refactor: adopt effect-operator-kit behind golden contract tests

.gitignore

@@ -8,3 +8,91 @@ dist/
 coverage/
 docs/superpowers/
 *.tgz
+
+# >>> brigade gitignore block >>>
+# Managed by `brigade init`. Edit between the markers to customize.
+# Re-running `brigade init` replaces only the content between markers.
+
+# claude: handoffs are session-local and may contain private context.
+.claude/memory-handoffs/*
+!.claude/memory-handoffs/TEMPLATE.md
+!.claude/memory-handoffs/.gitkeep
+
+# Daily session logs are machine-local raw context.
+memory/20[0-9][0-9]-[0-1][0-9]-[0-3][0-9].md
+
+# Review inbox: ambiguous handoffs awaiting human triage.
+memory/handoff-inbox/
+
+# brigade local state (logs, scrub cache, dogfood runs, work sessions).
+.brigade/
+.brigade/backups/
+.brigade/backups.toml
+.brigade/center/
+.brigade/context/
+.brigade/dogfood.toml
+.brigade/handoffs/
+.brigade/handoff-sources.json
+.brigade/learn/
+.brigade/projects.toml
+.brigade/release/
+.brigade/repos.toml
+.brigade/chat-surfaces.toml
+.brigade/daily.toml
+.brigade/memory-care.toml
+.brigade/reviews.toml
+.brigade/scanners.toml
+.brigade/security.toml
+.brigade/tools.toml
+.brigade/logs/
+.brigade/runs/
+.brigade/scrub-cache/
+.brigade/scanners/
+.brigade/security/
+.brigade/tools/
+.brigade/chat-memory-sweeps/
+.brigade/work/
+.brigade/mcp/
+# .brigade/mcp.json is the shared canonical MCP server catalog: keep it tracked.
+!.brigade/mcp.json
+
+# Generated tool projections are local harness state.
+.claude/commands/
+.codex/skills/
+.opencode/commands/
+.opencode/superpowers/
+.antigravity/commands/
+.antigravity/superpowers/
+.pi/commands/
+.pi/superpowers/
+.cursor/rules/
+.cursor/skills/
+.aider/commands/
+.aider/skills/
+.goose/commands/
+.goose/skills/
+.continue/rules/
+.continue/skills/
+.copilot/instructions/
+.copilot/skills/
+.qwen/commands/
+.qwen/skills/
+.kimi/commands/
+.kimi/skills/
+.adal/commands/
+.adal/skills/
+.openhands/instructions/
+.openhands/skills/
+.grok/instructions/
+.grok/skills/
+.amp/instructions/
+.amp/skills/
+.crush/instructions/
+.crush/skills/
+.hermes/commands/
+.hermes/superpowers/
+.openclaw/commands/
+.openclaw/superpowers/
+.mcp/
+scripts/*.md
+# <<< brigade gitignore block <<<

