Guide Changelog

(.github/workflows/publish-mcp.yml): the protected publisher now checks whether the exact npm version already exists. It skips npm publish only when the public SHA-512 integrity matches the approved archive, then continues with the public smoke test and MCP Registry publication. Registry errors other than a confirmed npm 404 fail closed.

(mcp-server/package.json, generated registry metadata, product manifest, and statistics collector): aligned the case-sensitive package and server name with the GitHub OIDC namespace granted by the registry, io.github.FlorianBruniaux/claude-code-guide. npm 1.3.0 remains immutable with the lowercase metadata value; 1.3.1 is the published, registry-compatible patch.

(mcp-server/scripts/generate-public-runtime-snapshot.mjs): runs the exact npm package outside its source directory so npx cannot resolve the local package without its installed binary. The refreshed snapshot records the observed 1.3.1 handshake and capability names.

(guide/ops/subscription-strategy.md, guide/ecosystem/local-vs-cloud-inference.md, guide/ecosystem/agentic-tools.md): Anthropic paused the announced Agent SDK and claude -p billing split on June 15, 2026, so the subscription page no longer presents a separate programmatic credit as active or calls interactive use unmetered. It now distinguishes Team included usage limits, Platform API billing, and usage-based Enterprise; scopes Team's 150-seat ceiling to intended Claude users rather than company headcount; documents Enterprise's native spend controls; and limits gateway claims to API traffic actually routed through the proxy, including LiteLLM's disabled-by-default max_budget. Replaced the unsourced per-developer cost range with Anthropic's current enterprise benchmark and added a 2026 coding-agent preprint showing up to 30x token variation across repeated runs of the same task. The self-hosting section fixes its cross-link, records the GeneralCompute workload and conflict of interest, and scopes the 50 to 100 concurrency rule to one 671B-class 4-bit model on 8xH100. DeepSeek V4 Pro output pricing moved from the June analysis's $0.87/MTok snapshot to $1.98 off-peak and $3.96 peak, reducing the fixed ≈$10 self-host comparison from more than 11x to about 5.1x or 2.5x; added vLLM, DistServe, and Splitwise primary research to show how sequence shape, latency objectives, and serving topology move capacity. The opencode Go subsection now reflects its current catalog, bounds request-count estimates to opencode's cache-heavy assumptions, and documents that enabling **Use balance** bypasses blocking at the Go usage limit by drawing from the Zen balance.

(guide/ops/subscription-strategy.md): removed the false claim that a consumer training opt-out, Team and Enterprise product data, and API traffic share one 30-day default. The page now separates training choice from saved-chat retention, documents the API's default 30-day backend deletion, and records that Enterprise custom product retention has a 30-day minimum while current product guidance defaults to indefinite retention when no custom period is configured.

(guide/ops/subscription-strategy.md, guide/ecosystem/local-vs-cloud-inference.md): replaced abstract-only paper links with direct PDFs and evaluation page references; added Smekal's 2,700-run specification-cost preprint with its one-model, five-task limitation; added Murakkab's OSDI 2026 workflow-optimization evidence while separating its 24-hour proxy trace from production coding-agent telemetry; added EcoServe's commodity-Ethernet serving counterexample and its baseline limitations; and added OpenTela's 22-month operational trace plus the control-plane functions omitted by GPU-only cost models.

(guide/ops/subscription-strategy.md, guide/ecosystem/local-vs-cloud-inference.md): added TraceLab's eight-month observed Claude Code and Codex trace with its API-list-price cost distribution, prefix-cache share, and 43-developer limitation; added GitHub Copilot's one-week production trace to replace seat-count concurrency assumptions with measured session tails, shallow within-turn parallelism, and retry amplification; and kept both papers explicitly separate from task-acceptance evidence, GPU sizing, and hosted versus self-hosted break-even claims.

(guide/ops/subscription-strategy.md, guide/ecosystem/local-vs-cloud-inference.md, guide/ecosystem/agentic-tools.md): added Agentix's program-aware scheduling result with its synthetic-arrival, A100, and vLLM 0.6.1 boundaries; added ThunderServe's heterogeneous-GPU and 5 Gbps Ethernet counterexample without treating it as frontier-model quality parity; added DynamoLLM's load-sensitive energy results and the much larger modeled GPU-rental saving relative to electricity; added Agentless as evidence for bounded candidate generation; corrected TraceLab's cited page range; and replaced the false claim that SWE-agent with Claude 3.7 held an open-weight SWE-bench record with the models, pass rates, cost denominator, and per-run cap reported in the NeurIPS 2024 paper.

(README.md, guide/README.md, machine-readable/reference.yaml, mcp-server/content/reference.yaml, plus the landing guide reader, Cmd+K index, RSS, announcement, and HTML sitemap): exposed the team-scale decision page from the root and guide navigation, kept the current section anchors in both machine-readable mirrors, and synchronized the public route and search surfaces without presenting one self-hosting crossover as portable across workloads.

(guide/ops/subscription-strategy.md, guide/ecosystem/local-vs-cloud-inference.md, guide/ecosystem/agentic-tools.md): added Back Market's active-user denominator, reported per-active-developer average, heavy-user tail, and staged API-to-subscription policy with the oral-account limitations preserved; added Shopify, Ramp, and Back Market examples of gateway cost attribution and duplicate-spend detection; documented that an aggregator contract does not approve every downstream provider; added a 200-engineer-scope reviewer case that moved from OpenRouter to Vertex AI and later rolled back a quality-regressing model update; and added a llama.cpp coding-agent cache-invalidation incident while keeping its estimated 95% performance loss explicitly anecdotal and integration-specific. Every practitioner claim links to the cited YouTube timestamp.

(README.md, guide/core/{community-patterns.md,memory-systems.md}, guide/ultimate-guide.md, guide/ultimate-guide.fr.md, plus claude-code-ultimate-guide-landing/src/components/landing/HeroBanner.astro and claude-cowork-guide-landing/src/components/landing/HeroBanner.astro): checked every link flagged as dead in this repo's own GitHub issue #66 (Aug 1 automated scan) and in two sibling repos' link-checker issues, verifying each against the live target instead of trusting the scan. GitHub's July 2026 restriction on public stargazer-list access made every .../stargazers URL 404; all three occurrences (this repo's README badge and star callout, plus one HeroBanner.astro in each landing site) now point at the repo itself. guide/core/community-patterns.md cited the Desloppify author as github.com/peteromaller, a typo for the real account peteromallet (extra "t"), confirmed live with 254 followers and the 3k-star desloppify repo; both the profile and repo links are corrected. guide/ultimate-guide.md and its French translation linked platform.claude.com/docs/en/release-notes/model-deprecations, moved to platform.claude.com/docs/en/about-claude/model-deprecations; both updated and the target reverified to still list the cited claude-3-haiku-20240307 retirement. guide/core/memory-systems.md linked github.com/mem0ai/mem0/tree/main/openmemory, a subpath removed from the parent repo; both references now point at github.com/mem0ai/mem0 directly, and a note flags that the mem0ai/openmemory repo name has since been repurposed for an unrelated CLI tool, so it is not a substitute link. One flagged link, doobidoo/mcp-memory-service, was confirmed a false positive (live, 1.9k stars) and left unchanged. context-evaluator.ai, gemini.google.com, and semgrep.dev/docs/mcp were flagged by the same scan but not independently reverified, their error types (connection refused, HTTP/2 protocol error, 405) match known bot-blocking false positives rather than confirmed dead links.

(claude-code-ultimate-guide-landing/src/pages/sitemap/index.astro): the automatically generated XML sitemap was verified valid and current with 433 indexable URLs, including Agent Harness Engineering, Agent Harness Map, Agentic Tools, Releases, and the HTML sitemap itself; robots.txt points to its canonical sitemap index. The human-facing HTML sitemap previously claimed to list every page while exposing only a curated subset and omitted the three Agent Harness reference pages. It now labels itself accurately as curated navigation, links the three missing references, and points readers and crawlers to the complete XML sitemap. Two regression tests protect those links and the XML handoff.

(machine-readable/reference.yaml, mcp-server/content/reference.yaml): 9 bare-integer deep_dive line references had drifted 26 to 93 lines from their actual heading and were corrected. 4 ambiguous slug anchors (task_hierarchy_design, task_status_transitions, task_metadata_conventions, multi_instance_decision_matrix) that each matched multiple same-slug headings across the guide were resolved to the one specific heading their surrounding content actually describes. 3 entries (chain_of_verification, outcome_engineering_o16g, ai_fluency_diagram) carried a spurious double-hyphen from a colon-to-hyphen slugify bug, corrected to the real GitHub anchor slug. The section_maps block's 11 broken entries, 1 in guide/cheatsheet.md (same slugify bug) and 10 in guide/workflows/smart-suggest-routing.md (that file was previously rewritten, every referenced heading no longer exists), were regenerated wholesale via scripts/gen-section-maps.py --apply since that block is fully mechanical, now 83 files and 943 anchors, 0 invalid. mcp-server/content/reference.yaml confirmed byte-identical to machine-readable/reference.yaml both before and after.

(guide/ecosystem/agent-harness-landscape.md, scripts/build-agent-harness-page.py): reader-facing Unknown cells now render as an accessible ? with a tooltip and legend, while N/A remains reserved for fields that do not apply. The canonical JSON keeps its unknown evidence values unchanged.

the "What Actually Fits" table previously implied nothing in the GLM-5 family fits this page's hardware; that was true for GLM-5.2 (753B) and the 743B GLM-5.3 flagship SKU, but not for GLM-5.3-Flash, a separate and much smaller MoE (320B total, 18B active, 45 layers, first natively multimodal model in the GLM-5 line) that Z.ai announced officially on Aug 26, 2026 after running it anonymously as "Ox Alpha" on OpenRouter and OpenCode from Aug 20. Added a new "192-256 GB" table row for the third-party LibertAIDAI/GLM-5.3-Flash-NVFP4 checkpoint, which quantizes the routed FFN tensors (≈97% of parameters) to weight-only NVFP4 and drops weight residency from 598.5 GiB (BF16) to ≈181 GiB, fitting this bracket with headroom unlike the other entries; its own authors verified it only on a 2x DGX Spark pair via SGLang (tensor-parallel 2) and their README states vLLM does not run on that combination. Also corrected an unsourced date: the table previously stated GLM-5.3 was announced Aug 17, 2026, a figure that traces to an earlier CHANGELOG entry with no citation behind it; Z.ai's own announcement is Aug 14, 2026. Added a new hardware row, "2x NVIDIA DGX Spark" (≈$9,398 combined, 256 GB unified memory, no NVLink), to the "Comparable Hardware Configurations" table, which is now fourteen configurations, not thirteen; renumbered every downstream reference to the section name, table row numbers, and anchor links accordingly. Added an analytical paragraph on three third-party throughput measurements of the same NVFP4 checkpoint on the same 2x DGX Spark hardware class within two days of each other (Aug 26-27, 2026): Tutanka01/glm5.3-flash-2x-dgx-spark-nvfp4 (SGLang, ≈18 tok/s, no documented method), kingjones30/GLM-5.3-Flash-2x-DGX-Spark (modified vLLM plus MTP-5 speculative decoding, 24.74/30.30/19.58 tok/s across code/structured/prose, dropping to a flat 14.6 tok/s without speculative decoding), and an undocumented NVIDIA forum thread reporting a 43.4 tok/s peak with no method disclosed; framed the spread as most plausibly explained by engine choice and speculative decoding rather than a confirmed fact, per this page's existing Benchmark Protocol section. Sources list expanded with the GLM-5.3-Flash model card, its Artificial Analysis entry, the NVFP4 checkpoint repo, and both third-party deployment repos.

(guide/ecosystem/local-vs-cloud-inference.md): removed the unsupported universal claim that CPU offload stays below 5 tokens/sec; separated weight residency from runtime, context, and per-sequence KV-cache memory; corrected Llama 4 Scout to require dual RTX 5090 cards or at least 64 GB aggregate memory rather than one 32 GB card; and changed Llama 4 Maverick's 205.7 GB estimate from "marginal" on 192 GB to not fitting. The hardware picker and both decision diagrams now compare purchase, dedicated rental, and elastic rental instead of contradicting each other on 24/7 workloads. The Hetzner comparison now distinguishes its 300 W RTX PRO 6000 Blackwell Max-Q from the 600 W Workstation Edition used for the purchase price, and labels the 15.7-month figure as a card-only spend crossing rather than a performance-equivalent break-even. AWS and OVH conclusions are bounded to the listed prices and workload shape; Apple power figures are identified as vendor-published; and the cited 0.20 to 0.12 J/token change is stated as a 1.67x efficiency improvement rather than "up to 2x." Added a reproducible benchmark protocol covering weights, runtime headroom, prefill, decode, concurrency, wall power, utilization, and full TCO, with timestamped field observations from four talks. The transcripts are supporting practitioner evidence, not controlled cross-hardware benchmarks.

the ≈20-minute figure was an unverified guess left over from an earlier, much shorter version of the page. Checked how the portfolio computes reading time for blog articles (florian-portfolio/src/data/reading-time.ts: 130 wpm for dense technical prose plus 30s per fenced code block, chosen because mainstream defaults like Medium's 270 wpm or dev.to's 275 wpm assume easy prose and undercount content mixing argument with code). Applying that formula as-is to this page's 6,400 prose words and 5 code blocks gives a 52-minute ceiling, but a third of that word count (2,098 words) comes from table cells, which are scanned, not read linearly at prose speed; excluding table words from the per-word rate and giving each of the page's 8 tables a flat 20-second scan allowance instead brings the estimate to ≈38 minutes. Settled on ≈35 minutes, in line with the page's existing "≈" convention. No script exists yet to compute this automatically for guide pages; the portfolio's reading-time.ts has no table-aware logic either, so this was a manual one-off calculation, not a new shared utility.

, per a Slack-relayed suggestion. Verified via Perplexity deep research cross-checked against NVIDIA's own Build model card (build.nvidia.com/deepseek-ai/deepseek-v4-flash-0731/modelcard) and DeepSeek's Hugging Face repo: the GA release (July 30-31, 2026) is 304B total / 13B active per NVIDIA's card, not the 284B the earlier preview build (and several secondary sources) still cite; neither DeepSeek nor NVIDIA states why the GA total grew, so a datanorth.ai claim attributing it to a bundled DSpark speculative-decoding module was deliberately not repeated as fact. No official VRAM figure exists for this model; used the actual spread of third-party quantized estimates (Unsloth: ≈103 GB at 3-bit, ≈162 GB at "lossless" 8-bit; Spheron: ≈166 GB at INT4; llmfit: 155.8 GB) rather than picking one number and presenting it as authoritative. All of this fits comfortably in both the Mac Studio M5 Ultra (256 GB) and the dual RTX PRO 6000 Blackwell (192 GB combined) configs, unlike Llama-4-Maverick-17B-128E's 205.7 GB, which only fits the 256 GB config and is marginal there. Updated three places: the "What Actually Fits" table's 192-256 GB row, the "Which Local Machine for Which Usage" table's flagship row, and the Decision Framework's "genuinely huge models" paragraph. Llama 4 Maverick is kept as a secondary mention in all three (it still fits, just more tightly) and untouched in the separate Energy Efficiency section, where it remains relevant as Meta's only disclosed training-energy figure on this page.

user-reported screenshot of the "Which Local Machine for Which Usage" flowchart showed every multi-line node (using <br/> inside {...} and ([...]) shapes) clipped to its first line in a non-GitHub Mermaid renderer, the same class of rendering bug fixed once before on this page's other diagram (2026-08-25, node-label clipping). Root cause not fully isolated (one node with a two-line label rendered correctly while otherwise-similar nodes didn't, ruling out a simple shape or length explanation), so the fix removes the ambiguity instead of chasing the renderer's specific behavior: every node in both Mermaid diagrams on this page ("Which Local Machine for Which Usage" and the pre-existing "Decision Diagram") now uses a single-line label, no <br/> anywhere in the file. The ASCII fallback for the usage-picker diagram was reworded to match. No logic, edges, or click targets changed.

(README.md, AGENTS.md, CLAUDE.md): a mechanical scan reusing the anti-ai-markers.sh hook's exact patterns found 114 em dashes in README.md, 2 in AGENTS.md, and 2 more in CLAUDE.md (never scanned until AGENTS.md was resynced from it, see below); all in the label — description bullet/heading convention. All other hook-checked markers (stereotyped EN phrases, redundant modal stacks, stereotyped openings, vague link labels, hollow evidentiality) were already at zero across all three files, confirmed twice: once via the hook's own grep patterns, once independently via a Python string count after a prior session flagged that rtk's grep alias can silently swallow em-dash matches. 112 of README's occurrences converted mechanically to a colon (**Label** — text → **Label**: text); 8 lines where that produced an awkward adjacent double colon were hand-fixed to a comma or a restructured clause. A guide-reviewer agent pass then caught judgment-level markers grep can't: the "not just X" contrast pattern used 6 times as a dramatization tic (kept once, in the intro; rewrote the other 5 as direct claims), the "design your own workflows instead of copy-pasting" slogan repeated near-verbatim 3 times (kept once, replaced the other 2 with a concrete example each), a sentencious 3-imperative closing line, one stray "the tool" right after the sentence had named Claude Code, and a promotional template ("### emoji Title" / Outcome / bullets / "What this means for you" triad) repeated identically across 8 feature-highlight sections with fully interchangeable triad items; 6 of the 8 "What this means for you" lines were rewritten as a single concrete sentence tied to an actual guide link or command, 2 were left as triads whose items were already distinct enough. Separately, AGENTS.md was found to have been corrupted by a naive "Claude" → "Codex" find-replace at some prior point: its title and intro literally claimed "Codex (Anthropic's CLI tool)", which is false (Codex is OpenAI's CLI, this repo documents Claude Code), plus broken paths (.Codex/ instead of .claude/, code.Codex.com instead of code.claude.com, guide/core/Codex-releases.md instead of the real filename) and two facts stale relative to CLAUDE.md (reference.yaml token estimate, resource-evaluation file count), plus a leaked <claude-mem-context>/<!-- lean-ctx --> block that had no business being committed. Since AGENTS.md and CLAUDE.md are meant to be a verbatim mirror (confirmed: diffing them after normalizing "Codex" back to "Claude Code" showed zero unexpected differences), AGENTS.md was regenerated with cp CLAUDE.md AGENTS.md after CLAUDE.md's own 2 em dashes were fixed; both files are now byte-identical and clean. CHANGELOG.md itself still carries 587 more em dashes in dense technical entries where a blanket colon substitution would risk misreading nested clauses; left untouched per explicit user decision, since the hook already blocks new em dashes on any future edit to this file. Not yet committed or pushed.

(whitepapers/{fr,en}/{02-personnalisation,04-architecture,07-guide-reference,11-team-metrics}.qmd + FR-only-tracked WP00/01/05/06/08/09 on disk, whitepapers/recap-cards/{fr,en}/{03-permission-modes,c03-xml-prompting-anchors,m01-workflow-quotidien,m03-sessions-continuité,m04-compact-vs-clear,m05-plan-mode,m15-tdd-bdd-sdd,m19-github-actions,m21-debug-methodique}.qmd, florian-portfolio/public/guides/, florian-portfolio/api/guides.mjs, landing src/data/whitepapers-data.ts + src/data/recap-cards-data.ts, landing public/ebooks/epub/{fr,en}/): a background workflow (70 parallel agents, one per bilingual document) checked every whitepaper and recap card against the house anti-AI style checklist (em dash, stereotyped openings, rhetorical announcement colons, sentencious closings, decorative emoji, invented personas, hollow buzzwords). 59 of 70 documents were already clean; 11 got real edits, the largest being WP07 (51 fixes, mostly --- used as an em-dash substitute) and WP11 (20 fixes, rhetorical "X : Y" announcement colons rewritten as plain sentences). Two cross-document patterns were flagged by nearly every agent but deliberately left untouched, pending an editorial decision rather than a per-file fix: the recurring named personas (Antoine, Léa, Karim, Sophie, Marc, Thomas, Julien) used in scenario callouts across the whole series, and the 📖 Pour aller plus loin/Further reading navigational emoji marker repeated identically in all 13 whitepapers. All 10 changed whitepapers had their PDF and EPUB rebuilt (FR+EN, quarto render --to whitepaper-typst / --to epub); WP11 is PDF-only per its formats field. Recap card M03 had its PDF rebuilt (--to recap-card-typst), which also required regenerating the Methodology-series ZIP (FR+EN) since M03 is one of its 22 members. New content hashes computed and copied into florian-portfolio/public/guides/ (whitepapers + card + zip), stale pre-fix files removed; guides.mjs's GUIDE_MANIFEST and recap-methodologie.{fr,en} zip entries, the landing's whitepapers-data.ts (10 hashedFileFr/hashedFileEn pairs), and recap-cards-data.ts (M03's hash pair plus the Methodology series' hashedZipFr/hashedZipEn) all updated to match. Verified: no stale hash string remains in any of the three manifest files, every new hashed filename resolves to a file that exists on disk, landing site builds clean (430 pages). Not yet committed or pushed in any of the three repos.

(florian-portfolio/public/guides/, florian-portfolio/api/guides.mjs, landing src/data/whitepapers-data.ts + src/data/recap-cards-data.ts): rendered all 13 whitepapers (quarto render --to whitepaper-typst, FR+EN) and all 57 recap cards (whitepapers/recap-cards/render-recap-cards.sh all, --to recap-card-typst) from the corrected .qmd sources, computed sha256-truncated-12 hashes for every output file, copied them into the portfolio's public/guides/ (whitepapers) and public/guides/recap-cards/ (cards + 6 new series ZIPs, rebuilt from the freshly hashed card PDFs, T/M/C × FR/EN), and updated all three deployment-manifest files: guides.mjs's GUIDE_MANIFEST (26 whitepaper keys + 6 recap-zip keys, used for email download links), the landing's whitepapers-data.ts (const V bumped v3.41.1 → v3.41.3, all 26 hashedFileFr/hashedFileEn values), and recap-cards-data.ts (CARD_HASHES_FR/CARD_HASHES_EN, 57 entries each, plus the 6 hashedZipFr/hashedZipEn fields on RECAP_SERIES). Five recap cards (01, 03, 04, 06, 25) and one with a French accent in its filename (m03-sessions-continuité) had a landing slug that didn't match their .qmd basename (resolved via each card's card-number frontmatter field against the landing's src/content/cheatsheets/*.md cardNumber field, the same mapping upload-en-pdfs.mjs already used for the EN-only pass); the accented file now gets a plain-ASCII hashed filename (m03-sessions-continuite...) instead of carrying the accent into a URL, unlike its predecessor. Verified after the fact: every filename referenced in all three manifest files resolves to a file that actually exists on disk, zero dangling references. The recap-cards portfolio directory also had 283 orphaned PDF files from prior partial/duplicate deploys (multiple stale hashes for the same card); cleared before repopulating. Not yet committed or pushed in any of the three repos.

(whitepapers/recap-cards/{fr,en}/{01,03,04,06,25,c01-c05,c11,c12,m01,m03,m04,m10-m14,m20-m22,t02,t04,t06-t10,t11-t15,t16-t20,t21,t22}.qmd; C06-C10, M05-M09, and M15-M19 documented separately below): the same 12-agent audit pass covering the 13 main whitepapers found comparable drift across the 57 recap cards. Notable fixes: a fabricated Ctrl+J "open Claude Code" shortcut and a --no-stream flag that doesn't exist (01); --dangerously-skip-permissions claimed to skip all of .claude/ when the guide scopes it to skills/, agents/, commands/ only, plus a stale threat-db count (v2.15.0/28 CVEs vs the current v2.27.0/118 CVEs) (03); a stale settings.json model id (04, 06); a 3-command production pipeline card (M14, "Plan-Validate-Execute") whose body described a completely different, generic workflow (manual Plan Mode) under the real feature's name, rewritten to the actual /plan-start//plan-validate//plan-execute pipeline; a card built entirely around .claudeignore (T09, "Workspace Hygiene"), which never existed as a real feature per this repo's own CHANGELOG, rewritten around permissions.deny; sandbox network config using nonexistent policy/deniedDomains keys instead of the real sandbox.network.strictAllowlist (T16); a full model-pricing table stuck on Sonnet 4.6/Opus 4.8 figures, a missing xhigh effort tier, and a "Three Models" title over four listed models (T18); MCP Apps claimed to render inside the CLI when the guide states explicitly it's Desktop/VS Code/ChatGPT only, no CLI support (T12); Sequential Thinking "triggers" listed as fabricated --think/--think-hard/--ultrathink CLI flags that aren't real Sequential Thinking triggers (T13); and a TaskCreate/hook stdin-reading pattern with the wrong call shape across several M-series cards. guide-version/version bumped to 3.41.3 and date to 2026-08-24 across all 57 pairs (114 files). Full findings: claudedocs/whitepaper-content-audit-2026-08-24.md.

(whitepapers/recap-cards/{fr,en}/c0{6,7,8,9}-*.qmd, whitepapers/recap-cards/{fr,en}/c10-ai-traceability.qmd): C06 (Configuration Decision Guide) opened with a fabricated "56% of teams don't use a shared project configuration" statistic that does not exist anywhere in the guide or whitepapers, actually a misapplied copy of the unrelated "56% of sessions" skills-invocation figure from guide/ultimate-guide.md; reworded to drop the invented number while keeping the underlying point. C08 (Attack Surface & Threats) claimed Claude Code writes tool calls to ~/.claude/logs/session-*.jsonl, a path that does not exist for that data; per guide/ultimate-guide.md's Data Sources section, tool calls live in the session transcript at ~/.claude/projects/{encoded-path}/{session-id}.jsonl, corrected in prose and in the jq example command. C08's CVE table was also missing ADVISORY-CC-2026-002 (deny rules silently dropped past 50 subcommands, fixed in v2.1.90), present in examples/commands/resources/threat-db.yaml and guide/security/security-hardening.md but absent from the card; added as a row. C10 (AI Traceability) illustrated the Co-Authored-By trailer with the superseded Claude Sonnet 4.6; corrected to Claude Sonnet 5, the current default model. C07 (Team Conventions at Scale) and C09 (Prompt Injection Defenses) verified clean against guide/security/security-hardening.md and current CLI flag documentation, no other content issues found. All 10 files' guide-version and version bumped to 3.41.3, date updated to Août/August 2026.

