
 A temporary standalone clone is a degraded handoff, not an equivalent location. The base clone
 does not register it, `git worktree list` does not show it, and an IDE opened on the base clone
 does not discover its changes. The maintainer must navigate to it manually, and the operating

.github/skills/resync-a-repo/SKILL.md

@@ -37,8 +37,15 @@ anything else. The finding kind names the procedure the repo is owed.
 ## Reach the hub and measure before changing anything
 
 Fetch a hub checkout of your own immediately before reading it, per RESYNC.md section 1, since a
-stale clone answers confidently instead of failing, and verify the host with
-`python3 scripts/host_gate.py --repo <path-to-target-checkout>`. Then run the audit end to end,
+stale clone answers confidently instead of failing. Never operate against an existing checkout
+already present at a known or shared path, the maintainer's own primary checkout included, even
+one that looks current -- always fetch into a private worktree of your own, per `repo-worktree`.
+On Claude Code this is now also a mechanical stop for most such commands (a `PreToolUse` hook
+denies a mutating git operation run directly in a primary checkout), though this prose is still
+the only enforcement for a non-Claude-Code agent, and for the narrow shapes the hook itself
+exempts, so following it here is not optional even where no hook can catch a lapse. Verify the
+host with `python3 scripts/host_gate.py --repo <path-to-target-checkout>`. Then run the audit end
+to end,
 RESYNC.md section 2, against the target's `main` branch, never `develop`. A finding is a snapshot,
 so quote the run stamp in anything derived from it and re-run before acting on a finding read
 earlier in the session.