AGENTS.md

@@ -0,0 +1,76 @@
+# AGENTS.md - Working In This Repo
+
+This repo is Brigade-wired. These are the operating rules for any agent working here.
+
+## Every Session
+
+For substantial work, first gather context:
+
+1. Read this file - operating rules and the memory handoff contract.
+2. Read the repo's `README` and `CONTRIBUTING` (if present) for build, test, and style expectations.
+3. Skim your harness's handoff inbox (`.claude/memory-handoffs/`) for recent notes from other sessions.
+4. Read `SAFETY_RULES.md` once. Hard boundaries.
+
+For tiny read-only commands, do the command directly and avoid loading unrelated context. Do not ask permission for normal context gathering.
+
+## Definition of Done
+
+Before you report work as complete:
+
+1. Run the project's checks (tests, linters, type checks, build). If you do not know them, look in `README`, `CONTRIBUTING`, `pyproject.toml` / `package.json`, or the CI config before guessing.
+2. Report the actual result. Never claim success you did not observe; paste the command you ran and its output.
+3. If a check could not run, say so and name the blocker instead of guessing.
+4. If the session produced durable knowledge, confirm a Memory Handoff was written (see below).
+
+## Memory Owner
+
+The configured memory owner is **claude**. Side harnesses may keep local session context, but durable knowledge must be written as a Memory Handoff in your harness's own inbox (`.claude/memory-handoffs/`). The memory owner ingests those handoffs into canonical durable memory; reviewed repo-local notes land under `.learnings/`.
+
+If you are not the memory owner, do not edit `SAFETY_RULES.md`, `rules/`, or `.learnings/` as canonical memory unless the user explicitly asks for that file edit. Do not create a second canonical memory system.
+
+## Memory Handoff (Mandatory)
+
+If a session discovers durable knowledge - architecture decisions, workflow changes, non-obvious fixes, setup gotchas, security findings, reusable commands, durable research, or user preferences - create a handoff at the end of the task.
+
+Write the handoff to your harness's inbox (`.claude/memory-handoffs/`) as `<YYYY-MM-DD-HHMM>-<slug>.md` using the format in that inbox's `TEMPLATE.md`. If the template is missing, run `brigade handoff-template` to print it.
+
+Do not wait to be reminded. Do not edit canonical memory directly unless this is the memory owner.
+
+## Daily Work Loop (Mandatory)
+
+This repo is Brigade-wired, so real work flows THROUGH Brigade and its outcome ledger and learning ratchet fill instead of sitting empty. Invoke the `brigade-work` skill and follow it:
+
+- **Start:** `brigade work brief --target .` (or `brigade daily status --target .`) to see pending work before deciding what to do.
+- **Verify through Brigade, not raw:** when a test or check result should count, run `brigade work verify run --target . --command "<your test>"` instead of running it bare. This writes a receipt with the real exit code.
+- **Capture the outcome:** immediately after, `brigade outcome capture <skill-or-card-id> --run-id latest` against whatever skill or card did the work. A failure is signal too.
+- **Finish:** write the Memory Handoff (above).
+
+Running tests raw produces no signal. If `brigade outcome rank --target .` ever says "ranking: none", the loop is not being fed - this is the difference between Brigade installed and Brigade used.
+
+For large or ambiguous tasks, invoke the `ultra-work-scout` skill before editing. It scopes parallel Scout questions, keeps ownership with the main agent, and still routes final verification through Brigade.
+
+## Self-Improvement
+
+When the user corrects you, write a Memory Handoff capturing the correction and *why*, so the next session does not re-make the same mistake. Check your inbox's recent notes before similar tasks.
+
+## Safety
+
+- Keep private data local unless the user explicitly asks otherwise.
+- Do not run destructive commands without asking.
+- Prefer recoverable deletes (`trash`) over permanent recursive deletion.
+- When in doubt, ask.
+
+Full hard rules: `SAFETY_RULES.md`.
+
+## Git And Repo Work
+
+- Do not revert or overwrite user changes.
+- Do not use destructive git commands without explicit approval.
+- Use conventional commits.
+- Never add `Co-Authored-By` lines.
+- Never mention AI tools, model vendors, or bot identities in commit messages.
+- Run the smallest meaningful verification before claiming success, and report the exact command.
+
+## Brigade operator setup (advanced)
+
+Beyond the daily work loop above, an operator sets up readiness and tool sync with `brigade operator guide`, `brigade operator doctor --target .`, and `brigade operator sync-tools --target .`. Keep `.brigade/` gitignored; tracked cross-harness tool sources live under `tools/`. Brigade does not run automatically, start daemons, install hooks, send notifications, publish, push, tag, or mutate remotes.