(whitepapers/recap-cards/{fr,en}/m0{5,6,7,8,9}-*.qmd): M06 (Task Management System) and M07 (TodoWrite vs Tasks API) presented the Tasks API and TodoWrite as available by default with no caveat; both are disabled by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models since v2.1.233 (re-enable with CLAUDE_CODE_ENABLE_TODO_TOOLS=1), added as a callout to both cards per guide/core/claude-code-releases.md. M06's status table listed a cancelled status that does not exist in the Tasks API; corrected to the documented failed status (used with error metadata for debugging, per guide/ultimate-guide.md line 4880). M07 FR claimed the Tasks API became default "depuis v2.1.19" and invented a --task-manage CLI flag with no source anywhere in the guide or CHANGELOG; corrected to the actual default-activation version (v2.1.142, per guide/core/settings-reference.md and guide/core/tools-reference.md) and the flag section rewritten to match the accurate description already present in the EN sibling. M08 (Custom Agents) cited agent persistent memory as introduced in "v2.1.32+" in two places; corrected to v2.1.33 per guide/ultimate-guide.md line 7009, and the model frontmatter field table was missing the inherit value listed in the guide's own field reference. M05 (Plan Mode) and M09 (Slash Commands) verified clean against guide/ultimate-guide.md §2.3 and the CC 2.1.3 skills/commands unification note, no content issues found. All 10 files' guide-version and version bumped to 3.41.3, date updated to Août/August 2026.

(whitepapers/recap-cards/{fr,en}/m1{5,6,7,8,9}-*.qmd): M16 (Multi-Agent Topology) invented an unsourced "~7 directories or 50 files" threshold for switching to multi-agent, contradicted by its own table two lines below and by guide/workflows/agent-teams.md's actual line-count metric (10K/50K/100K+ lines); rewrote the paragraph and fixed the table's first row from "<10 répertoires"/"<10 directories" to "~10K lignes"/"~10K lines" to match the guide's real unit. M16 also referenced the superseded Claude Opus 4.8 as the recommended Agent Teams model in three places (context-window note, prerequisites line, dedicated-reviewer guardrail); corrected to Opus 5 per guide/ultimate-guide.md's "Model lineup" note and guide/workflows/agent-teams.md's stated model requirement, and the reviewer ratio "1:4" loosened to "3 to 4" to match the guide's actual "1 reviewer per 3-4 builders." M19 (GitHub Actions) pinned the GitHub Actions example workflow to claude-sonnet-4-6, a superseded model id; corrected to claude-sonnet-5 per examples/github-actions/claude-code-review.yml. M15 (TDD/BDD/SDD) illustrated the Tasks API with a fabricated TaskCreate: { title: ..., blockedBy: [...] } object-literal call shape; corrected to the documented TaskCreate("title", { blockedBy: [...] }) positional-argument signature per guide/ultimate-guide.md line 17917. M17 (Communication & Trust) and M18 (Event-Driven Agents) verified clean against guide/workflows/agent-teams.md and guide/workflows/event-driven-agents.md respectively, no content issues found. All 10 files' guide-version and version bumped 3.41.0 → 3.41.3, date updated to 2026-08-24.

(whitepapers/{fr,en}/{00,01,03,04,05,06,08,09,10,11}-*.qmd; WP02, WP07, and WP12 documented separately below since their agents wrote their own entries): a background workflow (13 parallel agents, one per whitepaper pair, comparing each file against guide/**, CHANGELOG.md, and guide/core/claude-code-releases.md) found the same class of drift repeated across the series: Opus 4.8 still presented as the current default model where Opus 5 (v2.1.219) has replaced it (WP00, WP04); sub-agent nesting depth stated as "5 levels" where the current default is 3 since v2.1.219, after a brief drop to 1 in v2.1.217 (WP00, WP04); --safe-mode mischaracterized as adding validation before risky actions when it actually disables all customizations for troubleshooting (WP00); a fabricated MultiEdit tool listed among the 10 core native tools, which does not exist in the current 40-tool set (WP04); TodoWrite presented with no caveat despite being disabled by default on Sonnet 5/Opus 4.8/Fable 5 and newer since v2.1.233 (WP04); a fabricated --no-human-approval-required CLI flag and a wrong settings.local.json path (WP05); three dead internal links using pre-reorganization paths, guide/data-privacy.md and guide/ai-traceability.md instead of their guide/security/ and guide/ops/ locations (WP06); Agent Teams' "all teammates run the same model" constraint going unstated (WP08); a dead link to a nonexistent guide/roles/team-deployment.md page (WP11); and assorted stale line/template/hook counts and version stamps throughout. wp-version bumped by one patch per fixed pair, version synced to 3.41.3, date bumped to 2026-08-24 where the file already carried a date field. Full findings and fixes: claudedocs/whitepaper-content-audit-2026-08-24.md (not checked in, gitignored working doc).

(whitepapers/{fr,en}/{01,07,09,12}-*.qmd): the content-accuracy fix pass above bumped each file's YAML frontmatter version to 3.41.3, but 8 files (WP01, WP07, WP09, WP12, both languages) carry a second, hardcoded *Version X.Y.Z | Month Year* line in their closing footer that several agents left at the old 3.41.1 | Juillet/July 2026 value. Synced all 8 to 3.41.3 | Août/August 2026, preserving WP07's and WP09's additional parenthetical/date-tracking text.

(whitepapers/fr/07-guide-reference.qmd, whitepapers/en/07-reference-guide.qmd): the model table omitted Claude Opus 5 entirely and labeled the now-superseded Opus 4.8 as current, corrected against guide/ultimate-guide.md's "Model lineup July 2026" note and CHANGELOG v2.1.219 (Opus 5 added as opus, May 2026; Opus 4.8 relabeled previous-gen, default on Bedrock/Vertex/AWS only). Claude Fable 5's knowledge cutoff was listed as "June 2026" (the whitepaper's own authoring date, not the model's actual cutoff), corrected to January 2026 per the guide's knowledge-cutoff table. Sub-agent nesting depth was stated as "5 levels" in three places; per CHANGELOG and guide/core/claude-code-releases.md nesting was disabled by default in v2.1.217 and restored to depth 3 (not 5) in v2.1.219, corrected in the body text and both closing-footer version summaries. The /branch row said it "replaces /fork" with no further context; /fork reappeared in v2.1.212 with a distinct meaning (copies the conversation into a separate background session, not a parallel timeline), noted inline. EN's hook-events table and lead sentence were missing 3 of 30 documented events (PostToolBatch, UserPromptExpansion, MessageDisplay) that the FR sibling already listed; added to match FR and guide/core/hooks-events-reference.md, and the "30 events total" figure now stated explicitly in both languages. EN's synthesis blurb cited fabricated chapter numbers ("Ch.8b Migration, Ch.9 IDE...") that don't match the document's actual chapter order; dropped in favor of the FR phrasing (topic list, no numbers). Guide line count and template count were each cited under three different stale figures within the same document (22,000/19,000/26,600 lines; 189/232/271 templates); harmonized on the current figures (~26,600 lines, 271 templates) throughout both files. Both frontmatters bumped version 3.41.1 → 3.41.3 (current guide version) and wp-version 1.4.1 → 1.4.2 (patch, content correction only, no new sections).

(whitepapers/fr/07-guide-reference.qmd, whitepapers/en/07-reference-guide.qmd): the prior WP07 fix (above) relabeled Opus 4.8 as previous-gen but left "Actuel"/"Current" in the Knowledge Cutoff column, a value that doesn't fit that column and doesn't match any date. Corrected to "Janvier 2026"/"January 2026" per guide/ultimate-guide.md's knowledge-cutoffs table (line 3032). Both frontmatters bumped wp-version 1.4.2 → 1.4.3 and date 2026-07-02 → 2026-08-24; version already at 3.41.3.

(whitepapers/fr/02-personnalisation.qmd, whitepapers/en/02-customization.qmd): the SKILL.md frontmatter examples and field table listed a fabricated agent: specialist/general field not present in guide/ultimate-guide.md §5.2's field set; removed from both the generic template and the security-guardian example, replaced with real fields (model: haiku, effort: low). The context: fork explanation presented fork isolation as unconditional protection for destructive operations; added the documented limitation from §5.2 that fork is ignored when a skill is invoked via the Skill tool from agent code, and only activates for a user-typed slash command. The agent frontmatter's memory field was described and exemplified as an inline pre-populated text block (memory: | followed by prose); corrected to its real scope-selector syntax (memory: project) per §4.2, mapping to ~/.claude/agent-memory/<name>/, .claude/agent-memory/<name>/, or .claude/agent-memory-local/<name>/. The "3 Scopes of Memory" table conflated Auto-Memory (guide/core/memory-systems.md §2.2) with the Agent Memory frontmatter field and got both wrong: no .claude/MEMORY.md/.claude/MEMORY.local.md files exist, Auto-Memory actually stores at .claude/memory/MEMORY.md (project) and ~/.claude/projects/<path>/memory/MEMORY.md (global), with no gitignored third scope; split into two accurate sections, one for Auto-Memory storage paths and one for the Agent Memory frontmatter's real three directory-backed scopes. Agent Teams' experimental-status callout mislabeled it "community-discovered" with "no official Anthropic support"; per guide/workflows/agent-teams.md it is an official Anthropic research preview (v2.1.32+, flag CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1), corrected while keeping the production-caution advice. model: opus-4.6 (a stale pinned version) replaced with the generic opus alias in both the frontmatter field table and the Model Selection table, matching §4.2's real value set and the current Opus 5 default (v2.1.219). FR alone still recommended a separate .claude/commands/ folder in its final "Structure Recommandée" tree and Git Rules line, contradicting the same document's own "commands live in skills/ since CC 2.1.3" statement earlier; replaced with the unified skills/tech/commit/SKILL.md tree already used by the EN sibling, and dropped commands/ from the committed-paths list. FR alone is still missing the Dynamic Workflow row in the Agent vs Skill vs Command table and the Auto Dream memory-consolidation paragraph that EN already has; left unaddressed, that gap is a parity backfill, not a content-accuracy correction, and was out of scope for this pass. Both frontmatters bumped version 3.41.1 → 3.41.3 (current guide version), wp-version 1.5.1 → 1.5.2 (patch, content correction only, no new sections), and date 2026-07-02 → 2026-08-24.

(whitepapers/en/12-agent-engineering.qmd, whitepapers/fr/12-agent-engineering.qmd): the EN closing footer read "Version 3.41.0 | May 2026", contradicting the file's own frontmatter (3.41.1) and the FR sibling's footer ("Version 3.41.1 | Juillet 2026"), fixed to "Version 3.41.1 | July 2026". EN also compressed the FR "Claude Code: Native Workflow Primitives" subsection (three engineering guarantees, the ultracode/workflow rename in v2.1.160, and the Agent tool/Skill/Workflow decision rule) into a single sentence buried in "Multi-Agent Frameworks: Build vs Use", giving EN readers materially less operational guidance than FR on the same feature; added the missing subsection to EN, translated from FR, and trimmed the now-redundant compressed sentence to a cross-reference. Both frontmatters bumped version 3.41.1 → 3.41.3 (current guide version) and wp-version 1.1.0 → 1.1.1 (patch, content correction only, no new sections).

user-relayed Slack discussion surfaced FlashML-org/FreeToken (verified: 7,342 stars, Apache 2.0, pushed same day, arXiv paper at arxiv.org/abs/2608.16157 with credible co-authors including Song Han and Ion Stoica), which contradicted a claim this page had published: that MoE experts have no shortcut around full-VRAM residency. Checked llama.cpp's own GitHub docs and issue discussions to confirm independently: its --n-cpu-moe/--cpu-moe flags do keep MoE expert tensors in CPU RAM while streaming only the per-token active experts to GPU over PCIe, a real (if not literal every-expert-loaded-nowhere) shortcut. FreeToken implements a more elaborate version (bandwidth-adaptive hybrid PCIe-fetch/CPU-compute split, LRU expert caching, calibrated via ft bench bw), and its README's own claim of 3-4x faster decode / 6-30x faster prefill than Ollama is cited as vendor-reported, not independently verified. Rewrote the paragraph to state the real constraint (full expert set must be resident in system RAM, not VRAM, with only active experts streamed) rather than the previous absolute claim, and softened the "does not fit" verdicts for GLM-5.2 and DeepSeek-V4-Pro accordingly: both become usable with enough system RAM and a CPU-offload-capable engine, just not via naive full-VRAM loading. Included Slack-relayed, explicitly-labeled-unverified community throughput numbers (39.3 tok/s on an 8GB laptop GPU + 64GB RAM for a 35B MoE; 22 tok/s on an RTX 5090 + 192GB RAM for DeepSeek-V4-Flash 284B; 14.9 tok/s on a 96GB workstation GPU + 512GB RAM for GLM-5.2 753B). Also fixed a stale reference in the same paragraph still citing Kimi-K3 at "5.5T parameters," missed in an earlier correction pass that had already fixed the same figure in the table above it (the real, officially-confirmed figure is 2.8T).

user-reported screenshot from the live site showed a full sentence rendered struck through. Root cause: the page used a bare ~ (tilde) throughout as an "approximately" marker (91 occurrences, e.g. ~€13,578), and the landing site's Markdown renderer treats a single ~ as a strikethrough delimiter rather than requiring GFM's double ~~, so any paragraph containing two unrelated ~-prefixed numbers had everything between them rendered struck through. Replaced every occurrence with the unicode ≈ character, which carries the same "approximately" meaning and isn't a Markdown control character in any renderer. No numbers or meaning changed, purely a character substitution.

the previous commit's model-generation update trusted llmfit info "moonshotai/Kimi-K3" at face value (5,526.6B total, no MoE expert breakdown exposed), a scrape error. A second verification pass against Moonshot AI's own GitHub repo (github.com/MoonshotAI/Kimi-K3) and product page confirmed the real figure: 2.8T total parameters, 16 of 896 experts active per token (~50B active, calculated, not officially stated as a round number). The full-weight VRAM requirement was recalculated by extrapolating from DeepSeek-V4-Pro-0813's own confirmed VRAM-per-parameter ratio (845.4 GB / 1,650.5B) rather than trusting llmfit's wrong entry for this specific repo, landing at roughly 1,430 GB instead of the previously published 2,831 GB. Also corrected: DeepSeek-V4-Pro-0813's active-parameter count is officially confirmed at 49B (Hugging Face model card), not left unstated as in the prior pass, and its GA release date (August 13, 2026) is now confirmed via Reuters rather than inferred from the -0813 filename suffix alone. Also corrected a false claim in the prior CHANGELOG entry: GLM-5.3 does exist as an official Zhipu/Z.ai announcement (August 17, 2026), sharing GLM-5.2's base architecture and parameter count with a staged, coding-focused post-training upgrade; it was not a hallucination the way "Muse Glimmer" and the specific "GLM-5.3 as a distinct 753B base" framing were. Added a "Data Snapshot Date" pointer to two continuously-updating trackers, llm-stats.com and benchlm.ai, for readers who need current numbers past this page's fixed snapshot.

user feedback flagged the reference models (Llama 3.1/3.3 70B, Qwen2.5, Mixtral 8x22B, DeepSeek-V3) as dated. Replaced with the August 2026 generation, each verified via llmfit search against real HuggingFace repos and queried on the official lab's own org (not a third-party quant mirror) with llmfit info: Qwen/Qwen3.8-27B (dense, 27.8B, Apache 2.0), meta-llama/Llama-4-Scout-17B-16E-Instruct (108.6B total MoE, 1 of 16 experts active), meta-llama/Llama-4-Maverick-17B-128E-Instruct (401.6B total MoE), zai-org/GLM-5.2 (753.4B total MoE, MIT), deepseek-ai/DeepSeek-V4-Pro-0813 (1,650.5B total MoE, MIT), Qwen/Qwen3.8-2.4T-A95B (2,446.2B total MoE), and moonshotai/Kimi-K3 (5,526.6B total). A first Perplexity research pass had returned several fabricated or unconfirmed names (a "Muse Glimmer 30B" from Meta, "GLM-5.3", "DeepSeek-V4-Pro" claimed as 49B active) sourced from low-authority blog aggregators rather than official pages; cross-checking every claimed name against llmfit's HuggingFace-scraped database caught this before publication (GLM-5.3 returns zero results, the real current GLM is 5.2 at 753.4B, matching the number Perplexity had misattributed to the fake 5.3). Also added a technical clarification the previous table lacked: for MoE models, llmfit's "active VRAM" figure (the per-token compute cost) is not a substitute for the "full weight" figure (the actual deployment requirement), since routing picks a different expert combination per token and the entire expert set must stay resident. Updated the frontier-gap framing (DeepSeek-V3's 350.6 GB grew to DeepSeek-V4-Pro's 845.4 GB) and the Decision Framework's 405B reference to Llama 4 Maverick's confirmed 401.6B. llmfit's own data quality has gaps worth flagging for future updates: Llama-4-Maverick-17B-128E-Instruct (128 experts per its name) and Llama-4-Scout-17B-16E-Instruct (16 experts) both report an identical "1 active / 16 total" MoE breakdown, an apparent scrape error not corrected in this pass since it doesn't affect the full-weight figures actually cited.

user-reported screenshot showed the diamond node "Data must never leave your infra?" rendering as "Data must never" with the second <br/> line dropped, and several rectangle nodes (buy/rent/license recommendations) similarly cut short, in a non-GitHub Mermaid renderer. Shortened every multi-line node label (Data must stay on your own infra?, Need over 70B or max quality?, Committed for over a year?, and the three recommendation nodes) so each line is shorter and less likely to overflow a fixed-size node regardless of renderer, without changing the diagram's logic or the click target anchors. ASCII fallback updated to match.

(scripts/generate-guide-exports.sh, docs/workflows/whitepaper-build.md): added the supported quarto typst CLI as a portable fallback between a standalone Typst install and Quarto's legacy macOS-only bundle path. Pandoc/Typst diagnostics are no longer discarded; each run uses an isolated, automatically cleaned build directory; and all requested outputs are staged and verified before replacing existing exports.

(docs/superpowers/plans/2026-08-31-mcp-product-source-brief.md, docs/superpowers/plans/2026-08-31-mcp-product-launch.md): verified the local 1.3.0 runtime, public npm 1.2.10 state, capability counts, index size, companion commands, download periods and official MCP Registry absence. The plan separates stable capabilities from dated statistics, gates publication on archive evidence, defines three public surfaces, fixes consent before new analytics events, and keeps observability, first-party telemetry and cohort research outside the 1.3.0 critical path.

(~/Sites/perso/florian-portfolio/src/data/mentions.json, /mentions/, and .agents/skills/source-command-track-mentions/SKILL.md): expanded the guide reference log into a catalog covering 15 active public projects, with RTK and support repositories excluded. The page tracks 64 unique source URLs, assigns one source to several projects without duplication, separates 34 editorial or community mentions from three visible repository integrations and 23 registry or directory entries, and shows five projects for which this search found no verified third-party reference. Added confirmed coverage for the Cowork guide, StarMapper, CCBoard, CC-Copilot Bridge, ctxharness, Dep Scope, flow-lean, Google Search Console MCP, and Claude Code Plugins. The tracking skill now supports a portfolio mode with canonical URL deduplication, project identifiers, adoption and registry classifications, and explicit zero-result reporting.

(docs/media-mentions/mentions.yaml, docs/media-mentions/README.md): replaced the April 14 snapshot with a 46-reference catalog updated on August 30. Added four confirmed editorial or community recommendations, two credited translations, and six automated directory entries. The published totals now separate 44 third-party references from two author posts and keep automated indexes distinct from earned recommendations; inaccurate MCP-directory metadata is recorded for correction instead of repeated as fact.

(README.md, machine-readable/navigation.json, schema and validator, plus the landing /changelog/, /guide/, /sitemap/, header, footer, Cmd+K, RSS, and XML sitemap): replaced the 1,003-line repository front page with a 390-line source-oriented entry point organized around Start, Build, Scale, Resources, and Updates. The README and public sitemap now consume the same validated manifest, while long-form material stays in its existing guide pages. The repository remains canonical for Markdown sources and reusable artifacts; the website owns reading and discovery. /releases/ remains exclusively about Claude Code versions, and its inactive guide-changelog loader was removed.

(mcp-server/src/server.ts, bundled indexes, and agent-harnesses.json): synchronized the runtime handshake version with the npm package version. A clean build, dry-run package inspection, JSON-RPC initialization, tool listing, and resource listing confirm 17 tools, 1,751 search entries, 228 Claude Code releases, and the Agent Harness Map resource before publication.

(guide/core/{agent-harness.md,loop-graph-engineering.md,context-engineering.md}, guide/workflows/agentic-software-factories.md, guide/ecosystem/practitioner-insights.md, and docs/resource-evaluations/pavan-belagatti-agentic-engineering-2026.md): verified 62 English WebVTT transcripts, corrected the "agents do the work, humans provide the gates" timestamp from 1:13 to 1:37, and separated repetitive execution from human governance. Added a software-factory operating model, shared-context failure boundary, four paraphrased insights, six source entries, and a scored resource evaluation. Port appears in 33 unique transcripts and remains labeled as vendor-oriented implementation evidence rather than an independent architecture benchmark; GraphRAG and 10x claims were not promoted.

(guide/core/loop-graph-engineering.md, docs/resource-evaluations/loop-graph-engineering.md, examples/workflows/bounded-loop-*, navigation, glossary, evaluation, observability, workflow pages, machine-readable indexes, MCP mirror, WP12 FR/EN, C14 FR/EN, bilingual cheatsheets, and the landing): added a contract-first guide to bounded loops, executable workflow graphs, durable execution, judgment allocation, recovery, and telemetry. The page separates practitioner vocabulary from emerging research terminology, links current primary documentation, includes a bounded YAML graph contract and a Mermaid selection diagram, and keeps the runtime and product taxonomies on their existing canonical pages. A runnable Python example demonstrates a separate verifier interface, attempt budgets, evidence, and escalation. The landing gains the public page, Cmd+K routes, RSS entry, HTML and XML sitemap coverage, and an updated announcement. Targeted PDF, EPUB, HTML, cheat sheet, and recap-card renders were regenerated and validated for guide version 3.43.0.

written after a practitioner Slack thread (350-person org, roughly 300 engineers) surfaced a recurring gap. The guide already had per-task cost economics (ai-unit-economics.md), gateway mechanics (api-gateway.md), and single-machine local hardware economics (local-vs-cloud-inference.md), but nothing tying seat-based subscriptions, Enterprise usage billing, and self-hosting into one team-scale decision. The new page documents the Claude Team 2 to 150 seat cap and $20/$100 (annual) seat pricing, and Enterprise's $20/seat plus API-rate usage, both verified live against claude.com/pricing on 2026-08-29 rather than taken from the thread. It flags that Anthropic's own pricing page does not document cross-workspace artifact or Design sharing, so a multi-workspace split past 150 seats should be verified with Anthropic sales rather than assumed. It also states why a personal Pro/Max plan is a compliance gap (no DPA, no admin control, Consumer Terms scope) independent of its retention settings, which already match Team/Enterprise by default. guide/ecosystem/local-vs-cloud-inference.md gains a "Sizing Self-Hosted Inference for a Team" section: two independently sourced concurrent-throughput benchmarks (GeneralCompute's Llama 8B/70B vLLM numbers, Developers Digest's 671B-MoE break-even analysis), and the finding that self-hosting a frontier-scale open-weight model costs more than 11 times a cheap open-weight API even at 100% utilization, breaking even only above roughly 50 to 100 sustained concurrent requests and only against a premium proprietary API, plus the $5,000 to $15,000/month ops-cost floor the source analysis adds on top of GPU rental. guide/ecosystem/agentic-tools.md section 1.5 gains an opencode Go subsection (source opencode.ai/docs/go, verified 2026-08-29): $10/month with $12 per 5 hours, $30 per week, and $60 per month usage caps, and the concrete disqualifier for team use, only one member per workspace can subscribe to Go regardless of its per-request economics. reference.yaml and its mcp-server mirror gain nine new deep_dive keys; guide/README.md gains the new page's row. validate-reference-yaml.py --ci and check-index-coverage.py --check both pass clean (702/702 anchors resolve, 97/97 files indexed).

(guide/core/{agent-harness.md,glossary.md}, guide/ecosystem/{agent-harness-landscape.md,agentic-tools.md}, guide/roles/agent-evaluation.md, guide/ops/observability.md, guide/security/security-hardening.md, docs/resource-evaluations/liza-mas-framework.md, machine-readable indexes and MCP mirrors): analyzed Tangi Vass's private Liza comparisons against the pinned Liza source, official LangGraph documentation, first-party loop-engineering essays, and primary reviewer/self-correction research. The guide now separates feedback loops, executable graphs, harness controls, and orchestration; assigns product intent, mechanical acceptance, semantic sufficiency, exceptions, and release authority explicitly; replaces the unsupported universal creator-verifier uplift with mixed task-dependent evidence; and evaluates reviewer independence across context, model/provider, evidence, role, and escalation authority. Liza is documented as a domain-specific organization graph plus runtime work graph, with workflow correctness separated from task correctness. Its own issue ledger now supports the published limits: provider diversity is preferred rather than guaranteed, reviewer accuracy is unmeasured, and human checkpoints remain load-bearing. Added Hippolyte Durix's bounded Ippon REX, roughly 30 tasks, 5 sprints, 35 verdicts, 3 corrected rejections, 3 to 4 human hours, and massive token use, while explicitly rejecting production or comparative conclusions. Added graph-level trace fields and a security comparison between Codex execpolicy, experimental bash-policy, and OS-level sandboxing.

(guide/core/agent-harness.md, guide/images/agent-harness-reliability-loop.webp, .github/workflows/collect-agent-harnesses-github.yml, machine-readable/agent-harnesses-github.schema.json, scripts/collect-agent-harnesses-github.py, scripts/build-agent-harness-page.py): integrated the selected 1376 x 768 reliability loop diagram next to the engineering definition. Added a Monday 06:17 UTC collector for 179 canonical GitHub repositories. It recomputes the catalog checksum, enforces strict fields and timestamps, bounds responses and API quota, reuses checksum compatible ETags, writes atomically, and uploads a 14 day candidate artifact. The job has read only repository permissions and never commits, opens a pull request, changes editorial classifications, or updates editorial freshness dates. Promotion remains a separate human review.

(guide/ecosystem/{agent-harness-landscape.md,agentic-tools.md}, guide/core/agent-harness.md, guide/roles/agent-evaluation.md, guide/security/security-hardening.md, guide/workflows/spec-first.md, docs/resource-evaluations/liza-mas-framework.md, machine-readable catalog and indexes): cloned liza-mas/liza at commit a22c12381c5d884d2586a48aaaa517bca184f9cf, inspected supervisors, state transitions, leases, recovery, worktrees, provider adapters, merge gates, and 296 Go test files, then verified the exact commit's successful Ubuntu and macOS CI jobs. Classified Liza as a repository-harness plus adjacent control plane over external coding-agent CLIs, not a runtime that owns the inner tool loop. Added its evidence-pinned profile, current 363-star GitHub snapshot, provider permission warning, and architectural-issues boundary. The map now contains 192 projects in total: 160 pinned upstream projects plus 32 guide supplements, including 15 adjacent control planes, while retaining 42 strict runtimes. The landing banner, RSS entry, and Cmd+K index now expose the updated map and Liza profile. Local tests of Liza were not run because Go was unavailable on the review host.

(guide/core/{agent-harness.md,glossary.md}, guide/ecosystem/{agent-harness-landscape.md,agentic-tools.md}, guide/{roles/agent-evaluation.md,ops/observability.md,security/security-hardening.md}, guide/cheatsheet.md, WP12, C14, bilingual cheatsheets, navigation and machine-readable indexes): replaced the universal "harness matters more than model" framing with the evidence-bounded model-harness pair. Added controlled scaffold-effect results, repeated-run reliability measures, component-interference evidence, AgentDojo and CaMeL security benchmarks, current OpenTelemetry GenAI attributes, and an outer-loop research table covering ADAS, AFlow, ACE, GEPA, Meta-Harness, Agentic Harness Engineering, and HarnessOpt-Bench. The guide now separates runtime harnesses, repository harnesses, orchestrators, evaluation harnesses, harness optimizers, and meta-harnesses; documents held-out evaluation, frozen invariants, explicit budgets, candidate lineage, and multi-metric promotion; and labels recent optimizer results as preprints with transfer and contamination limits rather than product claims. WP12 moves from 1.2.0 to 1.3.0.

(guide/core/agent-harness.md, guide/ecosystem/agent-harness-landscape.md, README.md, guide/README.md, machine-readable/{README.md,llms.txt,reference.yaml}, root llms.txt, MCP mirrors): checked ten short verbatim quotations against their local WebVTT transcripts, linked each quotation to the exact YouTube timestamp, and labeled every source as official current evidence, a dated creator interview, or a practitioner talk. The engineering page now covers inner, outer, and meta feedback loops; context outside the repository; codification of recurring review feedback; Claude Code permission-system rationale; outcome and tail-latency measures; proof bundles; and requirement-level executable-spec verification. The Landscape keeps official docs and canonical repositories as the source of truth, adds Claude Code and OpenCode creator interviews as supplementary design evidence, and expands its test-drive protocol with turns to accepted completion, requirement coverage, proof artifacts, and tail latency. New machine-readable routes expose the engineering page, loop-horizon section, and video-evidence ledger.

(31 files under guide/, 5 files in the sibling florian-portfolio repo, plus a working-doc audit at claudedocs/internal-linking-audit-2026-08-28.md, gitignored): a full inventory found the guide almost never linked out to itself or to the author's own writing, only 3 links to florian.bruniaux.com existed across all 104 guide files, 13 guide pages had zero outbound links to any other guide page, and 9 pages were unreachable from guide/README.md's navigation hub. Fixed all three: added the 9 missing pages to guide/README.md (core reference rows, top-level entry points, an ecosystem row, two workflow rows, and pointed the diagrams intro link at diagrams/README.md directly instead of the bare directory), gave each of the 13 orphan pages one outbound cross-link (including sequential Previous/Next links across the five learning-path modules that had none), added one topically-matched link per file from 10 guide pages (security, context engineering, roles, TDD, agent teams, MCP servers) to the corresponding florian.bruniaux.com article or guide, cited the author's own open-source tools (rtk, ccboard, cc-sessions, ctxharness) by name in 5 ops/core/roles pages where they were relevant but previously unmentioned, and added 5 reciprocal links from florian-portfolio pieces (claude-code-under-the-hood, context-engineering-team-system, mcp-servers-token-cost, plan-execute-migrations, tdd-avec-claude-code) back to the matching guide page. A parallel coverage audit of examples/, docs/, tools/, scripts/, quiz/, and mcp-server/ against machine-readable/ found the guide template count is inconsistent across the repo's own files (README.md claims 271, examples/CATALOG.md claims 181, actual count is 224 non-README .md files), 3 to 4 of the 7 files in tools/ have no deep_dive entry in reference.yaml, and docs/resource-evaluations/README.md's self-reported tracking backlog has grown to 175 files on disk against its own last count. Separately, running the existing scripts/validate-reference-yaml.py --ci gate surfaced 27 pre-existing hard failures (anchor line numbers drifted 45 to 93 lines from their real heading, 11 fully broken anchors in guide/cheatsheet.md and guide/workflows/smart-suggest-routing.md), unrelated to this linking pass; see the Fixed entry below, all 27 are now resolved.

(README.md, guide/core/agent-harness.md, guide/ecosystem/{agent-harness-landscape.md,agentic-tools.md}, machine-readable/{README.md,llms.txt,reference.yaml}, root llms.txt, MCP mirrors): kept the stable architecture reference separate from the dated product catalog, then added a shared question-to-page router and related-reading paths across architecture, tools, hooks, context, memory, evaluation, observability, security, teams, software factories, glossary, repository harness engineering, releases, and normalized data. Corrected the engineering page against Claude Code releases through v2.1.250: automatic compaction is no longer described as manual-only, the hook section now names the real event model instead of nonexistent generic pre/post-LLM hooks, native tools are separated from loadable Skills, inherited subagent permission mode is documented with least-privilege controls, and current worktree, network-allowlist, and --restricted boundaries are mapped to release evidence. Added the Landscape page to reference.yaml's file_sections, moved the canonical harness definition route to the engineering page, and kept both YAML and all three llms.txt copies byte-identical.

(guide/ecosystem/local-vs-cloud-inference.md#serving-engine-tuning-vllm-in-production): new section covering compilation optimization levels (-O0 to -O3), automatic prefix caching, chunked prefill, KV cache preemption, TP/PP/DP/EP parallelism strategies, and multimodal processor cache flags, sourced against the official vLLM docs. Corrects two claims from a circulating LinkedIn optimization post: -O3 is documented as currently identical to -O2, not a distinct aggressive tier, and vLLM's CPU-binding/NUMA-pinning feature is scoped to the vllm-ascend (Huawei NPU, ARM) plugin, not standard CUDA deployments. Indexed in machine-readable/reference.yaml and mcp-server/content/reference.yaml as local_vs_cloud_vllm_tuning.

(guide/ecosystem/local-vs-cloud-inference.md#coding-agent-setup-apple-silicon-with-mlx): new section covering the MLX-side equivalent of the vLLM section above, model pairing (Qwen3.6-35B-A3B MoE for daily agent turns, Qwen3.8-27B dense for harder reasoning, both verified against their HuggingFace model cards), a runtime comparison (MLX/mlx-lm, llama.cpp Metal, LM Studio's mlx-engine, Ollama) that separates officially-verified facts from vendor-published and third-party-blog numbers, memory/context budget guidance, and a mlx_lm.server + launchd service recipe. Also added Qwen/Qwen3.6-35B-A3B to the "What Actually Fits: Named Models" table. Corrects a circulating research report's use of the older Qwen3.6-27B dense model (superseded by Qwen3.8-27B, already this page's reference model, strictly better on every compared benchmark) and flags a misattributed citation (a claimed "Apple scalable inference paper" TTFT figure that traces to an unrelated, non-Apple arXiv paper with different numbers). Indexed as local_vs_cloud_mlx_coding_agent.

(guide/ecosystem/agent-harness-landscape.md, machine-readable/agent-harnesses.json, machine-readable/agent-harnesses.schema.json, scripts/build-agent-harnesses.py, scripts/build-agent-harness-page.py): pinned and normalized all 160 projects across the 12 Best of Agent Harnesses categories, then added 32 directly researched guide supplements, for 192 projects in total. The reader-facing map separates 42 strict runtimes from 15 adjacent control planes, gives every project an official external URL including Devin, dates every displayed GitHub star count, preserves confirmed, claimed, unknown, and not-applicable evidence states, and adds a repeatable 8-to-12-task test-drive protocol. Three new visuals explain the 160-project boundary, four-layer taxonomy, and selection funnel. Cross-links now cover architecture, evaluation, observability, security, software factories, team practices, glossary, learning paths, whitepapers, cheatsheets, and the C14 recap card. The normalized JSON is available through the claude-code-guide://agent-harnesses MCP resource; MCP package version is 1.3.0.

(guide/images/agent-harness-160-not-runtimes.webp, guide/images/agent-harness-four-layers.webp, guide/images/agent-harness-selection-funnel.webp, docs/visual-prompts/agent-harness-landscape.md): replaced the initial drafts with the three selected Gemini outputs, normalized them to 1600 x 900 WebP assets, and corrected the pilot card from 5-to-10 to the guide's canonical 8-to-12 real tickets before publication.

(guide/workflows/monitor-event-delegation.md, guide/core/tools-reference.md, guide/core/settings-reference.md, guide/ultimate-guide.md): added a canonical workflow separating Monitor command source (v2.1.98+), native WebSocket source (v2.1.195+), experimental plugin monitors (v2.1.105+), MCP Channels (v2.1.80+, preview), and Routines' separate cloud sessions. The GitHub-to-Monitor path now requires signature validation, repository/event allowlisting, schema validation, X-GitHub-Delivery deduplication, and a narrow WebSocket payload before a local Monitor sees it. Codex starts read-only with codex exec; an explicit human or policy gate is required before a separate isolated --sandbox workspace-write task. Raw event bodies and comments are documented as data, never instructions or authorization. Added cross-links from cross-session messaging, generic event-driven agents, GitHub Actions, navigation, and machine-readable indexes; both llms.txt entry points remain byte-identical and now track Claude Code v2.1.250.

(docs/resource-evaluations/switch-agent-human-chat-bridge.md, score 3/5): analyzed a local clone of sandbox-quantum/switch (source, not README claims): a Matrix-based (Tuwunel homeserver) bus connecting heterogeneous agents (Claude Code, Codex, OpenCode, anything speaking its SSE-down/HTTP-up protocol) and humans into Slack, Microsoft Teams, Discord, Telegram, and Mattermost through five real bidirectional bridge adapters, with a centralized owner-inheritance authorization chokepoint (authz.py). Checked three existing guide sections as candidate homes before concluding this is a genuine, previously unfilled category gap, not a placement failure: memory-systems.md §4.7 (Switch has no embedding/retrieval, it's a real-time bus, not a semantic memory system), third-party-tools.md's Multi-Agent Orchestration section (those tools run multiple instances of the same coding agent on one machine; Switch bridges heterogeneous agents to external chat platforms, a different axis), and ai-ecosystem.md's "agent-chat" entry (tagged "Slack-like" in the guide's own prose but verified to be a read-only local SSE dashboard, no live external platform connection). Health signals verified via local git log and gh api repos/sandbox-quantum/switch: created 2026-07-16 (about 6 weeks old), 449 commits, 252 stars, bus factor close to 1 (one author at 80%, a second at 8%), pre-1.0 core version (0.21.0), backed by a funded company (SandboxAQ) rather than a solo project, with real release engineering (Docker Compose + Helm chart artifacts, RELEASING.md). Decision: no dedicated guide section (no comparable peer project exists yet for a routing/comparison table, the guide's precedent for a standalone file), one line in third-party-tools.md's Known Gaps table plus a docs/resource-evaluations/watch-list.md entry, revisit at a tagged 1.0.0 release, an independently documented production deployment outside SandboxAQ/Flint AI, or a second comparable tool appearing. Indexed in machine-readable/reference.yaml and its mcp-server/content/ mirror (4 matching keys), and in docs/resource-evaluations/README.md's tracking table.

(CFO, CMO, CHRO, General Counsel, COO, board of directors), distinct from Gstack's dev-workflow personas. Deep dive on OpenExecutive (SenteLabsAI, Apache 2.0, 838 stars, 8-agent architecture, correctly-structured Anthropic prompt caching, a real eval gate: 29 scenarios, LLM-as-judge, CI threshold ≥3.5/5) as the reference architecture, flagging its unverifiable "Harvard MBA-level knowledge" tagline and the absence of a documented recommendation-vs-decision guardrail on its GC/Board agents. Five open-source alternatives (Become CEO, OneManCompany, AI CFO Agent, Quorum Virtual Board, crewAI) with star counts, licenses, and last-push dates pulled directly from the GitHub API on 2026-08-27, not from secondary write-ups: an earlier Perplexity deep-research pass had misdescribed Gstack itself (claimed 23 roles/8 power tools and ~97k stars, versus the guide's own already-verified 6-skill/124.8K-star description in gstack-workflow.md), which is the reason every number in this new page was independently re-verified rather than trusted from research output. A routing table maps 9 role categories (CFO, CMO, COO, CHRO, General Counsel, Chief of Staff, Sales/CRO, board of directors, build-your-own) to the open-source and commercial project that fits each, explicitly flagging the confirmed gap (no branded "AI CHRO" product exists) and Quorum Virtual Board's near-zero adoption (0 GitHub stars, no license file, meaning no reuse rights are actually granted). Closes on governance: every product surveyed positions itself as augmentation rather than replacement regardless of marketing tone, and the only serious attempt at a legal accountability framework for a fully autonomous AI board member is the theoretical "Synthetic Director" concept (Stirling & Rose, 2023), not implemented in any jurisdiction. Indexed in machine-readable/reference.yaml and its mcp-server/content/ mirror (7 matching keys, verified byte-identical), linked from guide/README.md, root README.md, ai-ecosystem.md's augmentation-vs-replacement section, and third-party-tools.md's Gstack entry (added a one-line disambiguation there since the /plan-ceo-review command name invites confusion with this page's topic).

(score 3/5, moderate, per docs/resource-evaluations/supermemory-memory-context-engine.md): four touch points, no new section. §3.8 Other Notable Tools gains a table row and a paragraph naming its three distinct surfaces (free no-login MCP, claude-supermemory Claude Code plugin gated to a $19/mo Pro plan, self-hosted MIT-licensed binary). §3.9 Master Comparison Table gains a row. §4.7 Why the Team Gap Is Structural gains two sentences citing Supermemory's container tags and paywalled plugin as evidence for existing barriers, not a new one. §9 Benchmarks and Evaluation gains a paragraph on a same-vendor inconsistency: supermemory.ai publishes 95% and 85.4% Recall@15 for the same LongMemEval_s benchmark on two different pages, neither reproduced by a third party. machine-readable/reference.yaml and its mcp-server/content/ mirror both gain three matching keys (verified byte-identical after the edit).

(examples/hooks/bm25-routing/, guide/workflows/smart-suggest-routing.md): rebuilt the runnable UserPromptSubmit example around one global Codex hook that discovers nested project, repository, user, admin, and explicit skill roots from each prompt's cwd. Added deterministic project-over-global shadowing, validated external corpus overlays, content-hashed scope caches, atomic writes, expiring rebuild locks, contrastive negative vetoes, strict status: ok eligibility, bounded $skill or /skill hints, metadata-only logging, a holdout evaluator, an idempotent backup-producing installer, and Node tests. Corrected the previous BM25+ label to Okapi BM25, removed the false confidence percentage and blanket negation opt-out, and documented that additive Codex hook layers must not carry duplicate BM25 handlers.

(guide/images/local-vs-cloud-{entry-tier,decision-tree,hetzner-math}.webp): user-generated (Nano Banana Pro, Bold Guy pencil-on-cream-paper style) from prompts drafted against this page's own verified content, then reviewed for accuracy against the source text before embedding. Two rounds of correction preceded the final assets: a 4th image (a cover for the whole page) rendered as a generic corporate dashboard with fabricated pricing charts instead of the requested hand-drawn style, and was dropped rather than published; a 5th generation of the Hetzner comparison had two clipped text strings ("THE ONE EXCEPTI", "cheaper, even used e") from box-overflow truncation, fixed by shortening the prompt's text and regenerating before use. Placed each image next to the exact paragraph it illustrates rather than clustering them: local-vs-cloud-entry-tier.webp under the Thirteen Comparable Hardware Configurations intro (illustrates the 16 GB entry tier), local-vs-cloud-decision-tree.webp under the Which Local Machine for Which Usage intro (a simplified 3-branch version of that section's own Mermaid decision tree), and local-vs-cloud-hetzner-math.webp directly after the "renting beats buying" paragraph in One-Year Cost Projections. Source files compressed from 550-780 KB JPEG to 50-71 KB WebP (cwebp -q 80 -resize 1400 0) to match this repo's existing guide/images/ file sizes (the one prior image there is 42 KB); sips was tried first but failed on this sandbox's tmp-directory write restriction, cwebp was already installed and worked. Images are gitignored nowhere else in the pipeline: guide/images/* gets copied verbatim into the landing repo's public/guide/images/ by prepare-guide-content.mjs, and the ../images/... relative paths resolve correctly once served at /guide/local-vs-cloud-inference/.

follow-up to the hardware-level Power Consumption section, answering a distinct question the user surfaced (does model architecture itself affect energy per token, and what do labs disclose). User ran an independently-drafted Perplexity research prompt and pasted the result; every load-bearing claim was independently re-verified before publishing, not taken on trust. Verified directly: Meta's official Llama 4 model card (github.com/meta-llama/llama-models) does report training GPU-hours and CO2eq (Scout: 5.0M GPU-hours, 1,354 tons location-based CO2eq; Maverick: 2.38M GPU-hours, 645 tons), the only lab on this page's model list that discloses anything at all; DeepSeek's own model card does state the 27%-FLOPs/10%-KV-cache claim against DeepSeek-V3.2 verbatim; ML.Energy's v3.0 leaderboard blog does contain the exact Qwen 3 30B-A3B-vs-32B (3.56x), 235B-A22B-consumes-more, and FP8-batch-size-dependent (up to 56% worse at batch 8-16, 11% better at batch 65-256) figures; and the EnergyLLM-Bench Mixtral-8x7B figure (271.44 J/token, an order of magnitude above dense Mistral-7B's 4.59 J/token) was cross-checked via an independent web search after the source PDF blocked direct fetch, since it was the single most surprising number in the batch. Also confirmed Know Your Compute's Llama 4 Wh-per-query estimates explicitly self-label as derived, not official. The section's throughline: MoE's active-parameter ratio reduces arithmetic per token but does not reliably predict measured energy (Qwen 235B-A22B and Mixtral-8x7B both demonstrate the opposite), and quantization's energy benefit is real but batch-size-dependent rather than a fixed percentage. New local_vs_cloud_model_efficiency deep_dive key and energy-efficiency-by-model-architecture section_maps anchor added (both reference.yaml copies). Index coverage 95/95, no new validation failures.

a colleague-relayed question asked why the page had no watts-per-token or watts-per-hour figures. Deep research confirmed the honest answer: none of OVHcloud, AWS, Lambda, GMI Cloud, or Hetzner publishes per-token or per-request energy data, and neither Anthropic nor OpenAI discloses it for Claude or GPT-5.6, an industry-wide gap rather than one specific to this page. The new section separates three tiers of evidence: official TDP/board-power specs (RTX 5090, RTX PRO 6000 Blackwell variants, Ryzen AI Max+ 395, MacBook Pro M5, DGX Spark, all sourced to TechPowerUp/NVIDIA/AMD/Apple), independently measured system power (Apple's own wall-measured Mac Studio figures, ServeTheHome's measured 60-90W DGX Spark LLM-inference draw), and the two real per-token energy sources found (ML.Energy's measured 0.20 to 0.12 J/token improvement for Llama 3.1 8B on H100 across software generations, and Neuralwatt's published Wh-per-request pricing for GLM-5.2, explicitly flagged as a live figure that moved between two checks the same day, 2.29/1.73 Wh versus 1.96/1.17 Wh for the standard/fast variants). Deliberately excluded a set of "illustrative" joules-per-token estimates the research process itself generated for RTX 5090, RTX PRO 6000, DGX Spark, and a hypothetical Claude/GPT-5.6 cluster, all built on throughput assumptions invented by the research pass itself rather than measured, since publishing them would fail this page's own sourcing standard. Points readers at TokenPowerBench (verified real GitHub repo, arXiv paper) for self-measurement and gives the underlying formula (joules/token = watts / tokens-per-second) so nobody has to trust a number without knowing its provenance.

, sourced from a Slack-relayed request ("add the very small 16GB VRAM configs") plus a same-day product launch the user flagged from apple.com/fr/mac-mini. Three new rows added to what is now the **Thirteen** Comparable Hardware Configurations table (renamed from "Ten"): the Mac mini M6 (announced August 25, 2026, shipping September 22; verified via 9to5Mac's launch coverage and MacGeneration's French pricing, 12-core CPU/12-core GPU, 16-32 GB unified, 170 GB/s bandwidth, EUR base price 1,049 EUR at 16 GB/256 GB confirmed, the ~1,500 EUR figure at the 32 GB max estimated by scaling Daring Fireball's confirmed $400 USD BTO upgrade, since Apple's per-configuration French pricing pages weren't fetchable directly), the Mac mini M5 Pro (24-64 GB unified, 307 GB/s bandwidth, EUR base 1,999 EUR at 24 GB/512 GB confirmed, ~3,000 EUR estimated at the 64 GB max from the confirmed $1,000 USD BTO), and a workstation built around the RTX 5060 Ti 16 GB (4,608 CUDA cores, 448 GB/s, $429 MSRP per VideoCardz's launch coverage, ~590-730 EUR street price per BestValueGPU's August 2026 tracker). Ran llmfit --memory 16G --ram 32G info against candidate models for this tier: openai/gpt-oss-20b (OpenAI's own model card confirms 21B total/3.6B active, Apache 2.0) fits comfortably at 11.0 GB, while Qwen/Qwen3.8-27B only reaches this tier at a heavier Q3_K_M quant, marginal at 99% memory utilization; added as a new row in What Actually Fits: Named Models, ahead of the existing 32 GB row. The new Which Local Machine for Which Usage section reorganizes the page's existing hardware and model-fit data by use case instead of by price, with a table (7 usage archetypes from "trying it out under 2,000 EUR" to "24/7 production, rent don't buy") and a Mermaid decision tree (plus ASCII fallback) walking from usage question to specific configuration, cross-linking back into the existing Hardware Configurations and Named Models sections rather than duplicating their numbers. New local_vs_cloud_which_machine deep_dive key and which-local-machine-for-which-usage section_maps anchor added (both reference.yaml copies); local_vs_cloud_hardware_configs's anchor updated from #ten-comparable-hardware-configurations to #thirteen-comparable-hardware-configurations, and its two internal Mermaid click references in the existing Decision Diagram updated to match. Index coverage 95/95, no new validation failures (the 17 pre-existing CI failures are unrelated to this page).

added a pointer to cc-copilot-bridge (ccbridge.bruniaux.com, v1.5.3, v2 in progress), a Claude Code CLI routing layer distinct from this page's hardware/API economics: it switches which backend Claude Code talks to (ccd Anthropic direct, ccc GitHub Copilot, cco local Ollama) without touching the cost or hardware-fit questions the rest of the page answers. Noted the project's own documented caveat that the Copilot route uses a reverse-engineered API that may violate GitHub's Terms of Service. New local_vs_cloud_cli_bridge deep_dive key and switching-providers-at-the-cli-level section_maps anchor added (both reference.yaml copies). Index coverage 95/95, no new validation failures.

, sourced from a user-relayed Slack conversation with two unverified pricing claims, both checked against official pages before publishing. Quentin's claim of "~1,500 EUR/month" for a 96 GB RTX GPU at Hetzner did not hold up: Hetzner's own press release for the GEX131 (RTX PRO 6000 Blackwell Max-Q, 96 GB) lists **889 EUR/month** (1.4247 EUR/hour, excl. VAT); the higher figure appears only on a third-party reseller page, not hetzner.com. Thomas's GMI Cloud claim ("H100 same price, +300 EUR/month for H200") was directionally right but the actual gap is larger: GMI Cloud's own pricing page confirms $2.00/GPU-hour for H100 and $2.60/hour for H200, a difference of roughly $438/month at full-time usage, not $300-equivalent. Added both to the Cloud GPU Rental Pricing table and, where the billing model allows a fair comparison (GMI Cloud is elastic hourly, Hetzner is a flat-rate dedicated server), to the One-Year Cost Projections table. This changes one of the page's own conclusions: a full year of Hetzner's GEX131 (10,668 EUR) costs less than buying the same RTX PRO 6000 Blackwell card outright (~14,000 EUR), overturning the page's general "buy wins at 24/7 usage" pattern specifically for that GPU tier. GMI Cloud's H100 rate also undercuts OVHcloud's, the previous cheapest elastic-cloud H100 option on this page. The Decision Framework's "heavy or 24/7 usage, buy" bullet was qualified accordingly.

(guide/ecosystem/local-vs-cloud-inference.md, machine-readable/reference.yaml, mcp-server/content/reference.yaml): a Mermaid flowchart (plus ASCII fallback, matching the guide/diagrams/ convention and Bold Guy palette) walking the license-vs-local-vs-cloud-rental choice through the same two gates the page's prose Decision Framework already used, data sovereignty first, then usage pattern and model size, so the same conclusion (buy for 24/7 or >70B/405B, rent for sustained 4-8h/day, license a managed API for light or bursty usage) is reachable visually, not only by reading four paragraphs. Placed as its own section directly before Decision Framework, both in the page's own TOC and as a new local_vs_cloud_diagram deep_dive key and decision-diagram section_maps anchor. Index coverage 95/95, no new validate-reference-yaml.py --ci failures.

(guide/ecosystem/local-vs-cloud-inference.md, guide/README.md, machine-readable/reference.yaml, mcp-server/content/reference.yaml): a new ecosystem page answering when a local hardware purchase beats cloud GPU rental or per-token API pricing for running open-weight models in the 70B to 400B+ range. Ten comparable complete-system builds (CPU, memory, GPU, storage together, not bare GPUs) sized with llmfit (MIT CLI, brew install llmfit), from a $3,999 AMD Ryzen AI Halo box up to a ~$32,000 dual RTX PRO 6000 Blackwell workstation, each mapped to the largest named flagship model (Llama, Qwen, Mixtral, DeepSeek) that actually fits at a given quantization, not just the largest model by raw parameter count that llmfit's database happens to surface. Documents a real methodological limit found while building this page: llmfit's --memory/--ram flags correctly recompute capacity for a simulated hardware target, but the tool stays locked to the host machine's detected backend for its speed model, so tokens/sec estimates for a simulated Nvidia GPU run while testing on Apple Silicon are Metal-derived and not trustworthy, only the memory-capacity numbers are. Cloud GPU rental pricing compared across OVHcloud, AWS, Lambda, and RunPod, with one-year cost projections at 4h/day, 8h/day, and 24/7 usage against the ten local builds; AWS comes out priced for a different use case entirely (its own H100 24/7 estimate already funds close to three dual-RTX-PRO-6000 workstations in a single year). Also covers measured cloud API throughput for Claude Opus 5 and Sonnet 5 against OpenAI's GPT-5.6 family (Sol, Terra, Luna, launched July 9, 2026), including a correction surfaced mid-research: Claude Opus 5's real production-telemetry average (about 26 tokens/sec, LLM-Benchmarks) is well below the lighter-preset figure (about 55-80 tokens/sec) that other trackers publish, and explains structurally why cloud and local tokens/sec are not the same measurement (queueing and batching, invisible reasoning tokens inflating time-to-first-token, and cloud frontier models running full-precision at a scale local quantized deployments never reach). Closes with a decision framework by usage pattern. Index coverage 94/94 (was 93/93), validate-reference-yaml.py --ci still reports its pre-existing 17 bare-line-number drift failures, none newly introduced by this page.