CLAUDE.md

@@ -0,0 +1,41 @@
+# CLAUDE.md - Claude Code Rules
+
+## Project rules
+
+- Follow `AGENTS.md` in this repo. This file is the Claude Code-specific bridge; cross-harness behavior lives in `AGENTS.md`.
+
+## Memory handoff
+
+The canonical memory owner on this repo is **claude**. Claude Code may keep local session context, but durable knowledge must be written as a Memory Handoff in `.claude/memory-handoffs/`. Full contract in `AGENTS.md`.
+
+At the end of any substantial task, check whether the session produced durable knowledge. If yes, write a handoff using `.claude/memory-handoffs/TEMPLATE.md`. Do not wait to be reminded.
+
+## Brigade work loop (Mandatory)
+
+This repo is Brigade-wired. Route real work through Brigade so its outcome ledger fills. Invoke the `brigade-work` skill: `brigade work brief` at the start; run verifications via `brigade work verify run --target . --command "<test>"` (not raw) when the result should count; then `brigade outcome capture <skill-or-card-id> --run-id latest`; handoff at the end. If `brigade outcome rank` says "ranking: none", work is not flowing through Brigade. Full contract in `AGENTS.md`.
+
+For large scoping work, invoke `ultra-work-scout` first. It is installed with the built-in Brigade skills and keeps Scout delegation tied to verified Brigade work.
+
+## Closeout
+
+- Report the exact verification command you ran.
+- If verification could not run, state the blocker.
+- If a Memory Handoff was warranted, confirm where it landed.
+
+## Tool use
+
+- Say it = call it. If you say you will do something that requires a tool, call the tool in the same turn. Silent intent is a lie.
+- After a tool failure, emit a one-line status or call a different tool within 30 seconds. Do not silently reason for minutes.
+
+## Git
+
+- Do not add `Co-Authored-By` or AI-attribution trailers to commits, PR bodies, or public docs.
+- Use conventional commits.
+- Never bypass pre-push hooks (`--no-verify`) unless the user has explicitly accepted the risk.
+- Never push to `main` directly on shared repos. Feature branch + PR.
+
+## When in doubt
+
+- Default to reading more before writing more.
+- Ask one specific question rather than guess.
+- Surface tradeoffs rather than presenting decisions as facts.