(guide/ultimate-guide.md §1.4, new subsection under "Auto Mode (all plans, v2.1.114+)"): the guide covered Auto Mode's classifier and autoMode.environment/allow/soft_deny/hard_deny config but never mentioned the wizard that drafts those entries. Content verified against code.claude.com/docs/en/auto-mode-config directly (fetched, not inferred), after a Perplexity Deep Research pass surfaced a plausible-looking but unverifiable posture=personal|open-source|enterprise|mixed parameter set sourced only from a third-party binary-extraction repo (Piebald-AI/claude-code-system-prompts), not from Anthropic's own docs, so it was left out. Covers what the wizard always scans versus its two opt-in scans, the accept/discard-as-a-whole review flow, the "Teach auto mode about your environment?" dialog trigger, the skillOverrides: {"auto-mode-setup": "off"} disable path (it's a built-in command, not a bundled skill, so disableBundledSkills doesn't cover it), and the four claude auto-mode inspection subcommands (defaults, config, critique, reset). Requirements: Pro/Max/Team plan, v2.1.228+ (v2.1.233+ on native Windows), not available on Claude Code on the web. No new deep_dive key added, the addition lives inside the existing permission_modes section already indexed at guide/ultimate-guide.md#14-permission-modes. validate-reference-yaml.py --ci still reports its pre-existing 17 bare-line-number drift failures (confirmed present before this edit via git stash), none newly introduced.

(machine-readable/agentsec-security-feed.v1.json): synchronized the 2026-08-24 AgentSec feed with two reviewed sources and one CVE-2026-24301 event covering Varonis's Microsoft Copilot Personal disclosure. The event is not_applicable to repository scanning, so AgentSec's runtime database remains at 114 CVEs while the public intelligence ledger moves to 20 sources and 10 events.

(guide/workflows/cross-session-messaging.md new page, guide/ultimate-guide.md new §9.27, guide/diagrams/07-multi-agent-patterns.md 6th diagram "Cross-Session Messaging: Discovery & Delivery", guide/security/security-hardening.md new Part 8, guide/core/tools-reference.md, guide/cheatsheet.md, guide/workflows/README.md, guide/diagrams/README.md, machine-readable/reference.yaml, mcp-server/content/reference.yaml): the ListAgents/SendMessage tool pair was previously described in the tools table only as agent-team teammate messaging, with ListAgents absent from the table entirely; neither tool had a section covering session-to-session peer messaging between independently launched sessions. Content verified against the official code.claude.com/docs/en/cross-session-messaging, /errors, and /settings-reference pages (fetched directly, not inferred from secondary sources) after a Perplexity Deep Research pass surfaced conflicting version claims from community write-ups. The new page covers ListAgents discovery (subagent/teammate/local-peer/cloud/Remote-Control rows), same-machine socket delivery versus cross-machine Remote Control routing, the inbox socket mechanism (CLAUDE_CODE_MESSAGING_SOCKET/_TOKEN, own-child auth rules), the full crossSessionInbound/isolatePeerMachines security model (a peer message can never approve a permission or change configuration), message size/burst limits, and a version timeline from v2.1.224 (introduction) through v2.1.239 (teammates listed, own-name handling fixed). The new security-hardening Part 8 adds a threat-model table for cross-session prompt injection and endpoint-spoofing defenses, mirroring the existing Part 7 (Remote Control Security) format. tools-reference.md's SendMessage row and subsection were broadened from "agent team teammate" only to cover independent-session messaging; a ListAgents row was added to the tools table for the first time. Diagram count 48 → 49; also fixed a stale "10 thematic files" claim in diagrams/README.md (actually 12). Index coverage 93/93, anchors clean (pre-existing unrelated failures untouched).

(guide/ecosystem/agentic-tools.md new §4.7, Situation-to-Tool Guide row): requested in issue #73. MIT-licensed desktop workspace (macOS/Windows/Linux, iOS/Android companion) running Claude Code and Codex side by side, worktree-per-session isolation, inline red/green diff review across markdown/mockups/Mermaid/Excalidraw/CSV/data models, plus a bundled kanban, extension SDK, and MCP client. Facts verified against the GitHub API (1,558 stars, MIT, created 2025-10-30, 223 forks, 560 open issues as of 2026-08-24), not taken from the issue's unverified description alone.

(guide/ecosystem/third-party-tools.md, whitepapers/recap-cards/{fr,en}/t22-third-party-tools.qmd): fixes issue #71. The guide stated Straude was "the only tool in this list that is social," which predated viberank's public leaderboard (Claude Code, Codex, Gemini CLI, OpenCode, and more, reading the same local ccusage data). New viberank subsection added with verified GitHub/npm facts (114 stars, MIT, created 2025-07-03, npx viberank-cli), and the Straude "only" claim reworded to "one of two social tools." Also carried the commenter's follow-up: viberank's CLI sends aggregate totals only (tokens, cost, dates, model names), no hostname or device UUID, unlike Straude, noted in both the guide entry and the T22 recap card (FR+EN).

(examples/github-actions/claude-issue-triage.yml, examples/hooks/bash/{dangerous-actions-blocker,file-guard}.sh + new test-hooks.sh, .pre-commit-config.yaml, scripts/generate-guide-exports.sh, docs/workflows/whitepaper-build.md): PR #67 swaps the retired claude-3-5-sonnet-20240620 model id for claude-sonnet-4-6 in the issue-triage example workflow. PR #48 hardens the two example security hooks, adding credential-file blocking to dangerous-actions-blocker.sh and splitting file-guard.sh's critical patterns into filename (basename glob) versus path (substring) matching to fix a false-positive bug where .env as a bash-glob-and-regex hybrid pattern could match unrelated files like dotenv.py; ships a 94-test suite. Reviewed line-by-line before merge: every change strictly adds coverage, none removes an existing protection, no network calls or exfiltration path introduced. PR #65 adds quarto typst as a portable Linux fallback for PDF/EPUB export (previously macOS-only bundle-path detection), isolates each run in its own temp directory, and stages/validates all requested outputs before replacing existing exports; its CI failure was confirmed to be pre-existing reference.yaml anchor drift on main, unrelated to the PR's files. Two other open PRs (#69, #70) are left unmerged pending rebase (both CONFLICTING); PR #64 (MiniMax model aliases) is left unmerged despite a harmless diff because its author account shows a bot-farm pattern (1,548 public repos created in 5 months); PR #69's author shows the same pattern (539 repos, 0 followers/following) and additionally redirects the README's star-history badge to an unofficial third-party mirror domain, recommended for closure rather than merge once rebased.

(guide/security/sandbox-isolation.md §5, new TL;DR row, docs/resource-evaluations/just-bash-simulated-shell.md, docs/resource-evaluations/README.md): agentOS runs a real, if hypervisor-less, VM (Rust sidecar plus V8 isolate); just-bash (vercel-labs/just-bash, 3.2.0) runs no VM at all, a bash lexer/parser/interpreter written directly in TypeScript over an in-memory virtual filesystem, with containment resting entirely on JS-level defenses (DefenseInDepthBox, null-prototype objects, per-call resource limits, each mapped to a named vector in the project's own 31.5 KB THREAT_MODEL.md). Scored 4/5: past 3.x on npm with a changeset release pipeline and a public website demo, a stronger maturity signal than agentOS's 0.0.1 preview, same bus-factor-1 risk (Malte Ubl, 322/380 commits, 84.7%) already flagged in the Executor and agentOS evaluations. One concrete gap named directly rather than smoothed over: the repository has no LICENSE file at its root despite the README's Apache-2.0 claim. No §6 Comparison Matrix column added, same call as agentOS, since most of its criteria (Docker-in-Docker, kernel isolation) do not apply to an in-process simulator.

(guide/core/memory-systems.md §3.7): Executor's MISTAKES.md/DESIRES.md/LEARNINGS.md run the same plain-file-committed-to-Git pattern as ORF and DiffMem, with one design choice that departs from all three existing examples: the files are gitignored, private working memory rather than shared team history.

(guide/core/context-engineering.md §4): Gorgias Engineering's "Building a Context Layer From the Ground Up" documents a production SQL-generating agent that rejected a monolithic table-description prompt for a three-tier context layer (per-table when_to_use/how_to_use metadata, hierarchical topic instructions, skill playbooks), citing progressive disclosure as their single biggest reliability improvement. Cross-referenced against the existing Dev With AI meetup finding on monolithic CLAUDE.md files, since both land on the same architecture from unrelated starting points.

(guide/core/skill-design-patterns.md): Executor runs .claude/skills/, .agents/skills/, .skills/, and .codex/environments/ side by side rather than consolidating into one directory, read as convergence across CLI conventions (Claude Code, a generic agent convention, a project-shared set, Codex) rather than disorganization. The pattern entry also notes the README's curated "References" reading list (FumaDB, Effect, OpenCode, OpenClaw, Emdash, Pi) as a related, separate convention worth naming.

(docs/resource-evaluations/README.md, machine-readable/reference.yaml): Executor (3/5, watch-list, cross-reference only) and agentOS (4/5, integrated). resource_evaluations_count moves from 167 to 169 files on disk, resource_evaluations_indexed from 48 to 50.

(guide/roles/learning-with-ai.md § External Resources, docs/resource-evaluations/kajan-siva-mini-claude-code.md, docs/resource-evaluations/README.md): Kajan Siva's "Construire un mini Claude Code pas à pas" (French, 9-min read, working code and a companion GitHub repo) scored 2/5, not because it is wrong but because it restates the same loop already documented at Tier 1 confidence in guide/core/architecture.md §1 "The Master Loop", and because it is French-only against this repo's English-only rule. Thorsten Ball's "How to Build an Agent" (ampcode.com), the most-cited article in the same genre, English, ~300 lines of Go, was added in its place.

(docs/resource-evaluations/084-rippletide-harness-is-the-agent.md, docs/resource-evaluations/README.md): a LinkedIn blog post by co-founder Yann Bilien, "The Harness is the Agent, What's Inside?", scored 2/5. Its three diagrams (harness anatomy, capabilities-vs-performance split, test-eval-modify iterate loop) map close to one-to-one onto guide/core/agent-harness.md's nine components, already sourced to arXiv 2605.18747, Fowler, and Anthropic telemetry, and the article carries zero citations or measured claims of its own. No watch-list entry added: the pattern across all three Rippletide submissions (072 at 2/5, 081 at 3/5, this one at 2/5) trends toward restating known concepts rather than surfacing new, checkable information.

(examples/skills/sandbox-unblock/SKILL.md, referenced from guide/security/sandbox-native.md §13, indexed as sandbox_unblock_skill): over one day of real work, six of eight reported sandbox blockers turned out to be false, and every one traced to the same handful of method errors. The skill front-loads eight checks so the report that reaches a maintainer is worth acting on: do not infer Bash restrictions from the read.denyOnly list in the system prompt (those patterns govern the Read tool only); confirm $TMPDIR shows the invocation ran sandboxed; put the cd and the tested command in the same Bash call, because the working directory resets between calls and two independent audits declared a package manager broken after landing in the wrong directory; check the binary exists before blaming policy, since output-compressing wrappers replace clear messages with bare errnos; read the real exit code rather than a pipe's; check whether a PreToolUse rewriter sits between the command and the excludedCommands matcher, which is what made prefixed entries work while unprefixed ones stayed inert; remember that an entry matches the command exactly as written, so git -C /path fetch and bare git fetch both miss git fetch *; and restart the session if the config changed after it opened. Ships a report template that forbids paraphrasing the error, an escalation section naming the two keys that mislead (credentials.envVars in deny mode leaves the variable readable to Bash, and allowUnsandboxedCommands: false does not neutralize excludedCommands), a network section separating an allowlist refusal (hangs 5 to 7 seconds) from a hostname that does not resolve (fails under 30 ms even when a wildcard covers it), and a table of limits with no configuration fix.

(examples/skills/sandbox-status/SKILL.md): the script read .sandbox.autoAllowMode, .sandbox.filesystem.allowedWritePaths, .sandbox.filesystem.deniedReadPaths and .sandbox.network.policy, none of which are real, so every jq lookup fell through to its default and the command printed not set for a fully configured sandbox. A status tool that reports "no restrictions" on a restricted machine is worse than no tool, since it converts a real policy into a clean bill of health. Now reads autoAllowBashIfSandboxed, filesystem.allowWrite, credentials.files[].path and network.strictAllowlist, and additionally surfaces allowUnsandboxedCommands so an audit can see whether the escape hatch is open. Example output updated to match, and both sandbox skills now cross-link.

(guide/security/sandbox-native.md, machine-readable/reference.yaml): the rule looks like a denylist and reads like one, so it gets audited as protection it does not provide. Measured on 2.1.220 in one session, on one machine: ~/.npmrc carried a sandbox.credentials.files entry and no deny rule, and cat ~/.npmrc returned Operation not permitted 5/5; a project .env carried Read(**/.env*) and no credentials entry, and cat .env returned exit 0 5/5 on a file holding real secrets. Only the credentials block reaches sandboxed commands, and it resolves absolute paths rather than **/ patterns, so a rule shaped like **/.env* has nothing to compile into the Seatbelt profile. Since .env files sit wherever projects put them, no absolute path closes the gap and a PreToolUse Bash hook is the remaining move. The guide now specifies its scope: block the readers that print or copy, leave source .env alone, because breaking how developers load their own variables costs more than the exposure it removes.

(guide/security/sandbox-native.md): a narrower allowWrite entry does not take the ground back, since the deny resolves inside the allow. Tested against .serena, .cursor, .zed, .fleet and .settings, all of which accept writes, so this is specific to those two names rather than a general rule about dotted config directories. It surfaces as a supply-chain paper cut: a package shipping a .idea/ folder in its tarball fails during extraction and leaves node_modules/ truncated. Running the install in a terminal is the cheap fix, and pnpm install* in excludedCommands is the expensive one, since it unsandboxes every postinstall script in the tree.

(guide/security/sandbox-native.md, machine-readable/reference.yaml): most sandbox bug reports are measurement errors, and one variable explains nearly all of them. Because excludedCommands unsandboxes the whole invocation, a probe sharing a line with git, gh, ssh or docker reports on the unsandboxed world, and sessions then trade contradictory findings about the same machine. Sandboxed commands get a per-session $TMPDIR; unsandboxed ones inherit the shell's. An A/B binding a Unix socket makes the mechanism visible and catches the third trap in the same table: the probe alone is denied, the probe plus git -C <path> fetch origin is still denied because -C <path> breaks the git fetch * match, and the probe plus git fetch origin succeeds with $TMPDIR switched to the shell value. One flag decides whether the entire line runs sandboxed.

(guide/security/sandbox-native.md): setuid binaries cannot exec, so ps, top, su and login (mode 04000) report operation not permitted while lsof and whoami run fine, and lsof -nP -iTCP -sTCP:LISTEN is the direct substitute for ps aux | grep. AF_UNIX bind() then listen() is denied in every writable directory including $TMPDIR, and network.allowLocalBinding covers TCP only, so tsx and anything else opening an IPC server at startup will not run; bundling with esbuild first sidesteps it. Writes to .idea/ and .vscode/ are the third.

(guide/security/sandbox-native.md, machine-readable/reference.yaml): the section first described a policy field that does not exist and called allowlist mode the default. The real switch is strictAllowlist, default false. The correction then overshot and claimed the list was inert whenever autoAllowBashIfSandboxed was on, resting on example.com and api.openai.com returning HTTP 200 against a 23-entry list. Both hosts sit in the built-in default list, so that test proved nothing about filtering. Re-measured on 2026-07-30 against a 32-entry list: neverssl.com stayed unreachable, and cursor.com and www.jetbrains.com went from unreachable to HTTP 200 on the addition of their wildcard alone, taking effect immediately with no session restart. Pick test hosts from outside the built-in defaults before concluding a list does nothing. A second note now distinguishes a blocked host from a nonexistent one: an allowlist refusal hangs 5 to 7 seconds, while an unresolvable hostname fails in under 30 ms even when a wildcard covers it (api.cursor.sh and cloud.ollama.com failed in ~25 ms while covered by *.cursor.sh and *.ollama.com; neither host exists). The deep_dive key sandbox_allowlist_inert_with_autoallow is replaced by sandbox_allowlist_filters_without_strict and sandbox_blocked_host_vs_missing_host. Also notes that github.com does not cover codeload.github.com, where npm and pnpm fetch git dependencies and tarballs.

(guide/security/sandbox-native.md, machine-readable/reference.yaml): the existing troubleshooting covered watchman, Docker, and Go CLI TLS. None of those were what a day of real use on a 200-repository setup produced. The sandbox fails on paths a toolchain uses without announcing them, so the section now opens with the break-in period: expect about a week before a configuration stabilizes, and widen a path because something broke rather than because something might. The worked example ends at 13 write paths with the failure that produced each one, in roughly the order anyone will hit them.

(scripts/check-index-coverage.py, .github/workflows/index-integrity.yml, .claude/hooks/index-sync-reminder.sh, .claude/rules/index-sync.md): the CI already answered "do the references in reference.yaml still resolve?" but nothing answered the opposite question, "did anything land in guide/ that the index never learned about?". That gap is what produced the July 28 finding where ten guide files, including the entire guide/learning-path/ series, had never been indexed at all. An unindexed page is invisible to the MCP server and to the landing's Cmd+K palette, and the only signal was an anchor audit months later. The new script measures file-level coverage; it reported 92/92 when added, so the CI gate is hard at zero with no ratchet to unwind. A Stop hook reports at end of turn when guide/ changed and no index file did, which catches the more common case of a new section inside an already-indexed file, where no automated check can distinguish a typo fix from a new concept. The hook warns and never blocks: a turn can legitimately end mid-edit, and a hook that vetoes that is a hook people disable. A rule file documents what to update where, since the hook only says "you forgot". Choosing a hook over a rule alone is deliberate: a rule is a reminder the model can rationalize past, and it costs context every session, while the hook is deterministic.

(guide/security/sandbox-native.md, machine-readable/reference.yaml): beyond the bare-name form that never matches and the glob that unsandboxes the whole invocation, an entry matches the command *as written*, so any wrapper, prefix, or loop silently sends the command back into the sandbox. gh api rate_limit runs unsandboxed and returns; rtk gh api rate_limit is sandboxed and fails. The two differ by a four-character prefix. A PreToolUse hook that rewrites commands, which token-optimizing proxies do by design, therefore disables every exclusion naming a wrapped binary with no report. The same applies to for d in a b; do (cd $d && git push); done, where the string starts with for. The symptom is never "your exclusion did not match": it is Operation not permitted on a path, or a Go CLI failing certificate verification with x509: OSStatus -26276 because it cannot reach the macOS keychain from inside Seatbelt. That error is now indexed as a diagnostic signature, since it was independently misdiagnosed twice in one session as an expired token, an EDR agent, and a macOS security policy.

(guide/core/settings-reference.md): credentials.files, credentials.envVars, and the related network.tlsTerminate had zero occurrences anywhere in guide/, despite being the mechanism the official documentation recommends for the exact hole the guide already described. sandbox-native.md correctly stated that sandbox read access covers the entire computer, then offered Read(~/.ssh/**) deny rules as the remedy. Those rules do work, since Read deny rules merge into the sandbox configuration, but they cannot touch environment variables, and sandboxed commands inherit the parent environment unchanged. A reader came away believing their tokens were protected while every sandboxed command could still read them. The new entries cover deny for files and variables, mask with injectHosts for the case where a CLI must keep authenticating, why mask fails closed without tlsTerminate, and the scope restrictions (mask is honored only from user, managed, and --settings, so a repository cannot authorize the proxy to send real credentials). Verified on 2.1.220: with the entry in place, ls ~/.ssh from a sandboxed command returns Operation not permitted while the directory still appears in a home listing.

(guide/core/settings-reference.md): filesystem.disabled (v2.1.216), network.strictAllowlist (v2.1.219), and allowAppleEvents were recorded as "a release happened" and never documented as usable settings. Each now carries its scope restriction (all three are ignored from project settings), its trade-off, and for filesystem.disabled the list of protections it silently turns off, including credentials.files and the settings-file write protection. strictAllowlist is explicitly marked as the last thing to enable, since before the domain list has stabilized it converts every missing domain from a one-time prompt into a hard failure.

(guide/security/sandbox-native.md): what survives auto-allow mode (deny rules, rm on / or ~, content-scoped ask rules, with a bare Bash ask rule skipped for sandboxed commands), the plan-mode interaction that changed in v2.1.212 and again in v2.1.218, that subagents inherit the parent's sandbox and cannot widen it, the session temp directory and the $TMPDIR divergence between sandboxed and unsandboxed commands, the git-worktree exception for the shared .git directory, and the write protection on Claude Code's own settings.json at every scope with symlink resolution since v2.1.210. That last one is easy to hit: a script editing ~/.claude/settings.json from Bash fails with PermissionError: [Errno 1] Operation not permitted while the same edit succeeds through the Edit tool, which is not sandboxed. Also adds the Ubuntu 24.04 AppArmor workaround, without which bubblewrap cannot create user namespaces and the sandbox fails to start with no obvious cause, plus the optional seccomp filter install.

(mcp-server/content/reference.yaml, mcp-server/content/llms.txt): the directory is a strict mirror (verified byte-identical at an earlier commit), and it is what the claude-code-guide MCP server reads. Two of its three files had fallen behind: the reference copy carried 4 anchored references against 36 in the source and none of the 874 section-map anchors, meaning every consumer of the advertised "instant expertise" entry point was being handed the broken positions this pass had just repaired. claude-code-releases.yaml was already in sync. Checked before overwriting that the server actually understands the new format: mcp-server/src/lib/section-reader.ts already resolves path#slug, including Pandoc-style explicit ids and near-miss suggestions, so the anchor migration matches where that code was already heading.

(.github/workflows/index-integrity.yml, scripts/resync-reference-yaml.py, machine-readable/reference.yaml): scripts/resync-reference-yaml.py already existed and already did key-name-to-heading matching, which is worth stating plainly, the rot accumulated anyway because nothing invoked it. Its own reported count was inflated by a parser bug: the pattern "([^"]+):(\d+)" also matched URLs and prose, so claude_mem_dashboard: "http://localhost:37777" was read as a file named http://localhost at line 37777, and a sentence ending in ... see guide/core/foo.md:2215 was read as a file named after the whole sentence. Both surfaced as FILE MISSING and inflated the total; the pattern now requires a repo-relative path under a known top-level directory, taking FILE MISSING to 0. With that fixed the real starting figure was 208, and applying the tool's own 63 HIGH and MEDIUM confidence corrections brought it to 145, clearing HIGH and MEDIUM entirely. What remains is 108 LOW and 37 UNKNOWN, where the key name does not identify a single heading well enough to correct without guessing.

(.github/workflows/index-integrity.yml, scripts/validate-reference-yaml.py): the workflow already ratcheted the line-number backlog; it now runs validate-reference-yaml.py --ci first as a hard gate at zero, covering what a ratchet cannot, namely YAML parseability, anchor resolution against real headings, path existence, line-reference bounds and section_maps validity. Anchors do not drift when lines are inserted above them, so this gate is cheap to keep green, and a failure means something is genuinely broken rather than merely stale. The gate was verified by deliberately corrupting one anchor and confirming exit code 1, then restoring and confirming exit code 0 with the file intact, because the whole reason this rot survived for months is that the previous check could not fail: it only asked whether a referenced line existed inside a 26,554-line document. The script also had its hardcoded absolute working directory replaced with a path derived from its own location, which would otherwise have made it pass vacuously on a CI runner.

(machine-readable/reference.yaml, new scripts/fix-reference-refs.py, scripts/validate-reference-yaml.py, scripts/gen-section-maps.py): the index passed every check it had, because the only check was that a referenced line existed inside a 26,554-line file. That test cannot fail in a large document, so it validated nothing. Matching each YAML key name against the headings of its target file instead of trusting the stored position showed how far the file had rotted: hook_templates pointed 17,104 lines before "A.4 Hook Templates", command_template 17,643 lines before its section, rtk_guide 3,687 lines off, mcp_secrets_management 2,937. The appendix block drifted in lockstep, appendix_a through appendix_d and every myths_* key each exactly 5,480 lines early, which is the signature of upstream insertions never propagated rather than independent mistakes. 132 string references were migrated from path:N to path#anchor, 73 bare line numbers were repaired in place, and the tooling now converges (a second pass reports zero changes). Anchors were chosen deliberately over line numbers where the landing consumes the value: build-guide-index.mjs strips both, so the migration is invisible to the build, but anchors survive insertions above them while line numbers do not. The guide gained lines twice during this work and the drift figures moved between two runs of the same script, which is the argument for anchors made in real time. Bare integers pointing into ultimate-guide.md were repaired but not converted, since the landing ignores them and a line number is more useful than an anchor for reading a range out of a 26K-line file.

(scripts/fix-reference-refs.py, scripts/validate-reference-yaml.py): the first pass would have rewritten resource_evaluations_count: 120 to 26366 and ui_ux_pro_max_stars: 33700 to a line number, because the pattern matching bare integers cannot tell a quantity from a position. A guard now protects keys whose name ends in a quantity suffix, backed by an independent bounds check that catches the rest (33,700 exceeds the file, so it cannot be a line regardless of what the key is called). The first version of that guard matched substrings anywhere in the key and swallowed six genuine references, memory_files, cost_optimization, ui_ux_pro_max_guide among them, so it was narrowed to suffix matching: protecting a real reference leaves it visibly unrepaired, whereas corrupting a counter is silent and propagates. Separately, the heading extractor used a naive fence toggle that desynchronised on any file with an odd fence count; enterprise-governance.md has 51 such lines, and the toggle got stuck inside a block and dropped 9 valid sections, reporting correct anchors as broken. Replaced with CommonMark fence semantics (matching character, length at least the opener, nothing trailing). Re-running the repair with the corrected extractor found 14 further fixes the broken version had missed.

(machine-readable/reference.yaml): quiz_count: 334 against 473 real questions, quiz_categories: 16 against 17, quiz_file pointing at a quiz/questions.json that does not exist, and a three-tier split (quiz_beginner, quiz_intermediate, quiz_advanced) referencing a quiz/categories/ directory that does not exist either, with sub-totals of 60, 100 and 97 summing to 257, a number matching neither the old figure nor the new one. The real bank is one YAML file per category under quiz/questions/, and difficulty is a per-question field alongside a profiles list, not a per-category tier. Replaced with the verified counts, the category filenames, and the actual question schema; the invented tier sub-totals were dropped rather than replaced with guesses. resource_evaluations_count was likewise 120 against 167 files on disk, now recorded alongside the 48 that the README index actually lists, since those are two different real numbers.

(machine-readable/reference.yaml, scripts/gen-section-maps.py): coverage was measured per file, not per section, so a file counted as indexed while none of its sections were reachable. ai-ecosystem.md had 0 of 41 sections indexed, cheatsheet.md 0 of 27, visual-reference.md 0 of 20, architecture.md 0 of 19. Adding one deep_dive key per section would have worked but cost twice: roughly 600 keys in a file already at 44K tokens, and 600 more entries in the landing's Cmd+K palette, since build-guide-index.mjs turns every deep_dive string starting with guide/ into a search entry. A top-level section_maps block of anchor lists sidesteps both, as that script only walks deep_dive. Duplicate slugs within a file are skipped rather than emitted, because GitHub would suffix them -1 and the reference would not resolve. The generator is idempotent and replaces its own block on re-run.

(scripts/validate-reference-yaml.py, scripts/gen-section-maps.py, scripts/fix-reference-refs.py): the validator checks YAML parseability, anchor resolution, path existence, line-reference bounds, how far each bare integer sits from its nearest heading, and section_maps validity in one pass. It is what would have caught this rot at any point over the past months. The generated block in reference.yaml carries the regeneration and validation commands inline, which is also why the scripts had to move: the block initially pointed at claudedocs/, a gitignored path, making the instruction dead for everyone but the session that wrote it.

(tools/permissions-audit-prompt.md): a self-contained prompt that answers one question the existing tooling does not, whether a project's permission rules still constitute a boundary. tools/audit-prompt.md scores the whole setup across eight dimensions and /security-audit scans for secrets and injection surfaces; neither detects the failure mode where a single allow entry resolving to an interpreter (Bash(bash *), Bash(node:*), Bash(python3 *)) silently makes every deny rule in every scope bypassable, since the matcher treats bash -c '<anything>' as a bash command and never as the inner one. Six phases: blanket execution grants, rule population health, deny and ask coverage, sandbox posture, scope hygiene, and permission-mode interaction. The prompt embeds the documented matcher semantics rather than letting the model infer them, because that is where audits of this kind go wrong: the stripped wrapper list (timeout, nice, command, bare xargs) versus the runners that are *not* stripped (npx, docker exec, devbox run), the fact that an allow rule stops at an unknown env-var assignment while deny and ask match past any, that :* is only recognized at the end of a pattern, that protected paths are not pre-approvable by an allow rule in settings, that sandbox.allowUnsandboxedCommands: false constrains only the dangerouslyDisableSandbox retry and not excludedCommands, and that in auto mode allow, ask, and deny resolve *before* the classifier, so a narrow rule such as Bash(git push:*) does not merely skip a prompt, it removes classifier review from that action. Scored out of 100 with a deliberately lopsided weighting: any arbitrary execution grant zeroes 30 points on its own. Includes a fleet triage sweep that ranks repositories by exposure before running the full pass, so a thirty-repo park is not audited one indistinguishable finding at a time. Every finding must carry a reproduction command; the prompt explicitly forbids padding and forbids recommending bypassPermissions as a remedy for prompt fatigue. tools/README.md was three files behind and is corrected in the same pass: context-audit-prompt.md and audit-cheatsheet-prompt.md had never been listed, and a "which audit when" table now routes between the five, including /security-audit which lives as a slash command rather than a prompt file. Indexed in machine-readable/reference.yaml under deep_dive alongside the two existing audit-tool entries (a deep_dive key change means the landing's Cmd+K index needs pnpm build:search), and the tools/ block in the root README.md tree, which listed two of the six files.

(guide/ecosystem/ai-ecosystem.md §7.1): new section covering agent-driven interactive UI output (forms, approvals, actions rendered inside a single chat turn, not a separate artifact), with a comparison table across the four current approaches and a case study on MDMA (MobileReality/mdma). The case study documents what holds up under source audit (a real deterministic validator/fixer pipeline, honest evals measuring 41% bare-prompt success vs. 90.5% with the DSL plus validator) against several overstated claims (no cryptographic guarantee of valid UI despite the 90.5%-not-100% figure, "runs anywhere" not extending to rendering since only a React renderer exists, the default chart component being an HTML table, webhooks only dispatching a UI event with no real HTTP call, "accessible by design" not backed by aria-invalid/aria-live or keyboard-operable PII-masking controls) and one unresolved functional bug found independently by two audit agents: form validation (required/pattern/min/max) is documented with worked examples but never enforced, because the form container is a <div> rather than a <form> and the submit button never triggers native constraint validation. Added a full evaluation at docs/resource-evaluations/mdma-evaluation.md (score 3/5, all claims verified against the local source tree at /Users/florianbruniaux/Sites/divers-test/mdma rather than the README alone), indexed in docs/resource-evaluations/README.md, and 8 new deep_dive entries in machine-readable/reference.yaml.

(guide/workflows/multi-provider-code-review.md): new workflow guide documenting a non-redundant 3-provider PR review setup, based on a mature production pattern: Claude Code Action owns deep semantic review and the merge-blocking gate, a deterministic tool (CodeRabbit or equivalent) owns PASS/FAIL pre-merge checks, a cross-file RAG tool (Greptile or equivalent) owns invariants that span multiple files. Covers role separation, the non-duplication rule across config files, a blocking CI gate script, batching for large PRs, delta-review, cross-tool deduplication, and the known friction of rule drift across the three configs. Added supporting templates: examples/github-actions/claude-code-review-batched.yml (domain-split matrix review for PRs over a file-count threshold) and examples/github-actions/.greptile/ (config.json, rules.md, files.json). Added a gate job to examples/github-actions/claude-code-review.yml that parses the posted review's Must Fix count and fails the CI check, letting branch protection actually block merge on 🔴 findings instead of only commenting. Indexed in guide/workflows/README.md and machine-readable/reference.yaml, cross-linked from guide/workflows/code-review.md.

(guide/workflows/support-csm-agent.md): New workflow guide covering internal (non-client-facing) support/CSM agents built with Claude Code. Documents a 6-level maturity model (L0 reply drafting through L5 CSM pre-call briefing), the human-in-the-loop boundary that separates this pattern from buy-side deflection tools (Decagon, Intercom Fin, Ada), a read-only DB diagnosis pattern, security guardrails, and internal-throughput metrics (draft-to-send edit distance, time to first response) instead of a deflection rate. Cross-linked from event-driven-agents.md, data-privacy.md, and team-metrics.md.

(guide/ecosystem/mcp-servers-ecosystem.md): New "Customer Support & CRM" category documenting shinzo-labs/hubspot-mcp, baryhuang/mcp-hubspot, and reminia/zendesk-mcp-server (verified via GitHub API for star count and last-push date; three lower-signal HubSpot alternatives evaluated and excluded for stale commits). Statistics table and maintainer count updated accordingly.

(examples/commands/resources/threat-db.yaml): monthly threat intelligence update via /update-threat-db. New malicious skills from Unit 42's OpenClaw supply-chain report (money-radar, letssendit, omnicogg, ai-tradingview-assistant-for-macos, tradingview-ai-indicator-assistant). New CVEs: CVE-2026-50548/50549 (Cursor agent terminal sandbox escape, CVSS 9.8 each, also added to guide/security/security-hardening.md CVE table), CVE-2026-32871 (FastMCP OpenAPIProvider SSRF/path traversal), CVE-2026-32625 (LibreChat MCP access control, CVSS 9.6), CVE-2026-0621 (MCP TypeScript SDK ReDoS). New attack technique T033 "Agentjacking" (fake Sentry error injection tricking coding agents into executing attacker code, 85% success rate in disclosure testing). New defensive resources: Akamai's security analysis of the upcoming MCP spec, Microsoft's MCP governance rollout in VS Code/Azure APIM.

(guide/ops/api-gateway.md): New guide on setting up an API gateway (LiteLLM or Portkey) between Claude Code clients and Anthropic's API. Covers virtual keys, per-team budget limits, model allowlists, Prometheus metrics, OTel integration, and production Docker Compose setup. Addresses the P0 enterprise deployment gap (cost control and centralized permissions).

(guide/security/sandbox-isolation.md §7b): New section covering Wassette, wasmcp, whamm, and splicer as an emerging Wasm-based approach to sandboxing MCP tools at the OS level. Includes tool comparison table, Wasmtime CVE caveat, and scope statement (Wasm isolation does not cover cost tracking or audit logs). Based on adversarial deep research (100 agents, 25 claims verified 3-vote).

(guide/ops/observability.md §10): New section covering two paths for centralizing Claude Code logs across a team: LiteLLM Gateway (recommended) and JSONL shipping to Loki. Includes OTel collector config for Tempo and Prometheus queries for Grafana dashboards.

(guide/ecosystem/practitioner-insights.md): added Devoxx (Java/JVM/architecture conference talks), Dev With AI Meetup (French AI-native development meetup), ByteByteGo (system design), and Stanford Online (academic ML/LLM coursework) alongside the existing IFTTD podcast corpus. Insight count grew from 22 to 65, with four new per-corpus source tables. Attributed field reports were also folded directly into guide/security/security-hardening.md, guide/security/sandbox-native.md, guide/security/sandbox-isolation.md, guide/roles/agent-evaluation.md, guide/core/context-engineering.md, guide/ecosystem/mcp-servers-ecosystem.md, guide/ops/observability.md, guide/workflows/agent-teams.md, guide/roles/adoption-approaches.md, guide/roles/ai-roles.md, and guide/roles/learning-with-ai.md. Notable additions: a formal Boolean-circuit bound on chain-of-thought reasoning (Denny Zhou, Stanford CS25 V5, 2025), a nine-speaker independent convergence on a 70% context-degradation threshold (Dev With AI Meetup), and a documented REX on unsupervised 24/7 agent delegation reducing team velocity. Also folded in field reports from The Product Crew (French product-management podcast) into guide/roles/adoption-approaches.md and guide/roles/ai-roles.md, treated as single-instance 2026 accounts rather than established data. Corrected a stale insight count (previously reported as 22 in machine-readable/reference.yaml and guide/README.md even before this expansion; the actual pre-expansion count was 35). Full attribution in guide/core/credits.md.

(guide/ops/ai-unit-economics.md, new file): original synthesis addressing an unmodeled gap surfaced across all eight source corpora analyzed for the practitioner-insights expansion above (none of them model the real cost of agentic AI at scale). Covers per-task cost decomposition (input/output/cache/tool-call/sub-agent tokens), the four cost levers with practitioner sourcing where available (complexity-based routing, sub-agent context isolation, exit criteria and max-iterations, cache reuse), the break-even point of an autonomous agent, and team budget governance (cross-linked to guide/ops/api-gateway.md for implementation). Explicitly flagged in its introduction as original analysis, not a practitioner-sourced compilation.

(3 files): updated Last Updated to June 21 2026, Lines of Documentation from 26,058 to 26,494 (reflects current ultimate-guide.md line count), Production Templates from 314 to 262 (authoritative count from check-landing-sync.sh method), and inline body references in llms-full.txt (FAQ answer, repo structure, What Is section).

(guide/ecosystem/team-knowledge-base.md, new file): answers the question "where do we put the company knowledge base so both Claude Code and Cowork can use it?" Covers the 3-tier framework (static Markdown vault for direct file reads, MCP connectors for live systems like Jira/Confluence/Notion/GitBook, RAG at scale for large corpora), the ~100-1000 doc threshold for switching from direct reads to retrieval, Onyx (self-hosted, ex-Danswer), LlamaCloud and Ragie as managed RAG via MCP, the plugin pattern for distributing team workflows, and the Cowork-specific governance caveat (audit log and DLP gaps as of mid-2026). Includes setup code snippets, comparison tables, and a decision table for what to build first. Cross-linked from ultimate-guide.md Cowork section and guide/README.md Ecosystem table. Machine-readable index updated: 18 new entries in reference.yaml, shared_knowledge block in cowork-reference.yaml, llms.txt/machine-readable/llms.txt updated.

(guide/ecosystem/practitioner-insights.md): new file consolidating paraphrased field insights from 11 IFTTD episodes (290-361), organized into 5 themes: context engineering, agentic patterns and orchestration, LLM evaluation, agent security, and DevX and adoption. 22 attributed insights from practitioners including Guillaume Laforge (Google Cloud), Zineb Bendhiba (Red Hat), Frédéric Barthelet (Theodo), Samy Lastmann (Arago), Jocelyn N'takpe (ManoMano), and others. All French content reformulated in English with attribution format: name, role, company, episode number, ifttd.io URL. No direct quotes.

(guide/ecosystem/context-engineering-tools.md, new subsection "Query-Side Indexing"): practical explanation of semantic chunking (boundary detection over fixed-token splitting) and synthetic question generation at index time (doc2query: Nogueira and Lin, 2019; HyDE: Gao et al., 2022). Retrieval improvement framed as Laforge's practitioner order-of-magnitude estimate, not a constant. Attributed to Guillaume Laforge (IFTTD ep 361).

(guide/core/context-engineering.md): practitioner paragraph after the Liu et al. "Lost in the Middle" citation clarifying that filling a 1M-token window is an anti-pattern, not a capability demonstration. Attributed to Guillaume Laforge (IFTTD ep 361). Also updated the Liu et al. citation to full form: "Lost in the Middle: How Language Models Use Long Contexts", TACL 2024, arXiv:2307.03172.

(guide/roles/agent-evaluation.md, new major section): six subsections covering scored-dataset evaluation (not red/green unit tests), statistical CI/CD with bash example (replay 10-100x, measure success rate as percentage), async LLM-as-judge pattern, hallucination as a calibrated trade-off, OpenTelemetry and Langfuse observability with trace structure example, and workflow vs pure agent evaluation implications. Sources: Louis Pinsard (ep 338), Frédéric Barthelet (ep 329), Samy Lastmann (ep 311).

(guide/security/sandbox-native.md, new subsection "Why Sandboxing Matters: Field Incidents"): two documented production incidents: guardrail evasion where an agent emptied a file when the delete operation was blocked (Zineb Bendhiba, ep 326), and data loss incidents including home directory wipes and database deletions across multiple agent products (Guillaume Lours, ep 360).

(guide/security/security-hardening.md): practical paragraph at the start of the MCP vetting workflow section recommending specific allowlist patterns (allow git add and git commit, require explicit approval before git push, hard resets, force-deletes, or database mutations). Illustrated with a real incident involving Firefox bookmark loss (Jocelyn N'takpe, ep 346).

(guide/ecosystem/mcp-servers-ecosystem.md, new subsection after the Quality Score block): three field-derived principles: keep tool count small to reduce hallucination probability, design tools as complete user intents not atomic endpoints, and the LLM is stateless with respect to MCP routing. Sources: Zineb Bendhiba (ep 326) and Frédéric Barthelet (ep 329).

(guide/workflows/agent-teams.md): four new entries in the testimonials section: Samy Lastmann on micro-agents over mega-prompts (ep 311), Guillaume Laforge on harness engineering as the emerging term for multi-agent orchestration (ep 361), Quentin Adam on Claude orchestrating Gemini for large-context rewrites (ep 341), and Jocelyn N'takpe on ManoMano's production MCP stack at scale (ep 346).

(guide/roles/adoption-approaches.md): three paragraphs after the empirical data table covering ManoMano's documentation-as-onboarding approach (N'takpe ep 346), the Mundler et al. typed-language safety net study (ETH Zurich and UC Berkeley, PLDI 2025, arXiv:2504.09246, correctly cited as "94% of compilation errors are type errors" not "94% of agent errors avoidable"), and practitioner notes on alternating AI and manual coding to preserve deep system understanding (Deleuze ep 349) and capping AI-assisted development cycles per day against cognitive load (Lepine ep 351).

(guide/ecosystem/third-party-tools.md): new dedicated section under Token & Cost Tracking. CodeBurn (8,100+ stars, MIT, Node.js 22.13+) reads Claude Code JSONL session logs and classifies every turn into 13 categories (Coding, Debugging, Exploration, Conversation, etc.) via deterministic local pattern matching, no LLM calls. Key differentiator from ccusage: CodeBurn explains WHERE tokens went and correlates sessions with git commits via codeburn yield; ccusage tracks how much was spent. Notable commands: optimize (retry loops, redundant re-reads), compare (model breakdown), yield (sessions vs. shipped commits), menubar (macOS SwiftBar widget), MCP server (v0.9.12+). Covers verified usage patterns, cost estimate caveats (LiteLLM pricing, not Anthropic billing API), and when to use alongside ccusage.

(guide/ecosystem/context-engineering-tools.md): new section after tilth. Token Savior (Mibayy/token-savior, ~1,000 stars, Python 3.11+, MIT) is a three-in-one MCP server covering structural code navigation by symbol (replaces full-file reads), Bash output compaction (34 compactors for git/pytest/jest/kubectl, opt-in via TS_BASH_COMPACT=1), and persistent cross-session memory via SQLite FTS5. Covers 6 tool profiles (full/core/nav/lean/ultra/tiny), 15+ navigation tools, tsbench results (Claude Opus 4.7, 96 tasks, -77% active tokens, synthetic 2,000-line codebase), install via pip/uvx, comparison with tilth (tilth: faster, independently benchmarked, 14 languages; Token Savior: adds Bash compaction + cross-session memory).

(guide/ecosystem/context-engineering-tools.md): brief entry for claude-token-efficient (drona23, 5,700+ stars) at the end of section 3. Frames it honestly as a single CLAUDE.md file that adjusts model output style, not a compressor. Notes the uncited 63% claim and the tool's ceiling (output tokens only, cannot compress shell output or file reads).

(guide/ultimate-guide.md): new section covering Google Cloud's OKF v0.1, published June 12, 2026. Explains the Karpathy LLM Wiki origin pattern (April 2026 gist, 16M+ views on X), how an OKF bundle works (directory of markdown files with YAML frontmatter, type field as the only required key), how OKF compares to existing patterns (CLAUDE.md, AGENTS.md, llms.txt sit at different layers), adoption status (v0.1 invitation not yet a standard, Google Cloud Knowledge Catalog already ingests it), decision guidance on when OKF fits vs llms.txt vs CLAUDE.md, and a minimal quick-start example. Existing 9.18.5–9.18.11 renumbered to 9.18.6–9.18.12.

(guide/workflows/smart-suggest-routing.md + examples/hooks/bm25-routing/): self-calibrating BM25 lexical scoring layer for UserPromptSubmit hooks; complements the existing regex smart-suggest with intent-based skill routing; includes runnable Node.js example with auto-calibration, detached index rebuild, and sample skill corpora

(guide/ecosystem/context-engineering-tools.md, guide/ecosystem/third-party-tools.md): added documentation for two new token-efficiency tools discovered via HN community analysis. tilth (MCP server, cargo install tilth) uses tree-sitter for structural code navigation with benchmarked results of -40% cost and +10pp accuracy across Sonnet 4.6, Opus 4.6, and Haiku 4.5 (160 runs, 4 repos). maki (standalone Rust TUI agent, replaces Claude Code rather than augmenting it) with embedded Python code execution and dynamic model selection for subtasks. Also added a real-world cost calibration note to the RTK section: bash output is ~12% of total session token usage (not the dominant source), file reads are ~65%, so RTK's actual API bill impact is 6-10% despite its per-command compression ratios of 60-90%. Section 10 tool selection table updated with tilth for the "file reads consuming most of context budget" use case.

(guide/ecosystem/third-party-tools.md): added NVIDIA's skill security scanner to the Security Scanning section. SkillSpector scans skills before installation using 64 patterns across 16 categories (prompt injection, data exfiltration, MCP tool poisoning, trigger abuse, supply chain, rogue agent, taint tracking, YARA signatures). Two-stage pipeline: fast static analysis then optional LLM revalidation (~87% precision). SC4 pattern queries OSV.dev live for CVE data. Apache 2.0. Fills the gap between AgentShield (config audit) and DeepSec (app code audit): neither previously covered pre-install skill vetting.

(.claude/commands/security-check.md, examples/skills/security-check/SKILL.md): Phase 3 now includes a "Deep skill content analysis" block inspired by SkillSpector patterns. Adds detection for hidden HTML comments and zero-width characters in skill files (TP1), base64 blobs over 40 chars (TP1/SC3), RTL unicode override characters (TP2), trigger keywords shadowing built-in commands (TR2), curl | bash patterns in skill scripts (SC2), cron/launchctl persistence writes (RA2), and env-harvesting-plus-network-call combinations (E2+E1). Applied to both the command version and the skill template.

(guide/ecosystem/third-party-tools.md): added to Plugin Ecosystem / Notable skill packs and Recommendations by Persona. Ponytail is a cross-agent skill that enforces a "lazy senior dev" decision ladder before writing code (YAGNI → stdlib → native platform feature → installed dependency → one line → minimum that works). Benchmarked at 80-94% less code, 47-77% lower cost, and 3-6x faster than unconstrained agents across Haiku/Sonnet/Opus. Ships with 4 commands (/ponytail, /ponytail-review, /ponytail-audit, /ponytail-debt) and supports 13 agents. MIT, by DietrichGebert.

(machine-readable/reference.yaml): added 16 data_privacy_* entries covering data flow, retention tiers (5y/30d/ZDR), known risks (/bug command, .env exposure, MCP DB), protective measures, and GDPR/HIPAA/PCI compliance. Governance and privacy sections are now searchable via cmd+k on the landing site and link to the local guide reader at cc.bruniaux.com/guide/.

(guide/ultimate-guide.md): new advanced pattern covering how to convert structured inline review feedback (via tools like crit) into CLAUDE.md rules. Covers the round-to-round diff as a verification mechanism, pattern extraction from review comment threads, promotion criteria, and the compounding effect over multiple sessions. Cross-referenced with §9.24 (Instinct-Based Learning) and §9.23 (Update Loop). Added to chapter 9 quick jump and ToC.

(docs/resource-evaluations/crit-human-in-loop-review.md): score 4/5, decision: integrate. Tool by tomasz-tomczyk for human-in-the-loop review with round-to-round diffing, inline plan review before execution, DOM-anchored web app comments, and native Claude Code integration.

(guide/ecosystem/agentic-tools.md): updated to v0.15.1 (from v0.14.0). Added concrete GEPA benchmark (40% faster task completion after 20+ auto-generated skills). Expanded Quick Start with hermes chat entry point and WSL2/no-WebUI note. Added "Known Operational Issues (v0.15.x)" subsection covering 7 production pitfalls with YAML/bash fixes: analysis-before-action via SOUL.md, SOUL.md vs AGENTS.md separation, kanban parallelism flood (max_in_progress_per_profile: null default), subprocess PATH inheritance (env_passthrough), worker protocol violations (missing kanban_complete), SQLite corruption with backup strategy, HERMES_HOME not propagated to subprocesses, and token overhead (~13,900 fixed tokens per call, gateway multiplier). Issues traced to community reports #28712, #18594, #4379, #23717.

(llms-full.txt): an earlier audit pass fixed 4 dead paths and 3 stale counts in this file but left the Hooks list unverified against the filesystem. Rewritten against ls examples/hooks/{bash,powershell}/: 12 real bash hooks replace the fabricated list, and the PowerShell section now states it covers a subset (2 files), not a mirror. The Agents count was also off by two (23 claimed, 21 real, loop-monitor.md was missing from the enumerated list).

(landing repo, scripts/build-guide-index.mjs): the entry generator stripped anchors before deduplicating, so every deep_dive key pointing at a different heading in the same guide file collapsed onto one search result, and the anchor a user actually needed was gone by the time the entry reached the palette. Rewrote the loop to keep anchors and dedupe on the final resolved URL instead of the bare path, with an explicit map for the three guide files that are client-side-redirect stubs (ai-ecosystem.md, ai-roles.md, claude-code-releases.md reroute to /ecosystem/, /roles/, /releases/, which share no heading structure with the guide markdown at all and would otherwise have silently produced 3 more broken entries). Verified against the actual built dist/ HTML: 696 entries, 696 distinct URLs, 0 collisions, all 266 non-GitHub entries resolve.

(machine-readable/reference.yaml): removing the phantom "2.7 Configuration Decision Guide" TOC entry shifted the rest of guide/ultimate-guide.md by -1 line. --apply auto-repaired the 25 declared-anchor references whose line had drifted, but 73 undeclared references (56 bare integers, 12 path:line refs into ultimate-guide.md, 5 into guide/security/sandbox-isolation.md) sat below the word-overlap heuristic's confidence floor and needed a targeted fix. Diagnosed by classifying the same reference set against the pre-edit commit in a worktree (611 apparent baseline failures turned out to be a copy artifact from only 3 files being present; a full worktree checkout showed the true pre-existing baseline was 8, all ANCHOR_DEAD, unrelated to this shift) and confirming programmatically that every one of the 73 resolved to sensible content at exactly old_line - 1. One --apply run had already produced a bad auto-repair earlier in this same investigation (mechanism_comparison_table jumped to an unrelated "Scheduled Tasks" table on generic "comparison table" word overlap), caught by reading the actual content at both locations before accepting it, corrected by hand with a declared anchor. The 12 path:line refs were migrated to path#anchor where the shifted target landed on a real heading (8 of 12; the other 4 landed on code-block comments that only coincidentally start with #, kept as corrected line numbers). One ambiguous target (security-considerations, 3 duplicate headings) was kept as a corrected line number rather than a plain anchor, to avoid re-introducing the exact ambiguity this file's hint_line mechanism exists to catch. resync-reference-yaml.py --check now reports a genuine 0 broken (up from a false 0 that a path-string bug in an ad hoc verification script had reported earlier in the same investigation), confirmed against the full CI suite: validate-reference-yaml.py --ci 0 hard failures, test-resync-reference-yaml.py 57/57, check-index-coverage.py 92/92.

(machine-readable/reference.yaml, scripts/resync-reference-yaml.py, .github/workflows/index-integrity.yml): every one of the 145 was decided from the real content of its target file, in groups by file, never by lowering a confidence threshold. 137 became path#anchor after checking which heading the key actually meant. Two measurement defects surfaced first, and both had been inflating the "undecidable" figure. 29 of the 37 UNKNOWN were not undecidable: the header index was built from a hardcoded whitelist of 14 files, so any reference into a file outside it scored against an empty index. rpi_phase1_research and rpi_phase2_plan were the standing example of an intractable case, and rpi.md has ## Phase 1: Research and ## Phase 2: Plan as real headings all along; they were invisible only because the file was not on the list. No guide edit and no key deletion were needed. Separately, 8 genuine references were out of scope entirely, hidden by the same substring guard the tool had already narrowed elsewhere: claudemd_sizing caught by "sizing", tasks_api_limitations by "limit", subscription_token_budgets by "budget", subscription_opus_ratio by "ratio", and four more. Bringing them into scope raised the honest starting figure from 145 to 153 before a single repair.

(machine-readable/reference.yaml, scripts/resync-reference-yaml.py, scripts/validate-reference-yaml.py): the last 8 references could not be confirmed by token overlap even with verified targets, because the key name and the heading share no words. cicd pointing at "9.3 CI/CD Integration" is correct and scores zero, since the heading spells it "CI/CD". Weakening the heuristic to absorb that would have been guessing at scale in the other direction. A trailing # anchor: some-slug says which section the author meant, and the stored line is then correct if and only if it equals the line of the heading with that slug. Ambiguity resolves to a failure rather than to the first match, because GitHub suffixes a repeated slug -1 and a duplicated slug identifies nothing. --apply repairs the line deterministically when text shifts above it, which is exactly the drift that produced this rot. Bare integers stay integers because the landing turns every deep_dive string starting with guide/ into a Cmd+K entry, so converting the remaining 108 would add that many entries pointing into a 26,554-line file.