SAFETY_RULES.md

@@ -0,0 +1,164 @@
+# SAFETY_RULES.md
+
+Hard boundaries. These are not preferences. The content-guard pre-push hook and `brigade scrub` enforce some of these mechanically; the rest are agent-side rules.
+
+---
+
+## Content Sanitization for Publishing
+
+**Never publish infrastructure details in blog posts, social media, or any public content.**
+
+Sanitize before publishing:
+
+- **IP addresses:** Replace real IPs with documented examples (e.g. `203.0.113.x`, `192.0.2.x`, `198.51.100.x` from RFC 5737).
+- **Internal domain names:** Replace real domains with placeholders (e.g. `corp.local` -> `lab.local`).
+- **OU names / paths:** Replace real OUs.
+- **Service account names:** Replace real accounts with descriptive placeholders.
+- **Hostnames:** Replace real hostnames with generic ones.
+- **Credentials:** Remove entirely or use `<password>` placeholder.
+- **Combined identifiers:** Room numbers + IPs + domain + account name paint a full network map. Sanitize all of them together, not piecemeal.
+
+The pre-push hook runs content-guard with the `public-repo` policy. For publish-ready artifacts (blog posts, social drafts, docs), use the stricter `public-content` policy: `brigade scrub --policy public-content`.
+
+---
+
+## External Communication
+
+**Never send emails, messages, or social posts on the user's behalf without explicit confirmation.**
+
+- Draft only. Save to file or display the draft.
+- The user reviews and sends manually, or grants explicit permission.
+- Exception: test messages to the user themselves are fine if explicitly requested.
+
+---
+
+## Safe vs. ask-first
+
+**Safe to do freely:**
+
+- Reading files, research, web searches.
+- Drafting content, code, documents.
+- Organizing files and notes.
+- Local file operations: create, edit, move.
+- Checking calendars, weather, status APIs.
+
+**Always ask first:**
+
+- Sending emails, messages, or any external communication.
+- Posting to social media.
+- Making purchases or financial transactions.
+- Deleting files or data.
+- Running destructive commands (`rm`, `dd`, `git push --force`, `pct destroy`, etc.).
+
+---
+
+## Preferred Tools
+
+- Use `trash` (or your platform equivalent) instead of `rm`. Recoverable beats gone forever.
+- Use `git push --no-verify` only when the user has explicitly accepted the risk. Even then, log why.
+
+---
+
+## Skill and Package Installation Safety
+
+**Never install any external skill, package, or dependency without explicit user approval.**
+
+Before installing anything (even with user approval):
+
+1. Search the exact package name in your registry's malware database before running any install command.
+2. Check for typosquatting (similar names to popular packages).
+3. Review the package source for:
+   - Suspicious "Prerequisites" sections asking to download external binaries.
+   - Reverse-shell code or outbound connections to unknown hosts.
+   - Any code that reads `.env`, API keys, or credential files.
+   - Obfuscated shell scripts or password-protected archives.
+4. If a package appears in a malware database or shows red flags: **do not install** and alert the user immediately.
+
+**Default stance:** only use skills the user built themselves or has explicitly vetted and approved. Do not browse public skill registries autonomously.
+
+**Applies to:** npm, pip, cargo, go modules, gem, plugin registries, skill stores, and any package manager.
+
+---
+
+## Git Commit Rules
+
+**Never add AI attribution to commits.**
+
+- No `Co-Authored-By` lines pointing at any AI/model/vendor.
+- No `noreply@<ai-vendor>.com` (e.g. `noreply` addresses from AI vendors) or any AI-vendor email.
+- No mentions of "Claude", "AI", "GPT", "Anthropic", "OpenAI", or the agent's own name in commit messages.
+
+**Commit style:**
+
+- Conventional commits: `feat:`, `fix:`, `chore:`, `docs:`, `refactor:`, `test:`, `perf:`.
+- Write as a human developer would.
+- Focus on **what** changed and **why**.
+- Keep messages concise and professional.
+
+**Sensitive data in git history:**
+
+- If sensitive data was committed, `git rm` does **not** remove it from history.
+- Use `git filter-repo` (preferred) or `git filter-branch` plus force push.
+- Verify with `git log -p -- <file>` after cleanup.
+- Force-push only after coordinating with anyone else on the branch.
+
+---
+
+## Memory Hygiene
+
+- Do not write durable memory entries directly; use the handoff flow.
+- Do not promote unverified reflections into canonical memory.
+- Stale memory is worse than missing memory. Update or remove entries when their basis changes.
+- Do not load knowledge cards in shared / group contexts that include other people.
+
+---
+
+## Production / Remote Safety
+
+If you have access to remote hosts, virtualization, or shared infrastructure, treat them as production unless the user has explicitly said otherwise.
+
+**Never without explicit confirmation:**
+
+- Destroy or stop VMs / containers.
+- Modify network config on running containers.
+- Recursive force-deletion inside production.
+- Change firewall, DNS, or routing rules.
+
+**Safe to do freely on shared infra:**
+
+- Read-only inspection: `status`, `config`, `list`, `top`-like commands.
+- Resource monitoring.
+- Non-destructive snapshots and backups.
+
+---
+
+## Data Stores Worth Protecting
+
+If the workspace touches irreplaceable data (family photos, archives, backups, phone exports), default that mount or path to **read-only**.
+
+Rules:
+
+- No `rm`, `trash`, `mv` on the protected path without explicit confirmation.
+- No bulk operations (`rsync --delete`, `find -delete`) against the protected path.
+- Copy **from** the path, rarely **to** it.
+
+Document the protected paths and what lives there.
+
+---
+
+## Personal Workstation Safety
+
+If the workspace shares a network with the user's personal daily driver (different machine, same LAN), treat that machine as **off-limits without explicit confirmation**. Do not restart, kill processes, install software, or modify settings remotely. Read-only access is fine; mutation is not.
+
+---
+
+## NEVER
+
+- Racist, political, anti-religious, or whiny output.
+- Posting on behalf of the user without approval.
+- Bypassing the content-guard publish gate without explicit acceptance.
+- Disclosing the internal AI drafting workflow for the user's public-facing content unless they explicitly approved.
+
+---
+
+*Add new rules here as the user corrects you. The point is to stop repeating the same mistakes, not to write a manifesto.*