(.github/workflows/index-integrity.yml): the strict gate exits 1 on a corrupted guide anchor and on a declared anchor sitting 3 lines off its heading, naming the drift in both cases, and returns to 0 on restore. The ratchet exits 1 on a drifted declared anchor, then --apply repairs 15030 back to 15027 and it returns to 0; it exits 1 again on a typo'd declared anchor, reported as ANCHOR_DEAD. --max-broken 145 is deleted rather than reduced, so the default of 0 fails the build on the commit that introduces the next imprecise reference. The workflow's path triggers now include scripts/** and the workflow file itself, which they did not: a change that broke a gate could not fire the workflow that runs it, only a later unrelated content edit could.

(scripts/resync-reference-yaml.py, new scripts/test-resync-reference-yaml.py, scripts/fix-reference-refs.py deleted): the earlier merge commit landed the combined tool but left the old one on disk. The test suite is 43 assertions and each trap is checked by a test that discriminates, running the known-bad implementation against the same input and asserting it is wrong. Verified by breaking each guard in turn: removing the counter guard produces 6 failures, widening it back to substring matching produces 8, replacing the fence tracker with a naive toggle produces 6, and loosening the path pattern to "([^"]+):(\d+)" produces 2. Two assertions about the fence trap were written wrong at first and the measurement corrected them. The synthetic fixture had a 4-backtick block containing a matched 3-backtick pair, so the naive toggle balanced out and got the right answer; it now contains a single unmatched opener. And on enterprise-governance.md the naive toggle does not find fewer headings, it finds more: 63 against 37. The failure is two-sided. Stuck inside a fence it drops 19 real sections; stuck outside one it invents 45 headings out of shell comments and the CLAUDE.md examples embedded in code blocks. Counting headings alone hides this, because the invented outnumber the dropped. The earlier note that it "dropped 9 valid sections" was an undercount.

(.github/workflows/index-integrity.yml, mcp-server/content/reference.yaml): mcp-server/content/ is a hand-copied bundle published to npm, nothing regenerates it, and nothing checked it. It had drifted before, and it drifted again the moment reference.yaml was repaired. Same failure class as the reference rot itself, a copy nobody verifies. The gate diffs the three files against machine-readable/ and prints the cp that fixes each one; verified by perturbing llms.txt and confirming exit 1, then restoring and confirming exit 0.

(machine-readable/reference.yaml): configuration_decision_guide_anchor pointed at #27-configuration-decision-guide, a section that no longer exists, and it was invisible to the anchor validator because a bare #slug with no path does not match the pattern. It now points at Memory Loading Comparison, where the mechanism comparison table and the 56% skill-invocation warning both actually live. security_claude_folder_audit carried a comment naming §1.4 Repository Pre-Scan while its key names the .claude/ audit in §1.5; the key wins, and the comment now records the contradiction instead of hiding it.

(examples/config/sandbox-native.json): autoAllowMode, filesystem.allowedWritePaths, filesystem.deniedReadPaths, network.policy, excludedCommands in the bare-name form, and ${HOME} / ${CWD} interpolation. The real keys are autoAllowBashIfSandboxed, filesystem.allowWrite, filesystem.denyRead, no policy field, the glob form, and ~/ or / prefixes with no interpolation. There was no credentials block at all. Copying this file produced a sandbox that protected none of what its own comments claimed, which is worse than a documentation gap: prose gets read critically, an example gets pasted. Rewritten against a configuration verified on 2.1.220 across a 200-repository park, with comments that explain each trap rather than paraphrasing the key names.

(llms-full.txt): the repo bans them and the PostToolUse hook enforces it, which meant the file could not be edited at all until it was cleaned. Converted to colons where the dash separated a label from its description (100 cases, the numbered section list and the bullet lists) and to commas elsewhere (4). Also adds a Security & Sandboxing block to the guide-structure section, which named ten guide areas and omitted the one this release documents most.

(guide/core/settings-reference.md, guide/security/sandbox-native.md): every example used the bare-name form ("excludedCommands": ["git", "docker"]), which matches only the zero-argument string and therefore never fires on a real invocation. A reader following the guide configures something inert, sees the command still sandboxed, and has no way to tell why. This is the form the published JSON schema suggests, which is what makes it the default mistake (anthropics/claude-code#10524). All six examples now use the glob form, verified on 2.1.220 where "git" had no effect and "git *" worked immediately. Both the sandbox.excludedCommands reference entry and the excludedCommands section of the sandbox guide gained a warning about the second, worse trap: once a glob does match, **the entire Bash invocation runs unsandboxed**, including commands that execute before the excluded one, so git status && cat ~/.ssh/id_ed25519 reads the key with "git *" in the list (#81157, open as of 2026-07-25 on 2.1.220). Both now document the mitigation: scope entries to the subcommands that need the network (git push *, git fetch *, and so on) rather than the binary, which keeps local git confined. Git over SSH is what forces the exception at all, since the sandbox proxy handles HTTP and HTTPS but not port 22 and blocks the ssh-agent socket, so an SSH remote fails at DNS resolution.

(guide/security/sandbox-native.md, guide/security/sandbox-isolation.md, guide/security/security-hardening.md): the guide claimed curl and wget are "blocked by default in the sandbox to prevent arbitrary web content fetching". There is no such blocklist. Both are constrained by the network allowlist like any other command, and a request to an allowed domain succeeds without a prompt: curl https://api.github.com returned HTTP 200 in 84 ms under auto-allow on 2.1.220, while a non-allowed host hung to timeout (HTTP 000, curl exit 28). The corrected text names the hang as the symptom to recognize, since a missing domain does not produce a clean error. Separately, five configuration examples used an autoAllowMode key that does not exist in any released version; the real key is autoAllowBashIfSandboxed.

(quiz/questions/*.yaml, quiz/scripts/generate-from-web.mjs, quiz/README.md, landing src/content/questions/**, src/content.config.ts, src/utils/categories.ts): the web quiz (Astro, one Markdown file per question) and the CLI quiz (YAML per category) had drifted past simple count mismatches. 344 shared NN-YYY ids held 38 outright answer contradictions and 60 unrelated questions reusing the same slot, and a further 60 CLI questions hid inside id slots that also existed in web with different content, undercounting the true gap. A full id-and-text cross-reference found 82 CLI questions with no web equivalent by any matching method. Each was triaged against the current guide before porting: 10 dropped for stale-model claims superseded by later releases (v2.1.90 fixed the exact caching bug one question described as unresolved) or answers the current guide contradicts outright; 72 ported into the web bank with fresh, non-colliding ids (the fork made old ids unsafe to reuse) and, where the CLI's declared doc_reference no longer matched any real heading, corrected to the anchor the content actually moved to (several had followed Agent Teams content from ultimate-guide.md into the dedicated guide/workflows/agent-teams.md). Team Metrics becomes web category 17. The web bank (canonical, 473 questions) now regenerates the CLI YAML through a one-way script (pnpm sync-from-web, with a --check mode for CI drift detection) that preserves each category's source_file header and replaces only its questions; the CLI README now tells contributors to edit the web Markdown and regenerate, not hand-edit the YAML, which is the practice that let the two banks fork in the first place.

(examples/skills/{autoresearch,canary,investigate,qa,plan-pipeline/ceo-review,plan-pipeline/eng-review}/SKILL.md): unquoted colons inside description: values ("Strategic product gate: challenge the brief...") made GitHub's YAML parser fail with "mapping values are not allowed in this context", showing an error banner instead of the rendered frontmatter. Quoted all six descriptions and validated with a YAML parse.

(scripts/check-landing-sync.sh): four of six checks still grepped the deleted index.html/quiz/index.html, and set -e killed the script mid-run on the first failed grep, so the version, quiz, guide-lines, and CC-version checks never executed (the script also referenced a $QUESTIONS_COUNT variable that was never computed). Rewrote all checks against the Astro sources: guide version from AnnouncementBanner.astro, quiz count from questions/*/*.md compared against quiz/index.astro, HeroBanner.astro, and the index.astro meta description, guide-lines against the "NK+ lines" claim with a 2K tolerance, CC version from the first releases.ts entry plus an exactly-one-latest: true flag check. Dropped the GitHub stars check (the landing fetches stars live client-side, there is no static value to sync). First run immediately caught a real drift: the landing meta description claimed a 346-question quiz against 330 actual questions, fixed in the landing repo.

neither the July 2 FR pass nor the July 3 EN pass had been deployed; the landing kept serving the stale hashed PDFs. Deployed the 24 corrected cards (10 FR + 14 EN) with new hashed filenames to florian-portfolio/public/guides/recap-cards/, rebuilt all 6 series ZIPs (T/M/C × FR/EN), updated CARD_HASHES_FR/EN and the 6 hashedZip entries in the landing recap-cards-data.ts, and refreshed the guides.mjs email-link manifest (also added the previously missing recap-conception.fr/en entries). Also added the landing repo to ALLOWED_PATHS in .claude/settings.json, it was the only documented sync target missing from the hook allowlist (portfolio was already there).

(whitepapers/recap-cards/en/): same audit as the July 2 FR pass, all 10 FR problems confirmed present in EN and fixed (dead autoApproveTools/top-level allowedTools keys replaced with permissions.allow in t04/c06/t06, .claude/commands/ updated to .claude/skills/ in c03/t09/t10/t06, fictitious --context flag removed from 01/04, permission-mode canonical names plus PreCompact/SessionEnd events in 03/m11). The EN pass additionally caught 6 findings the FR audit missed, verified against claude --help and guide/core/settings-reference.md: fictitious --no-stream flag (01, t02), fictitious --task-manage flag presented as native CC "since v2.1.19" (m07, it is a SuperClaude framework flag; the real behavior is Tasks API on by default since v2.1.142), non-existent {"vim": true} key (01, real key editorMode: "vim"), spinnerVerbs.mode: "add" (t06, valid values replace/append), non-existent sandbox.network.policy key (t16), and a settings-style allowedTools: snippet (c08). These 6 are still present in the FR counterparts. All 14 EN PDFs rebuilt. Full breakdown in whitepapers/CHANGELOG.md.

(whitepapers/fr/03-securite.qmd, wp-version 1.4.0 → 1.4.1): the July 2 EN freshness pass had flagged these counts as stale in both languages but only fixed the EN file. FR still stated 5 confirmed malicious authors and 314+/341+ malicious skills. Corrected against threat-db.yaml v2.23.0: 6 confirmed authors (sakaen736jih was missing), hightower6eu alone at 677 VirusTotal-confirmed skills, ClawHavoc campaign grown from 341 to 1,184+ confirmed entries by March 1, 2026. PDF and EPUB rebuilt.

(machine-readable/reference.yaml): the late-June rewrite of guide/security/data-privacy.md renumbered sections (Known Risks 3→2, Protective Measures 4→3, Enterprise Considerations 6→5) and removed the retention-tiers detail and IP sections, leaving 10 of 14 data_privacy_* anchors dead. Fixed all section-number anchors, corrected the TL;DR slug (tl-dr → tldr, GitHub slugger drops the semicolon without a dash), completed the truncated Risk 6 slug, repointed data_privacy_zdr to the Enterprise ZDR section and data_privacy_checklist to the new Quick Audit Checklist, removed the two entries whose target sections no longer exist (retention_policies, ip_considerations), and refreshed data_privacy_description. Documented the Cmd+K search index rebuild (pnpm build:search, scripts/build-guide-index.mjs) in a new section of docs/workflows/landing-sync.md, which the workflow referenced implicitly but never described.

(whitepapers/en/00-12): the FR pass surfaced a suspicion that EN carried the same drift, confirmed by the same 13-agent audit method. Same class of gaps found: WP04 and WP07 EN had the identical "sub-agents cannot spawn sub-agents (depth=1)" factual error, WP08 EN was missing the same 450-line Advanced Orchestration Patterns section, WP11 EN was missing the same Agentic Metrics section, WP12 EN was missing the same 4 evaluation subsections. Every fix was independently verified line-by-line post-edit after an earlier FR fix on WP00 was found to have missed its series-list correction despite a clean version bump. whitepapers/en/05-team.qmd confirmed untracked by git (blanket whitepapers/ gitignore, unlike its siblings), flagged not fixed. Full breakdown in whitepapers/CHANGELOG.md.

(whitepapers/recap-cards/fr/): dead settings.json keys (autoApproveTools, top-level allowedTools) replaced with the canonical permissions.allow in t04/c06/t06; .claude/commands/ references updated to .claude/skills/ (CC 2.1.3 merge) in c03/t09/t10; fictitious --context CLI flag removed from 01/04; permission mode canonical names, PreCompact/SessionEnd events, and a factual error (Shift+Tab×2 activates Plan Mode, not "Auto-accept all") fixed in 03/m11. All 10 rebuilt.

(whitepapers/fr/00-12): a version-only audit had marked all 13 whitepapers "fresh" (recent version field), but a deep content audit (13 dedicated sub-agents, one per whitepaper, cross-referenced against CHANGELOG.md [Unreleased] and machine-readable/) found real drift, including two factually wrong claims. WP04 and WP07 both stated sub-agents cannot spawn sub-agents ("depth=1"), outdated since Claude Code v2.1.172 (now up to 5 levels), and both were missing Sonnet 5 as the default model. WP08 was missing an entire "Advanced Orchestration Patterns" section (7 patterns, ~450 lines in the source guide) despite being previously judged up to date. WP11 was missing the whole "Agentic Metrics: What DORA Doesn't Measure" section, the WP's actual core topic. Full breakdown of all 13 corrections in whitepapers/CHANGELOG.md.

(guide/workflows/support-csm-agent.md, guide/ecosystem/mcp-servers-ecosystem.md): corrected a false claim that the official MCP Registry doesn't list HubSpot/Zendesk servers. Verified by direct query against registry.modelcontextprotocol.io/v0/servers, which does list several self-published entries. Added the distinction that modelcontextprotocol/servers (GitHub repo) is reference-only and defers to the registry for discovery, while registry presence itself signals submission, not vendor endorsement. Kept the existing star-count/commit-recency picks since the registry doesn't expose those signals.

(machine-readable/reference.yaml, llms-full.txt, guide/cheatsheet.md): three files independently understated the whitepaper count (9, 11, and 10 respectively) against the actual 13 whitepapers (00-12) on disk. Corrected all three to 13, extended whitepapers_topics in reference.yaml with the 4 missing topics (learning, budget, team-metrics, agent-engineering), and added a recap_cards_* index block since the 57-card recap-cards series had zero entries in reference.yaml.

the "FR" cheatsheet had lang: en and English-only content, essentially a stale duplicate of the EN cheatsheet. Rewrote it as an actual French translation, and refreshed both FR and EN cheatsheets with commands and features added since v3.27.6-3.29.2 (/powerup, /ultraplan, /rc, /mobile, /voice, /recap, /effort, /loop, /goal, Ctrl+F, expanded permission modes, unified skills/ folder structure, Search Tools quick reference). Both bumped to version 3.41.1, wp-version 1.1.0, and rebuilt.

(examples/skills/git-worktree*/SKILL.md): fixed 13 broken relative links that 404'd on GitHub. In git-worktree/SKILL.md, the three "Companion commands" links pointed at ./git-worktree-{status,remove,clean}.md (same directory) instead of the command files at ../../commands/, and the "Database Branch Setup Guide" link used ../workflows/ instead of ../../workflows/. The git-worktree-status, git-worktree-remove, and git-worktree-clean skills each had a "Part of:" line whose three cross-references used ./*.md (same directory) instead of ../../commands/. All links now resolve to existing files.

fixed 10 more broken relative links found via a full scan of examples/skills/. These used the wrong ../ depth — ../../guide/... (resolving to the non-existent examples/guide/) instead of ../../../guide/..., and ../hooks/, ../config/, ../agents/, ../skills/ (resolving inside examples/skills/) instead of ../../. All now resolve to the repo-root guide/ and the examples/{hooks,config,agents,skills}/ directories. Verified the full examples/skills/ tree (117 files, 57 relative links) is now 0 dead links.

fixed 10 broken navigation links found via a full link scan (1002 relative links across 259 files in guide/ + docs/). Wrong ../ depth or stale filenames in mikul-gohil-hooks-evaluation.md, nick-jensen-plugins.md, beyond-vibe-coding.md, siddhant-khare-ai-fatigue.md, system-prompts-official-vs-community.md, and 2026-02-07-paul-rayner-agent-teams-linkedin.md — they pointed into non-existent docs/guide/ or examples/guide/ paths instead of the repo-root guide/ subdirectories. Illustrative paths inside code blocks, the generated ultimate-guide.fr.md, and 3 intentional/forward-reference links were left untouched. (The matching guide/ link fixes were already merged upstream.)

(examples/github-actions/claude-issue-triage.yml): github.event.issue.title and github.event.issue.body were interpolated directly into shell via ${{ }}, allowing an attacker to inject arbitrary commands by crafting a malicious issue title. Fixed by moving both values to step-level env: (ISSUE_TITLE, ISSUE_BODY) and referencing them as plain shell variables, so GitHub Actions never interpolates user content into the script text. Reported in issue #50.

(llms.txt, machine-readable/llms.txt, mcp-server/content/llms.txt, llms-full.txt, AGENTS.md, CLAUDE.md): llms.txt still said "tracking Claude Code up to v2.1.220 (July 2026)" after the v2.1.237 tracker update, exactly the drift /update-infos-release step 4 exists to prevent. Bumped it to v2.1.237, re-synced the byte-identical machine-readable/ and mcp-server/content/ copies. llms-full.txt carried a stale "Last Updated: July 30, 2026", a line count 114 lines too high (from before the /ultraplan deletion), and the same outdated /simplify description already fixed elsewhere. AGENTS.md said "currently 3.40.0" and "~20K lines" for a guide already at 3.41.1 and 26,581 lines; it had never been touched since 2026-06-16 because it isn't wired into sync-version.sh. Tried adding it to the script, then reverted: AGENTS.md and CLAUDE.md both cite version bumps illustratively in their command examples (3.9.11 → 3.9.12), and the script's blind 3.x.x regex would corrupt those into nonsense. Documented the exclusion in both files instead, so the fix stays a manual "currently X.Y.Z" edit going forward.

(guide/ultimate-guide.md, guide/ultimate-guide.fr.md, guide/cheatsheet.md, whitepapers/en/cheatsheet.qmd, whitepapers/fr/cheatsheet.qmd, machine-readable/reference.yaml, mcp-server/content/reference.yaml): the guide still described Ultraplan as a research-preview cloud planning mode, five months after the CHANGELOG we ourselves track recorded its removal (v2.1.222, 2026-08-04, "Removed the ultraplan feature"). Deleted the ~100-line Ultraplan subsection, its comparison tables against OpusPlan and Ultrareview, the /ultraplan command-table rows, the ToC entry, and the cross-reference from Session Teleportation. Corrected /simplify's cheatsheet description to its post-v2.1.154 behavior (cleanup-only review, no longer general-purpose). Re-pointed 8 declared-anchor line numbers in reference.yaml that drifted by the same 110-line deletion (claudemd_sizing, configuration_decision_guide, mechanism_comparison_table, fifty_six_percent_warning, opus_4_6_assistant_prefill_removed, hook_teammate_idle, claude_agent_sdk, cicd) and 4 ambiguous-slug entries resolved by exact heading match instead of stale offset. Left whitepapers/guide-content.md/guide-content-fr.md untouched (gitignored, regenerated at build time) and claudedocs/*.yaml untouched (private working docs). 07-guide-reference.qmd and the client-specific cheatsheets (Purchasely, StrangeBee) keep an accurate /simplify description already and were not touched.

(machine-readable/agentsec-security-feed.v1.json, AgentSec exports/security-feed.v1.json, landing src/data/agentsec-security-feed.v1.json): the canonical feed now comes from AgentSec and reports 114 CVEs, 93 malicious skill or package records, 18 reviewed sources, and 9 events. Seven CVEs in this lot passed the primary-source promotion gate: two for Claude Code and Gemini CI plus five MCP Ruby SDK advisories. The nine community MCP rows still present in the guide compatibility database were not promoted to AgentSec in this lot and are not counted by the public feed. The earlier manual feed note claiming 123 canonical CVEs, four events, six sources, and unchanged input digests is superseded. Every new event now uses the schema-supported not_detected or not_applicable coverage status.

(examples/commands/resources/threat-db.yaml, guide/security/security-hardening.md new §1.6, examples/scripts/supply-chain-triage.py, machine-readable/reference.yaml, mcp-server/content/reference.yaml): the Shai-Hulud keyv/cacheable npm worm of 2026-08-04, cross-checked across eight vendor reports (SafeDep, Aikido, Chainguard, Snyk, JFrog, ArmorCode, Socket, The Hacker News) rather than taken from any single one, because their counts disagree and the disagreement is itself the finding. Three corrections to what circulated publicly: the @keyv/* storage adapters ARE compromised at 6.0.0 (JFrog's affected-package table and SafeDep's CSV both list them, contradicting an early report that they stayed clean); the named gh-token-monitor file paths come from Snyk's TanStack analysis of 2026-05-11 and are NOT confirmed in a keyv sample, so their absence proves nothing; and Aikido's live figure is 444 packages across 1,381 versions as of 2026-08-05 13:15 CEST. Counts are recorded per source with their timestamps instead of collapsed into one number. New campaign entry covering the provenance abuse (malicious releases carry valid OIDC and SLSA attestations because the maintainer's own GitHub Actions workflow published them, so npm audit signatures passes; Chainguard calls it the first documented npm worm producing validly attested malicious packages), 17 confirmed package@version pairs, three full SHA-256 payload hashes, npm-cache.com plus pypi-get.com and js-mirror.com as egress to block, and a remediation order that puts persistence removal before credential rotation because the payload ships a watcher that fires ON revocation. Two new attack techniques: T039 Agent Config Persistence (SessionStart, Setup, InstructionsLoaded, DirectoryAdded, and VS Code runOn: folderOpen, linked to CVE-2026-48124, CVE-2026-25725, CVE-2026-33068) and T040 AI Agent Commit Impersonation. The guide's §1.5 previously covered only PreToolUse/PostToolUse hooks, which need agent activity to fire; §1.6 covers the four events that fire on folder open, before any prompt, which is why attackers use them for persistence, and states the blunt consequence that git clone plus opening the folder is enough to execute attacker code with every package-manager defence sitting on a path the attack never takes. T040 documents the part with no prior analog: the worm commits as claude <claude@users.noreply.github.com> with the message chore: update config across up to 50 branches per repo, skipping dependabot and copilot, so on a repository where an agent already commits, authorship stops discriminating and branch fan-out becomes the signal. 8 new sources. YAML validated, 605/605 index anchors resolve.

(examples/scripts/supply-chain-triage.py): checks lockfiles (parsed per format, since npm writes name and version on separate lines and a proximity regex either misses the pair or, widened enough to catch it, starts pairing a name with the neighbouring entry's version), the installed tree, payload hashes, agent and editor startup hooks, revocation watchers, and egress config, in incident-response order. Reads its IOC set from threat-db.yaml instead of hardcoding one, with a built-in fallback so it still runs on a quarantined machine with no PyYAML. Two bugs were caught by the positive control and would have shipped without it: an initial dropper pattern matching install.js and postinstall flagged esbuild's entirely legitimate "postinstall": "node install.js", and the first lockfile matcher missed keyv@6.0.0 in a real package-lock.json. Deliberately not a filename scan, and the docstring says why: Math_Symbol.js is a genuine Unicode category file inside regenerate-unicode-properties and setup.mjs ships legitimately in motion-dom, so the attacker picked names that collide with common transitive dependencies. Measured on this workstation, a filename sweep across 152,491 installed package.json files returned 32 hits, all benign, while the preinstall check returned zero. Full run 5m42s, --fast 1m43s, same verdict.

(examples/commands/resources/threat-db.yaml, guide/security/security-hardening.md CVE table + new §1.2 subsection, machine-readable/reference.yaml, mcp-server/content/reference.yaml): 4 Perplexity searches over the 2026-08-06 to 2026-08-17 window, then every candidate verified against a primary source before entry. Two findings from search were rejected as duplicates on verification: **ChainDrop** is Microsoft Threat Intelligence's name for the keyv/cacheable worm already tracked at v2.26.0, not a second campaign (recorded as an alias with Microsoft's write-up added to the source list rather than filed twice), and **DuneSlide** came back as new but CVE-2026-50548/50549 were already in the table. **16 new CVEs.** Two are critical and directly actionable: CVE-2026-54316 in **Claude Code** (NVD 9.1, affects 0.2.54 through 2.1.162, fixed in **2.1.163**), where huggingface.co was allowlisted as a bare hostname for WebFetch so any path on it was fetched with no prompt, and Novee Security turned Hugging Face's public download counter into an exfiltration oracle: 64 attacker-created model repos, one per possible character, reading an API key back one increment at a time over a domain the operator trusted on purpose. Anthropic self-scored it CVSS v4 6.0 against NVD's 9.1; both numbers are recorded because the gap is a scoring-model disagreement, not two bugs. And CVE-2026-12537 in **Gemini CLI** plus the run-gemini-cli Action (CVSS v4 **10.0**, fixed in 0.39.1 / 0.1.22), where headless CI trusts the workspace automatically so a .gemini/.env in an untrusted PR executes OS commands on the CI host *before the sandbox initialises*. Both came out of Novee Security's Black Hat USA 2026 talk, already tracked here as technique T036 "Comment and Control" but with no CVEs attached until now. Five more cover the **MCP Ruby SDK**, all fixed in mcp gem **0.23.0** (CVE-2026-67431 session-ownership failure at NVD 9.1, CVE-2026-67432 unbounded request body read *before* auth, CVE-2026-63118 no Host/Origin check, CVE-2026-63119 unbounded stdio line reads, CVE-2026-67430 sessions that never expire). The minimum_safe_versions floor for mcp-ruby-sdk was still 0.9.2, eight advisories behind. The remaining nine are a selected subset of the ~20 VulDB records that landed on NVD in a single day (2026-08-09), all SSRF or path traversal across unrelated community MCP servers; the subset chosen sits in the Claude Code and skills tooling path (skill-vision-control, skill-ninja-mcp-server which writes AGENTS.md, claude-sesh, codex_mcp, Ollama-mcp, spec-workflow-mcp), and the entry says plainly that it is a subset with the full list in the source rather than implying complete coverage. Most are unpatched because maintainers never answered disclosure. **One new campaign**: the skills.sh Skill Supply Chain attack (Zenity Labs, disclosed at Black Hat USA 2026-08-06), with 4 malicious skill/package entries and 2 exfiltration domains. Attackers cloned Paperclip and Browser Use verbatim, published the typosquats clean so they passed marketplace checks precisely by being byte-identical to skills that deserved to pass, farmed installs and trending position for weeks, then trojanized on 2026-07-11; 1.7M aggregate installs by 2026-08-02. The false-positive note matters here: the malicious domain has a doubled p (getpaperclipp[.]com) and a request to telemetry[.]paperclip[.]ing is benign. **Three new attack techniques.** T041 **Ghostjacking** (Tenet Security, DEF CON 34 Main Track, 2026-08-09): the attacker never touches the agent, they arrange for injected text to land in a log the agent will later be asked to investigate. A request crafted to be *blocked* by Cloudflare's WAF gets its payload logged verbatim, and an agent reviewing blocked events rewrites DNS to "fix" the finding, 9 times out of 10 against Claude Code on Sonnet 4.6, under Cloudflare's own recommended MCP setup, across at least 48 organisations including 6 confirmed Fortune 500. Also demonstrated on Datadog (2,700+ leaked client tokens) and Sentry (~2,400 exposed DSNs), plus agent-to-agent movement where Sentry's Seer adopts the injection as its own finding and Cursor trusts Seer, and a Claude Desktop network-sandbox zero-day (disclosed, confirmed, fixed) where a reused permissive JWT passed the egress gateway. Supersedes T033 Agentjacking, Tenet's earlier Sentry-only research. T042 **Progressive Disclosure Payload Hiding** and T043 **Trusted-Domain Counter as Exfiltration Oracle**, the generalisation of CVE-2026-54316: any read-write public metric on an allowlisted domain is a channel, so download counts, star counts and reaction counts all qualify, and domain-based egress filtering cannot see it. **Three new tools**: AI Total (Zenity, free, detonates a skill in a live agent sandbox seeded with bait credentials), Numbat (Perplexity, **Apache 2.0**, single Go binary, 52 CEL rules across 11 categories, pre-action blocking, cross-harness over Claude Code / Codex / OpenCode / Pi, everything local), and agent-jackstop (Tenet, open source, the four controls that map onto Ghostjacking's kill chain). Numbat is the notable one: free, self-hosted, and the closest thing yet to the behavioural runtime control Tenet argues is the only real answer, in a section otherwise dominated by commercial platforms. Plus 2 defensive resources (OWASP GenAI State of Agentic AI 2.01 with the AGT-001/AGT-019/SEC-001 control IDs, Open Secure AI Alliance) and 12 sources. Four minimum_safe_versions corrections: claude-code 2.1.92 → **2.1.163**, mcp-ruby-sdk 0.9.2 → **0.23.0**, and new floors for gemini-cli, run-gemini-cli and spec-workflow-mcp. The three highest-impact CVEs mirrored into the security-hardening CVE table. The new §1.2 subsection exists because this campaign defeated two mitigations that section recommends: reviewing SKILL.md missed instructions that lived in a secondary setup-installation.md loaded only at the install step (progressive disclosure used as a hiding place), and pinning a version did not help because the version pinned was genuinely clean when pinned. Over 30% of dangerous skills in Zenity's sweep use the agent itself as the dropper, which is why static review of a skill's text cannot work: the payload does not exist at scan time. YAML validated, 878/878 index anchors resolve, coverage 92/92.

(machine-readable/agentsec-security-feed.v1.json, landing src/data/agentsec-security-feed.v1.json, src/data/security-data.ts, src/data/agentsec-security-feed.test.ts, src/data/rss-entries.ts, regenerated guide-search-entries.ts and guide-content-entries.ts): scripts/check-agentsec-security-feed.py hard-fails CI when feed.database.version differs from the threat database, so the v2.27.0 bump broke the build until the feed was re-cut. Its database block now carries 2.27.0 / 2026-08-17 with record_counts derived from the file rather than typed by hand (attack_techniques 40 → 43, campaigns 17 → 18, cves 107 → 123, malicious_skill_records 89 → 93). Because the security page reads cves-tracked from feed.database.record_counts.cves, the public counter moves 107 → 123 with no page edit. Four intelligence events added with 6 sources: Ghostjacking, the skills.sh Paperclip campaign, the two CI CVEs, and the five MCP Ruby SDK advisories. Each carries detector_coverage.status: "not_covered" stated plainly, because the only shipped detector targets Shai-Hulud Keyv and claiming coverage the scanner does not have would be worse than admitting the gap. **input_digests was deliberately left untouched**: neither digest matches the sha256 of the guide's threat-db.yaml at the commit that introduced them, so they describe the intelligence bundled inside AgentSec Triage 0.1.0a0, not this repo's file, and recomputing them here would fabricate a provenance claim. landing_metrics also untouched, since no new measurement supersedes the Snyk ToxicSkills sample. Two bugs found by running the checks rather than trusting the edit: date_kind: "published" is not in the parser's occurred | disclosed | updated enum and threw at module load, and agentsec-security-feed.test.ts pinned Threat DB v2.26.0 plus cves-tracked: 107 as expected values. Separately, security-data.ts still feeds the live threat-search widget on /security/ and had drifted to v2.22.0 / 2026-06-18: 63 of 93 malicious-skill records, missing every entry added since mid-June including all the Shai-Hulud keyv packages and the four Paperclip artifacts. Synced to 93, meta and cves_tracked corrected, version?: string added to the MaliciousSkill interface for pinned supply-chain entries, and its header comment repointed from examples/skills/update-threat-db/threat-db.yaml to the canonical path, the same stale-fork pointer already fixed in reference.yaml at v2.26.0. public/security-fs.json needed no intervention: build-security-fs.mjs already reads the canonical file and regenerates at build time (v2.27.0, 367.8 KB). One RSS entry (new_section). The announcement banner was left alone deliberately: bumping BANNER_ID resets the dismissed state for every visitor, and that is an editorial call rather than a sync step.

(machine-readable/reference.yaml, mcp-server/content/reference.yaml): the key resolved to examples/skills/update-threat-db/threat-db.yaml, last updated at v2.18.0 on 2026-05-16 and never touched since its "copy threat-db" commit, while the actively maintained file is examples/commands/resources/threat-db.yaml (now v2.26.0). Repository-wide, 8 references point at the stale copy and 12 at the canonical one, so any skill reading the former runs on eight-versions-old intel. The key now resolves to the canonical file, the stale copy is indexed separately and labelled, and the de-duplication itself is tracked in IDEAS.md.

(guide/ultimate-guide.md, guide/cheatsheet.md, guide/core/architecture.md, guide/core/visual-reference.md, guide/diagrams/01-foundations.md, machine-readable/reference.yaml, machine-readable/llms.txt, llms.txt, llms-full.txt, mcp-server/content/reference.yaml, quiz/questions/06-commands.yaml): the guide cited commands across three overlapping tables that had drifted apart, and none of them named a source of truth. Every one of the 101 commands listed at code.claude.com/docs/en/commands was checked for an occurrence anywhere in guide/, machine-readable/, docs/, examples/ and README.md. Thirteen had never been mentioned in any form: /autofix-pr, /design-login, /design-sync, /fewer-permission-prompts, /heapdump, /install-slack-app, /passes, /privacy-settings, /radio, /run-skill-generator, /stickers, /stop, and /pr-comments (the last one removed upstream in v2.1.91). Thirteen more appeared only inside historical release notes and never in a reference table: /advisor, /claude-api, /dataviz, /verify, /run, /subtask, /security-review, /export, /ide, /reload-skills, /upgrade, /color, /usage-credits. §10.1 is now the canonical table, all 99 current commands grouped into nine categories with aliases, arguments and availability constraints, opening with a source-of-truth callout pointing at the official page and at cli-reference for launch flags, and closing with a removed/renamed/never-existed section. §6.1 keeps a curated daily-driver subset and links to §10.1 rather than duplicating it, which is what let the two tables diverge. The official commands and CLI reference URLs were added to the Tier 1 sources table in architecture.md.

(guide/ultimate-guide.md x5, guide/cheatsheet.md, guide/core/visual-reference.md, guide/diagrams/01-foundations.md x2, machine-readable/reference.yaml, mcp-server/content/reference.yaml, llms-full.txt, quiz/questions/06-commands.yaml): the guide taught /execute as the way to leave plan mode in eleven places, including a quiz question whose explanation stated it outright. It appears nowhere in the official commands reference and nowhere in the 5,248-line upstream CHANGELOG. Plan mode is exited by approving the plan Claude presents or by pressing Shift+Tab. The landing quiz had already been corrected for this during the July 8 fact-check pass; the guide itself had not. A dedicated row in §10.1 now records that it is not a command, so the error does not get reintroduced from an old draft.

(guide/ultimate-guide.md, guide/cheatsheet.md, machine-readable/reference.yaml, mcp-server/content/reference.yaml, llms-full.txt): the old name is what shipped in v2.1.111 and is still correct inside that release's notes, which are left untouched as a historical record. Everywhere the guide presents a command as currently usable, it now uses the official name, with the former name given inline so the v2.1.111 notes stay findable.

(scripts/generate-examples-data.py, landing src/data/examples-data.ts): category keys were written unquoted, so the eight containing a hyphen (hooks-bash, hooks-powershell, claude-md, team-config, github-actions, mcp-configs, context-engineering, semantic-anchors) were not valid bare identifiers and esbuild aborted with Expected "}" but found "-". Found while trying to validate the quiz and cheat-card corrections through a landing build. The generator now quotes any key that is not a valid identifier; examples-data.ts was regenerated (268 entries) and pnpm build passes again at 428 pages.

(guide/ultimate-guide.fr.md): the file is generated by scripts/translate-guide.py and would pick up the corrected English source on the next run, but it is live on the landing today, so the six occurrences of /execute and the /less-permission-prompts row were corrected in place rather than left wrong until the next translation pass.

(landing src/content/cheatsheets/*.md, src/content/questions/**, src/data/glossary-data.ts, src/data/diagrams-data.ts; quiz/questions/*.yaml; whitepapers/{fr,en}/*.qmd; whitepapers/recap-cards/{fr,en}/*.qmd; whitepapers/CHANGELOG.md): the guide was not the only surface teaching /execute. The web quiz contained a direct self-contradiction, question 02-009 stating "there is no /execute slash command in Claude Code" while 06-006 instructed readers to "use /execute to exit Plan Mode"; only the first had been caught in the July 8 fact-check pass. Every published surface was swept: 4 landing cheat cards, 9 quiz questions, 11 whitepapers, 6 recap cards. Seven quiz questions pointed their official_doc at code.claude.com/docs/en/slash-commands, a URL that now serves the skills page rather than the commands reference; the three about built-in commands were repointed at /docs/en/commands and the four about custom commands at /docs/en/skills. Question 10-022 taught that effort has three levels because "max was removed in v2.1.72", which was true then and is not now, so it gained a current-state paragraph covering xhigh (v2.1.111), max and ultracode rather than a rewrite that would have erased the historical framing. Question 10-028 described a nonexistent "Execute Mode". The CLI quiz YAML was regenerated from the canonical web bank with pnpm sync-from-web rather than hand-edited, per the one-way sync the July fork cleanup established.

(landing src/content/cheatsheets/t03-permission-modes.md): its table listed "Auto-accept all" on Shift+Tab x2 (that cycles to Plan mode), had no plan, auto or dontAsk rows at all, and presented /less-permission-prompts as the way to enter "Auto (Max users)" mode, which conflates a skill that writes an allowlist with a permission mode driven by a classifier. The card set is generated from whitepapers/recap-cards/, and the recap-card source had already been corrected in the July 3 pass; the landing copy had never been regenerated, so the two had silently diverged. The table now carries the six canonical mode names with their real activation paths, matching the recap card.

(machine-readable/reference.yaml, mcp-server/content/reference.yaml, guide/ultimate-guide.md): four entries in the machine-readable index described something the command does not do. /effort listed the enum as xlow/low/default/high/xhigh (the real set is low/medium/high/xhigh/max/ultracode, with max and ultracode session-only), /focus was described as "focuses agent on specific files or tasks" (it toggles a minimal view), /tui as "shows tool calls in TUI mode" (it selects the renderer), /proactive as "enables proactive suggestions" (it is an alias of /loop) and /undo as "reverts last action" (alias of /rewind). The /branch versus /fork paragraph in §6.1 still described /fork as a plain alias of /branch, which stopped being true in v2.1.212 when /fork became "copy the conversation into a background session" and the in-session subagent moved to /subtask.

(guide/ultimate-guide.md): covers the narrower case where the goal is not a rewrite but a verified pointer from each documented feature to the file and symbol implementing it. Describes the four-layer model (deterministic anchor, semantic extraction, deterministic gate, standardized output via OKF), the LSP-then-grep-then-unresolved resolution order with an EXTRACTED / INFERRED confidence field, and why a commit hash is a freshness marker rather than a permanent anchor. Three tools were evaluated hands-on against a legacy fleet running a non-standard in-house framework: Reversa (rejected, one CRITICAL path-traversal in its uninstall path, zero automated tests across 56 releases, bus factor of one, and an unverified confidence seal), code-graph-mcp (rejected on measured evidence, 12/12 false inferred edges at maximum confidence on Fastify and zero routes extracted on the custom framework), and Graphify (retained as the strongest deterministic building block, its EXTRACTED tag is architecturally enforced and it emits no edge rather than inventing one when framework detection fails).

(machine-readable/reference.yaml, machine-readable/cowork-reference.yaml, machine-readable/llms.txt, machine-readable/README.md, llms.txt): the five files under machine-readable/ were validated programmatically rather than eyeballed, and every claim they make about the repo was checked against the filesystem. reference.yaml had 10 section anchors that no longer resolved to a real heading, all in content that had been restructured since the anchors were written (memory-systems.md sections 1, 2.1, 2.2, 2.3, 3.6, 4.7 and 7.1, the METR and DeputyDev paragraphs in adoption-approaches.md which are bold text inside the J-curve section rather than headings of their own, and the annotation cycle in plan-driven.md which is #phase-2-the-annotation-cycle). Those anchors feed the landing's Cmd+K palette, so a stale one is a dead link in production, not just a cosmetic error. Ten guide files were indexed for the first time: the whole guide/learning-path/ series (7 modules), hooks-events-reference.md, community-patterns.md, dynamic-workflows.md, code-review.md, github-actions.md, agent-evaluation.md, team-metrics.md, api-gateway.md, and guide/cheatsheet.md as a standalone file distinct from the in-guide section at line 19597. The Mermaid block claimed 41 diagrams across 10 files; the real figures are 48 across 12. Post-edit validation confirms 0 dead paths, 0 unresolved anchors, and 0 out-of-bounds line references across 265 line refs and 160 anchors.

(machine-readable/cowork-reference.yaml): the file still described Cowork at v1.0.0 (2026-01-20) and every documentation path resolved into cowork/, a directory removed from this repo in v3.9.7 (commit 9a29ba4). It is now at v1.12.0 with a repo: block giving the GitHub base URL of the dedicated claude-cowork-guide, matching the pattern reference.yaml already used for the Cowork cheatsheet. The content facts were refreshed too: Windows support since 2026-02-10 (the file still said macOS only), 1M-token context beta on Opus 4.6 (it said ~165K usable of 200K), the 11 official plugins and the Claude Legal extension, Agent Teams and scheduled tasks, and the current usage-window figures. Counts were taken from the Cowork repo's actual file tree rather than copied from its own index, which under-reports: 29 workflows not 28, 17 whitepapers not 12, and 4 sector prompt packs (conciergerie, ecommerce, immobilier, restauration) that had no entry at all. The naming convention trap is documented inline, since prompts/ uses .fr.md for French while workflows/ uses .en.md for English.

(machine-readable/llms.txt, llms.txt): the file had not been touched since 2026-06-23 and was describing a guide two months out of date, including two figures that are now simply wrong (a "200K token budget" and "9 hook events" against the documented 30). Coverage now names memory systems, dynamic workflows, agentic software factories, enterprise governance, team metrics, API gateway cost control, AI unit economics, the learning path, and practitioner insights, and adds a machine-readable entry-points section plus the releases and whitepapers URLs. The root llms.txt was byte-identical to the machine-readable/ copy at HEAD and was resynced so the invariant holds.

(machine-readable/README.md): last touched in January (v3.1.0), the table omitted claude-code-releases.yaml and cowork-reference.yaml entirely and advertised reference.yaml at "~2K tokens" when it measures ~44K. Anyone following the file's own advice to paste it into a system prompt was quietly burning a fifth of a 200K window. Sizes are now measured and labelled as such, with an explicit note to grep the index and follow the path rather than load it whole, plus a maintenance section covering version sync, anchor drift after guide restructures, and the pnpm build:search rebuild that deep_dive key changes require on the landing.

(machine-readable/claude-code-releases.yaml): re-checked against the upstream anthropics/claude-code CHANGELOG and the weekly docs digest. v2.1.220 (2026-07-24) is still the latest published release, and both Week 29 features (MCP connectors in published artifacts, screen reader mode) were already tracked. Weeks 30 and 31 are not published yet.

(guide/core/memory-systems.md, guide/learning-path/03-memory.md, guide/ecosystem/*.md, guide/core/methodologies.md, guide/core/community-patterns.md, guide/ops/devops-sre.md, guide/workflows/*.md, guide/ultimate-guide.md, guide/ultimate-guide.fr.md, docs/resource-evaluations/*.md, landing src/data/ecosystem-data.ts, src/data/glossary-data.ts, src/pages/memory-systems/index.astro, src/pages/ecosystem/mcp-vs-cli.astro, src/pages/context-engineering/index.astro, src/components/landing/MemorySystems.astro, src/components/landing/TokenOptimization.astro): every repo referenced with a stated star count across the living guide and the 55 dated docs/resource-evaluations/ files was re-verified against gh api repos/OWNER/REPO, not left at whatever number was last typed in. Most tools grew substantially in the community's usual hypergrowth pattern (claude-mem 26.5K to 88.7K, agentmemory 16K to 25.9K, RTK 446 to 73.5K, obra/superpowers 95K to 262K, BMAD-METHOD 50.2K to 51.2K, awesome-claude-code 20K to 51K), and several repos had been renamed or transferred to new orgs since the number was recorded (kairn-ai/kairn to primeline-ai/kairn, safishamsi/graphify to Graphify-Labs/graphify, block/goose to aaif-goose/goose, steipete/mcporter to openclaw/mcporter, ryoppippi/ccusage to ccusage/ccusage, clawdbot/clawdbot to openclaw/openclaw, rely-ai-org/caliber to caliber-ai-org/ai-setup). Two anomalies are flagged inline rather than silently overwritten: doobidoo/mcp-memory-service now returns 404 (the account no longer resolves, marked [UNVERIFIED] everywhere it's cited), and NicolasPrimeau/artel dropped from 210 stars at its original listing to 7, a reminder to treat brand-new-repo star counts as noisy rather than a stable signal. The 151 dated resource evaluations keep their original historical figure intact (that's evidence of what was known when each was scored) and get a same-language appended annotation with the current count and verification date, rather than a rewrite. Landing pages get a visible "star counts verified" note on the memory-systems page and its MemorySystems.astro component, matching the pattern the user pointed at directly.

(guide/ultimate-guide.md §9.21, machine-readable/reference.yaml): added under Legacy Codebase Modernization, covering the case where the goal isn't rewriting a system but building a verified pointer from a documented feature to the file and symbol that implements it (for costing, auditing a claimed status, or archival decisions). Documents a four-layer model (deterministic anchor, semantic extraction, deterministic gate, standardized output via OKF), the EXTRACTED/INFERRED confidence schema with LSP-then-git grep resolution order, and field-tested verdicts on three tools against a fleet with a non-standard in-house framework: Reversa rejected (CRITICAL path-traversal, zero automated tests across 56 releases, decorative confidence seal, frozen module-split guess when framework detection fails), code-graph-mcp rejected on evidence (12/12 false high-confidence edges measured on a modern stack), Graphify retained as the strongest deterministic building block (its EXTRACTED tag verified as architecturally enforced, not self-declared, though it still breaks on dynamic route dispatch). While editing this range, found that eight harness_* entries in reference.yaml (harness_agents_md_as_toc through harness_throughput_merge) already pointed roughly 550 lines short of their real target before this change, unrelated pre-existing drift, flagged here rather than fixed since locating their correct anchors is a separate pass. resource_evaluations_appendix was accurate and has been corrected for the 58-line shift this addition introduces (26294 to 26352).

(machine-readable/claude-code-releases.yaml, guide/core/claude-code-releases.md, landing src/data/releases.ts, mcp-server/content/): five releases condensed, covering July 20 to July 24, 2026. The headline is **v2.1.219**, which makes **Claude Opus 5** (claude-opus-5) the default Opus model with 1M context and fast mode at $10/$50 per Mtok, drops Opus 4.7 from fast mode, and adds the DirectoryAdded hook, sandbox.network.strictAllowlist, and the workflowSizeGuideline settings key. Subagent limits moved twice in three days: v2.1.217 capped concurrent subagents at 20 (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS), disabled nesting entirely, and finally made --max-budget-usd halt background agents; v2.1.219 then restored nesting to depth 3. v2.1.218 moved /code-review to a background subagent, required workspace trust for agent frontmatter hooks, and made context: fork skills run in the background by default. v2.1.216 added sandbox.filesystem.disabled and fixed a quadratic message-normalization slowdown that stalled long sessions. Two security fixes landed: symlinked working directories escaping background-session isolation (2.1.217) and untrusted-folder agent hooks (2.1.218). Added a Models and Behavior breaking-changes table to the Markdown release history, plus three milestone rows. MCP server content resynced and bumped to 1.2.6 (not published).

(quiz/src/index.js, quiz/src/quiz.js, quiz/src/topics.js, quiz/src/ui.js, quiz/README.md): categories 11-17 were present in the YAML question bank but unavailable through the interactive picker or --topics; Power User now covers the complete bank, the PM profile has enough eligible questions to deliver its promised 10-question overview, and a new quiz avoids questions from the immediately preceding set when the pool allows it.

(guide/core/memory-systems.md §3.7 + §3.9 + §4.7 + §9 + §10, docs/resource-evaluations/diffmem-git-native-memory.md, docs/resource-evaluations/README.md, guide/core/credits.md): new §3.7 "File-Based Experience Playbooks" ties together the whole no-vector, Git-committable memory track. **ORF** (Guillaume Laforge) is documented as the primary entry: three-tier progressive disclosure (index ~200 / frontmatter ~500 / playbook ~800 tokens), the Abstracted-Insight vs Validated-Path schema split, and the deliberate divergence from **ReasoningBank** (Google, arXiv 2509.25140), which retrieves by embeddings where ORF retrieves by LLM-read frontmatter. **DiffMem** (Growth Kinetics) is added as a case study, not a recommendation, evaluated from source at HEAD 9d24d0c: it **deleted its BM25 module** (commit c4fe4a3) in favor of LLM-agentic git-shell retrieval (one run(command=...) tool behind a whitelist, the agent greps and git blames the repo instead of querying an index), with orphan-branch-per-user isolation via git worktree; disqualifiers logged (bus factor one, no LICENSE file, retrieval core untested and in a rebuilding-retrieval branch) plus the shell=True arg-validation injection caveat. The section carries the sharpest transferable lesson, **match retrieval to query shape**: DiffMem's semantic people-and-events queries killed BM25, but a coding-agent memory's lexical queries (error strings, stack traces, symbols) are exactly where BM25 beats embeddings at a fraction of the cost, so DiffMem's abandonment argues for retrieval fit, not against BM25. A **practitioner-pattern** subsection documents this guide's own /retex setup (structured lessons in .claude/memories/retex-*.md, session-start surfacing and inline warnings via .claude/rules/retex-review.md) and the existing BM25 smart-suggest-routing engine as the right retrieval base for a retex corpus, with an LLM-agentic git-shell pass as an optional escalation tier. Supporting edits: ORF + DiffMem rows in the §3.9 master comparison table, a Git-native distribution note in §4.7 (files sidestep the single-tenant-DNA barrier but inherit Git's non-semantic merge), a ReasoningBank academic anchor in §9, two new §10 open problems (consolidation/staleness of playbooks, plus the file-based track as the partial exception to "no Git equivalent for memory"), source links updated, and credits entries for Guillaume Laforge and Growth Kinetics. DiffMem promoted from a private working candidate to a tracked 3/5 evaluation; README index now shows ORF (3/5) and DiffMem (3/5), footer corrected to 167 files on disk / 48 indexed.

(guide/core/architecture.md, guide/ecosystem/third-party-tools.md, guide/security/data-privacy.md, guide/workflows/agentic-software-factories.md, examples/skills/eval-hooks/SKILL.md): replaced ten invalid root-relative and machine-local destinations with portable repository-relative links.

(docs/resource-evaluations/orf-open-reasoning-format.md): source-level evaluation of Guillaume Laforge's file-based cross-session memory format for coding agents (blog post, 2026-07-21). An agent records operational learnings as Markdown playbooks with YAML frontmatter under ./experiences/, then reloads them next session to skip dead ends it already paid for. The design bet is explicit: drop the embedding/vector retrieval that ReasoningBank (Google, arXiv:2509.25140, verified) uses, and retrieve by filename plus one-line frontmatter descriptions read by the LLM, trading semantic recall for zero infrastructure and Git-committable files. Three patterns worth extracting were logged: three-tier progressive disclosure for retrieval with an explicit token budget (index ~200, category frontmatter ~500, single playbook ~800), separating the abstract insight from the validated concrete path in the 5-section schema, and an auto-synced INDEX.md that cannot drift because writing a playbook writes its index entry in the same operation. **Evidence quality scored 1/5**: the "66.7% to 100% SWE-bench Lite" figure is 3 tasks with one flipped, "-52% steps" is a single scenario, and the author states plainly it is "by no means a scientific evaluation"; no benchmark number is citable. The unproven core is retrieval without embeddings (an LLM reliably matching a task to a one-line description, no precision/recall data exists), and the author self-reports "haven't used the ORF skill in anger yet". Decision: mention in guide/core/memory-systems.md as the no-vector, Git-committable experience-playbook track missing from a list that is mostly SQLite-vec/ChromaDB, cite ReasoningBank as the academic anchor for success-and-failure memory (currently absent from the guide), and note it in §4 as a partial answer to the structural team-sharing gap (git commit experiences/ shares one developer's agent fix with the team, though consolidation and staleness stay unsolved). Do not recommend the tool for production. Integration into the guide was completed in the follow-up pass below.

(machine-readable/claude-code-releases.yaml, guide/core/claude-code-releases.md): two new releases condensed (2.1.213 was never published upstream). **v2.1.214** (2026-07-18) is the heaviest security release of the 2.1.2xx line, with eight distinct Bash permission-check holes closed: single-segment allow rules like Edit(src/**) were auto-approving writes to nested src/ directories anywhere in the tree instead of only <cwd>/src; commands over 10,000 characters now always prompt; file-descriptor redirect forms that bash parses differently than the permission analyzer now fail closed; zsh variable subscripts inside [[ ]] are no longer treated as inert text; certain help and man invocations that could smuggle command substitutions are no longer auto-allowed; and a bypass affecting Windows PowerShell 5.1 sessions was fixed. It also adds the **EndConversation tool** (Claude can end sessions with highly abusive users or jailbreak attempts, matching claude.ai behavior since 2025), a periodic progress heartbeat for long-running tool calls that previously went silent, CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH plus message.uuid / client_request_id / tool_source OpenTelemetry attributes for message-level correlation, and a large sweep of background-session lifecycle fixes (idle sessions keeping the daemon alive, completed sessions unremovable via claude rm, a displaced daemon deleting its successor's control socket). Three behavior changes worth noting for anyone with existing config: single-segment dir/** hook if: conditions now match only <cwd>/dir (write **/dir/** for any-depth, while deny/ask permission rules keep their any-depth match), file -m/-f is no longer auto-allowed as read-only, and docker daemon-redirect flags (--url, --connection, --identity, Podman remote mode) now prompt. **v2.1.215** (2026-07-19) stops Claude from invoking the /verify and /code-review skills on its own; both are now explicit-only. Milestone and breaking-change summaries updated in both files.

(machine-readable/claude-code-releases.yaml, guide/core/claude-code-releases.md): condensed two new releases. **v2.1.212** (2026-07-16) makes /fork copy the conversation into a new background session (the in-session subagent it used to spawn is now /subtask), adds a session-wide WebSearch cap (CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION, default 200) and a per-session subagent-spawn cap (CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION, default 200), auto-backgrounds MCP calls running past 2 minutes (CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS), and ships two security fixes (plan mode no longer auto-runs file-modifying Bash without a prompt; worktree creation no longer follows a committed .claude/worktrees symlink outside the repo); it also deprecates the Task tool's mode parameter, now ignored (subagents inherit the parent session's permission mode). **v2.1.211** (2026-07-15) adds --forward-subagent-text / CLAUDE_CODE_FORWARD_SUBAGENT_TEXT for subagent text and thinking in stream-json output, plus two security fixes (permission previews neutralize bidirectional-override and look-alike characters; auto mode no longer overrides a PreToolUse hook's ask for unsandboxed Bash). Milestone and breaking-change summaries updated in both files.

(guide/ecosystem/agentic-tools.md, guide/workflows/spec-first.md, guide/workflows/agentic-software-factories.md, claudedocs/perplexity-prompt-agentic-software-factories.md): a July 2026 research pass surfaced eight open-source multi-agent orchestrators (CAO, Mission Control, KanBots, Claw-Kanban, OpenKanban, Open Orchestrator, AI Agent Board, refute-or-promote), all re-verified against the GitHub API rather than the research summary. **Seven of the eight fail the bus-factor test**, with a single contributor holding 95% to 100% of commits; the lone exception is **CAO** (awslabs/cli-agent-orchestrator, Apache-2.0, 41 contributors, top at 20%), now documented as **§4.6** in agentic-tools.md. The sharpest illustration of the guide's star-count skepticism is preserved in that section: Mission Control carries 5,763 stars against CAO's 893 (6.4x) and one person wrote 78% of its commits, so sorting the market by stars selects the wrong tool. Provider list taken from CAO's README rather than the research summary, which had it wrong (Antigravity CLI, Hermes Agent, Cursor CLI, not Gemini/Q as reported). **New "consultancy-backed factory" cohort** added to the full-cycle factories section of spec-first.md: Thoughtworks AI/works (launched January 2026) and Agent/works (launched June 16, 2026, both confirmed via press releases), Solario/WeScale, Sopra Steria IAKA, Accenture AI Refinery, a category the previous table missed because it listed only VC startups; these lead with governance and sell velocity second, inverting the startup pitch. Solario is flagged hardest, since a platform positioned "Governance Before Scale" documents no enforcement mechanism, no underlying model, no pricing, no named customer. Agent/works' "provable compliance before execution" claim is flagged as the one worth watching (closer to model checking than prompt governance, if real). The unbounded-velocity section of agentic-software-factories.md gains the market-level finding: **no maintained open-source orchestrator industrializes adversarial verification** (execute the code to break it); every tool examined falls back to exit codes, pre-push hooks, or LLM-on-LLM review, which makes Fusion's dead-code double-checkout the closest thing to an answer anyone has written, and even Refute-or-Promote's own reference implementation is a one-star playbook abandoned three days after creation. The Perplexity prompt file gained a fourth section (relance #3, the falsifiable challenge that asks a search engine to disprove the "no verified production deployment" claim on the closed platforms) plus an ESN/consultancy axis and a Solario exclusion. All GitHub figures re-derived via gh api on 2026-07-16, none taken from the research summary. **Falsifiable-challenge pass run on the closed platforms** (WebSearch, since the Perplexity MCP returns 401): an active attempt to disprove the guide's "no independently verified production case study" claim on Devin, Factory.ai and Blitzy. The claim survived but was sharpened rather than left as-is, because the search surfaced a large volume of named-customer cases the previous wording ignored (Mercedes-Benz 200K lines COBOL 8 months to 8 days, Itaú 70% of vulns, Blitzy Fortune 100 33M lines in 3.5 days, QAD, Builders FirstSource 3x, Factory 550K hours saved). Every one traces to the vendor's own blog or sales page, not to the customer or a neutral party (Mercedes-Benz let Cognition publish the figure and published none of its own). Section 2 of agentic-software-factories.md was rewritten to draw the exact distinction (a named logo is an endorsement, not an auditable measurement) rather than imply the platforms have no customers, which a reader who knows those names would rightly reject. The only third-party signals found run against the platforms (three teams documented dropping Devin inside a quarter, field defect rates ~1.5-2x human code), and no independent comparative cost study between a closed factory and the native stack exists, the exact number that would settle the "almost never" judgment.

(guide/workflows/agentic-software-factories.md, guide/README.md, machine-readable/reference.yaml, guide/workflows/spec-first.md, guide/ecosystem/agentic-tools.md): the topic was spread across 7 files that cross-referenced each other without ever converging, so a reader asking "how do I build a software factory with Claude Code" had to read agentic-tools.md, third-party-tools.md, spec-first.md, methodologies.md, ai-ecosystem.md, agent-teams.md and ultimate-guide.md in no particular order. The new page is an orientation hub, not a rewrite: all detail stays where it is. It carries a six-level spectrum (single session, /batch, native Agent Teams, dynamic-workflows, plan-pipeline, third-party orchestrators, closed factory) with the cost and the upgrade signal for each level, a reading map organized by intent rather than by file, and the **decision tree that did not exist**: when does a closed software factory (Factory.ai, Blitzy, Maleus, Devin) actually beat native Agent Teams plus /batch plus dynamic-workflows, which already cover most of the same need at no extra cost. Trees already existed for multi-instance vs single-instance (ultimate-guide.md:20320) and for agent teams vs other patterns (agent-teams.md section 7), but not for this choice, which is the expensive one. The verdict is stated rather than hedged (for a small team, almost never) and explicitly labelled as this guide's editorial judgment rather than a measured threshold, since no comparative cost study exists to settle it; the reasoning behind it is checkable, namely six sourced production use cases for Agent Teams against zero independently verified deployments with metrics for any closed platform. A self-host branch pointing at OpenHands was added so the choice does not read as binary. The governance checklist extends the four questions at spec-first.md:970-975 with a fifth drawn from this session's Fusion analysis: is the verification feature the README advertises actually wired into the code path that runs in production, or only imported import type and never instantiated. Closes with a case-study callout on unbounded agentic velocity using the measured Fusion figures (727,279 lines in under 4 months, a 19,328-line executor.ts, 94% of commits from one identity, dual storage backend in parallel, a 986-line adversarial verification module built, tested and never wired), making the point that agentic velocity without architecture produces debt at a speed the industry has not had to handle before.

(docs/resource-evaluations/fusion-multi-agent-orchestrator.md, docs/resource-evaluations/README.md): source-level evaluation of Runfusion/Fusion at commit 8fe122d77 (MIT, pnpm TypeScript monorepo, 12 packages, 18 bundled plugins, @runfusion/fusion on npm), a multi-agent orchestrator marketed as "a software factory". Every claim was checked against code rather than documentation, which changed the verdict twice. **The one idea worth taking**: packages/engine/src/mission-verification.ts (986 lines) implements double-checkout adversarial verification, where the read-only AI judge is explicitly advisory rather than authoritative (lines 4-6), a real disposable checkout is materialized via fs.mkdtemp + git worktree add --detach (lines 338-341), and an agent-supplied regression test must **FAIL** on a second disposable checkout at the merge-base before it can pass (line 26, verdict at line 555), which mechanically kills expect(true).toBe(true) as a way to turn a task green; three typed verdicts (pass | fail | inconclusive, line 63) keep a flaky CI from being read as broken code (line 581). **That module is dead code in production**: mission-execution-loop.ts imports it import type only (lines 28, 112), the real implementation is imported by three test files and nothing else, verificationCapability is never wired at the single production instantiation point (runtimes/in-process-runtime.ts:543-570), and the code leaves behavioral assertions failed when it is absent (line 813); 5 commits, untouched since 2026-06-19. Wired-vs-advertised audit of 9 headline features: missions/autopilot (in-process-runtime.ts:537), shared branch groups, multi-node (project-manager.ts:224), spawn_agent and delegate_task are real; evals are gated behind evalsView, absent from DEFAULT_ON_EXPERIMENTAL_FEATURES (core/src/experimental-features.ts:25) and therefore off by default; "Signals" and "Connectors" from the README have no referent in code. **Health, the disqualifying number**: first commit 2026-03-25 (under 4 months old), 11,333 commits on main, 32 contributors displayed but gsxdsm plus bot identities account for **10,665 commits, 94%**, second human at 3.3%, and over the last 30 days gsxdsm at 2,203 against 55 for the runner-up. Bus factor 1. Velocity peaked in May (4,328 commits) and is declining (2,617 in June, ~1,900 on July's run rate). **Scale**: 727,279 lines excluding tests and node_modules, executor.ts alone at 19,328 lines, plus a dual storage backend maintained in parallel (sqlite-adapter.ts + db.ts alongside postgres/, every store duplicated: agent-store.ts at 122.7 KB beside async-agent-store.ts, async-mission-store-queries.ts at 85.8 KB), which explains the flood of pg-* changesets while ROADMAP.md still lists that migration as "planned". **Security is weak by default on all three layers**: agent execution defaults to sandbox.backend = native with bubblewrap opt-in and Linux-only, the heartbeat path grants write/edit/bash by system prompt (agent-heartbeat.ts:595) while the real fail-closed readonly allowlist (workflow-step-tool-policy.ts:4-25) only covers workflow-step gate nodes, and plugins run in-process with AI scan and signature verification both optional and off. Decision: **integrate as a case study, do not recommend as a tool**. Three angles carried forward: the double-checkout pattern deserves its own guide section as the concrete answer to the "decorative CI" trap already at guide/workflows/spec-first.md:979-988 and to Refute-or-Promote (arXiv:2604.19049); Fusion as a market entry in agentic-tools.md with an explicit bus-factor caveat; and the involuntary lesson, that a single developer with agents shipping 727K lines in under 4 months also ships documentation describing a product that does not quite exist, tested-but-unwired code, and two storage backends in parallel, which is a case study in **agentic velocity bounded by no architecture** that nobody else is documenting. Two method notes logged: the local RTK token-compression proxy silently truncates git output to 50 lines and produced a false first-commit date on the first pass (re-run through rtk proxy), and import type erases at compile time so it proves no runtime wiring, a distinction that separated Fusion's advertised verification layer from its actual behavior and is likely a generalized trap across this market. Also produced claudedocs/perplexity-prompt-agentic-software-factories.md, a three-stage Perplexity research prompt (market sweep excluding the 35+ tools already covered, adversarial-verification deep dive, negative-experience sweep) calibrated on these findings, with bus factor as the primary elimination criterion.

(guide/ecosystem/agentic-tools.md, machine-readable/reference.yaml): reading Liza's own competitive survey (mas-survey.md) surfaced three projects the guide had never covered, while confirming that BMAD, gstack, GSD, CrewAI, Ruflo, OpenSpec, Spec Kit, Kiro, LangGraph and AutoGen were already handled. **§3.5 MetaGPT** (69,384 stars, MIT, Python): the original Code = SOP(Team) framework with five fixed roles, framed as a reference architecture rather than a dependency because the last tagged release is v0.8.1 from April 2024 and the last commit is January 2026, with team attention moved to the hosted MGX product. **§4.4 Symphony** (25,969 stars, Apache-2.0, Elixir): OpenAI's scheduler that watches a Linear board, creates one workspace per issue, spawns a Codex agent, and collects proof of work (CI status, PR review, complexity analysis, walkthrough video) before landing; notable for shipping SPEC.md as the product and telling readers to have their own agent build the implementation, and carrying an explicit "low-key engineering preview" warning with no tagged release and no commit since June 9, 2026. **§4.5 Paperclip** (73,770 stars, 13,731 forks, MIT, TypeScript): org charts, budgets, approval gates and per-agent cost tracking over any runtime ("if it can receive a heartbeat, it's hired"), created March 2, 2026 and shipping weekly (v2026.707.0), positioned by its own README as "if OpenClaw is an employee, Paperclip is the company", which places it above rather than against Claude Code. Each entry documents where it stops: MetaGPT assumes SOP compliance and retries rather than preventing, Symphony has the agent self-certify with no review loop, and Paperclip governs who may act and how much they may spend but explicitly not how work is done inside a session. Also updated the spectrum diagram with an "agent orchestrator" tier, added three rows plus a staleness caveat to the comparison matrix, added four rows to the situation-to-tool guide, refreshed the stale CrewAI count (52K to 55K), and added metagpt_tool / symphony_tool / paperclip_tool anchors to reference.yaml. All figures re-derived from the GitHub API on 2026-07-15, none taken from the survey.

(docs/resource-evaluations/liza-mas-framework.md): the 3/5 score and the "mention as reference architecture in spec-first.md" decision are unchanged, since both rested on architecture (Go supervisors, circuit breaker, behavioral contract) verified against the repo rather than on the author's comparisons. Added a section documenting two problems with the survey. Its seven-category taxonomy produces a bucket of one ("Behavioral enforcement systems (Liza). One entry.", "Enterprise trust remains unsolved by everyone except Liza"), which is positioning rather than a finding. More measurably, it understates every competitor's traction in the same direction: gstack ~100.7k vs 122,026 actual, Paperclip "14k, just launched" vs 73,770, GSD 37k vs 64,742, CrewAI 45k vs 55,565, BMAD ~45.2k vs 50,631, MetaGPT 64k vs 69,384 (all gh api, 2026-07-15). Staleness explains part of it, but not the uniform direction, and the survey itself mixes figures dated a month apart in one matrix (gstack at 2026-05-22, BMAD at 2026-04-20). The practical effect is that its "Liza = Early vs GSD = 37k" row understates a gap that is really 322 against 64,742. Credit recorded where due: the per-competitor analysis is technically argued, and its critique of GSD (LLM-on-LLM orchestration has no hard trust boundary between orchestrator and subagent, versus Go-on-LLM) is reusable independently of Liza. Verdict: treat the survey as a lead list of projects to investigate, never as a source of figures. Two survey claims were checked and confirmed (MetaGPT's release really has been frozen since v0.8.1/April 2024; Symphony really is Apache-2.0, resolving the survey's own "some sources say MIT" hedge) and one marked unverifiable (the ~200-line goal doc that allegedly produced a full three-tier app, whose artifacts the survey admits live in a non-public repo). Confidence downgraded in wording from "Medium (architecture unique and verified)" to note the skewed self-reported comparisons. Separately, the file body was translated from French to English to match the repo's language rule and the 127-of-164 English majority in docs/resource-evaluations/; it was still untracked, so no committed content changed language.

(docs/resource-evaluations/ia-qa-cli-llm-testing.md, docs/resource-evaluations/README.md): evaluation of @ia-qa/cli v1.0.4 (Jean-Christophe Jamet, announced on LinkedIn 2026-07-15), a zero-dependency shell client exposing 148 QA/LLM tools from ia-qa.com, pitched at agents with shell access (Claude Code, Copilot CLI). Scored 3/5 on the announcement, downgraded to **2/5 after hands-on testing**. The 148-tool count is honest (verified against GET /mcp?full=1), but the package is 17.8 KB across 3 files and its own header comment states it "carries NO business logic" and runs everything on the hosted server, so every input (prompts, source, PII) is POSTed to a third party with no signup, no data processing agreement, and no retention policy. Measured three primitives against ground truth rather than trusting claims: count_tokens is literally chars/4 and underestimates by **-35% on JavaScript and -23% on accented French** versus real cl100k_base (verified with tiktoken), erring in the unsafe direction and propagating into estimate_llm_cost, context_window_check, and token_budget_calculator, with a second error layer for Claude users since cl100k is the GPT tokenizer. prompt_injection_scan is regex matching: it caught 3/3 textbook payloads (system override, context exfiltration, DAN) but flagged a security *article about* injections as critical (false positive) and passed base64 and leetspeak payloads as clean (false negatives), unchanged across all three sensitivity levels, despite its description advertising "encoding tricks" detection. hallucination_check self-declares as word-overlap and non-semantic. Credit recorded where due: the 336-line client is well engineered (writeSecureTmp uses wx + mode 0o600 against symlink pre-creation, SECRET_PARAMS is exact-match with a comment on why substring matching breaks, stderr warning before sending secrets to a non-default server, --<param>-file to survive Windows npx argv truncation, no install scripts, zero deps), and the server-side tool descriptions are honest about their limits, so the overselling lives in the LinkedIn post rather than in the product. Not integrated: nothing fills a guide gap (security-hardening.md covers prompt injection, third-party-tools.md covers mcp2cli as the generic MCP-to-CLI solution, ai-ecosystem.md covers promptfoo, ai-unit-economics.md covers token cost) and recommending it would mean routing reader source through a third-party host. Two teaching points logged for later, unattached to the tool: a CLI advertising "zero dependencies, no signup" can still be a network client (17 KB cannot hold 148 tools, checkable via npm view), and chars/4 token estimation fails on code by roughly a third. Re-evaluate if local execution ships, the server source is published, or a real tokenizer replaces the heuristic. Also corrected the index footer, which claimed "121 évaluations" against 162 files actually on disk.

(guide/security/data-privacy.md §Risk 7, guide/ops/ai-unit-economics.md §"Do not estimate tokens by string length"): the tool was rejected at 2/5, but two findings generalized beyond it and were integrated as patterns, deliberately without naming the product (a day-0 free project by a solo dev does not belong by name in a "Known Risks" section; the named analysis stays in the evaluation file, where it is balanced with credit). **Risk 7, the local-looking network client**: a package can advertise "zero dependencies, no signup" truthfully and still POST every input to a server you do not control, because a thin HTTP client genuinely has no dependencies. Documents the arithmetic tell (npm view <pkg> --json unpacked size against advertised functionality: 17 KB across 3 files cannot hold 148 analysis tools, it holds a fetch call) and a one-liner to read the source from the tarball before running it. The section's core argument is that **MCP mode is categorically worse than CLI mode**: in CLI mode a human picks each input, which is a discipline problem a careful team can hold; in MCP mode the agent picks, and the agent has the codebase in context, so it will hand a proprietary file to a hosted count_tokens without anyone approving that specific call. Client-side hardening (temp files in 0600, secret-param warnings) defends against argv leaks and local attacks, not against an agent deciding what to send. This framing came from a second independent evaluation session run against an unrelated production codebase and is sharper than the data-transfer framing the evaluation opened with. **Token estimation**: chars/4 measured against real cl100k_base at +10% on English prose but **-35% on JavaScript and -23% on accented French**, erring in the unsafe direction (reports that a payload fits when it does not, so a budget guard silently passes what it exists to stop), with cl100k being OpenAI's tokenizer so a Claude-targeted estimate stacks a second error. Includes the subtler second-order variant: counting the raw user message while sending a prompt assembled from that message plus system header, role prefixes, and instruction block, which under-counts by everything the wrapper adds and stays invisible in tests that skip formatting. Both points were confirmed present in shipping production code during the second session (a chars/4 helper guarding a hard provider limit on French user input, plus the count-the-wrong-string bug), which is what moved them from observation to guide content; that codebase is private, is not cited, and the guide sections use reconstructed examples. Both sections indexed in machine-readable/reference.yaml (data_privacy_local_looking_client, ai_unit_economics_token_estimation), YAML validated and anchors verified against the actual headings; the landing search index was rebuilt with pnpm build:search so Cmd+K resolves the two new entries.

(quiz/questions/16-agent-harness-context.yaml, quiz/questions/17-team-metrics.yaml, README.md, quiz/README.md): the bundled standalone CLI quiz tool and the live web quiz at cc.bruniaux.com/quiz had diverged on category 16, the CLI tracked "Team Metrics for AI-Augmented Engineering" (12 questions) while the web quiz already covered "Agent Harness & Context" (40 questions) under the same category number. Per user decision, the CLI now adopts the web's topic for category 16 (40 questions converted from the web's markdown source, doc_reference preserved per question), and Team Metrics moves intact to a new category 17. Local CLI quiz total goes from 334 to 374 questions across 17 categories. README.md and quiz/README.md badges/counts updated from the stale 271/159 and "10 Topic Categories" to the real 374/17. Separately, 55 new questions were added directly to the live web quiz (cc.bruniaux.com/quiz, claude-code-ultimate-guide-landing repo) covering recent Claude Code releases (v2.1.186-v2.1.204) and recently added guide sections, bringing that quiz to 401 questions across 16 categories; this was pushed by a parallel session during the same work window.

(whitepapers/guide-export.qmd, guide-export-fr.qmd, README.md, landing HeroBanner.astro): the ~700-page PDF/EPUB export answering issue #60 had drifted (GitHub Release stuck at guide-export-v3.38.3 since April 4 while VERSION was 3.41.1, because the automation cron was dead and the qmd cover version was hard-coded). Bumped both qmd covers to 3.41.1, rebuilt the EN PDF (17.2 MB) + EPUB (715 KB) locally with the Bold Guy Typst template, and published Release guide-export-v3.41.1 marked latest so the existing landing badge and README links auto-resolve to the current build. Replaced the two low-contrast "full guide" hero badges (grey #555, easy to miss) with a dedicated download block on the landing (accent-bordered, 📖 Full guide (offline), EN and FR grouped) and expanded the README Downloads section from two EN badges to four EN/FR badges with flag labels. The FR side is now live: guide/ultimate-guide.fr.md was re-translated against the current EN guide (25,798 lines, up from 24,039), rendered to a 592-page PDF (16.4 MB) and EPUB (742 KB) with the Bold Guy Typst template, and uploaded to Release guide-export-v3.41.1, which now carries all four assets (EN pdf/epub + FR pdf/epub). The releases/latest/download/guide-export-fr.{pdf,epub} links resolve (verified 200), so the README and landing FR buttons work.

(guide/workflows/tdd-with-claude.md): the PostToolUse example used the obsolete flat {matcher, command} shape, which current Claude Code silently ignores; replaced with the nested hooks: [{ type: command, command }] form. Surfaced while fact-checking a batch of portfolio TDD and security articles against this guide, where the articles already used the correct nested format.

(claude-code-ultimate-guide-landing/src/content/questions/): a 84-agent fact-check pass over all 346 live quiz questions (cc.bruniaux.com/quiz) against the current guide, official Anthropic docs, and live web search, triggered by a request to cross-reference the quiz with the guide's post-reorg file layout. 70 stale doc_reference.file paths were corrected (the guide moved several files into core/, security/, roles/, ecosystem/, and ops/ subdirectories since these questions were written, e.g. guide/core/architecture.md to guide/core/architecture.md). 11 questions were flagged with a wrong "correct" answer, independently re-verified by 2 skeptic agents each, and 10 of the 11 were confirmed and corrected (option text and explanation rewritten), covering things like the nonexistent /execute command, ~/.claude/mcp.json (Claude Code reads ~/.claude.json, not that path), ${workspaceFolder} (a VS Code convention, not supported here), and a systemMessage/hookSpecificOutput.additionalContext mix-up. Two YAML frontmatter bugs surfaced by the pnpm build Zod-schema gate were fixed (unquoted colons inside option values breaking YAML parsing). 64 new question drafts and category-coverage proposals were written to claudedocs/quiz-audit-2026-07-08/ in the guide repo for manual review; none of those were auto-applied per the task's scope. Build passes across all 346 questions; nothing was committed or pushed in the landing repo.

(guide/workflows/spec-first.md, guide/ecosystem/agentic-tools.md, guide/ecosystem/third-party-tools.md, docs/resource-evaluations/): triggered by a competitive-landscape research pass on Maleus (formerly misheard as "Solario" in a meetup transcript), Adrien Maret's Paris-based full-cycle spec-to-deploy platform. Added OpenHands (agentic-tools.md §2.4, 79,900+ stars verified via gh api) as the open source equivalent to Devin, with its dependency-graph parallel execution (Tier 0/Tier 1 sub-agent spawning) and integrator-merge pattern. Added BMAD-METHOD (50,200+ stars) and spec-kitty (1,400+ stars) to spec-first.md's tool-integration section: BMAD-METHOD's 19+ role-specific planning agents versus spec-kitty's git-worktree isolation with kanban-tracked merge gates and audit trail. Added a new "Full-cycle AI software factories" subsection covering Maleus, Factory.ai, Blitzy ($200M/$1.4B valuation, Northzone-led, May 2026, verified against SiliconANGLE/BusinessWire), and Devin as a distinct commercial category, framed around four governance questions (deterministic gate vs LLM self-grading, stop-the-line escalation, audit-trail traceability, spec staying authoritative after first generation) rather than a feature checklist. Added Agent Orchestrator (third-party-tools.md, right after Conductor, 8,100+ stars in 5 months, Apache-2.0) as the open source, cross-platform equivalent to Conductor, 23 supported agent CLIs vs Conductor's 2, plus a PostHog telemetry-by-default note and a correction of a secondary-source claim: the "CI retry twice then escalate" mechanism attributed to the project in cross-referenced research does not appear in its README, architecture doc, or status doc as of July 2026, and was not carried into the guide. Four new resource-evaluation files score BMAD-METHOD (4/5), OpenHands (4/5), spec-kitty (3/5), and Agent Orchestrator (3/5) against the existing 1-5 grid, all star counts and license fields verified live via gh api rather than secondary sources.

(guide/workflows/spec-first.md, docs/resource-evaluations/liza-mas-framework.md, machine-readable/reference.yaml): the "Full-cycle AI software factories" section listed four closed/managed commercial products (Maleus, Factory.ai, Blitzy, Devin) but no open source counterpart that answers the four governance questions in the open. Added Liza (Apache-2.0, 320 stars, single-author, verified via gh api 2026-07-12) as that counterpart: Go supervisors that enforce state transitions, role boundaries, merge authority and TDD gates mechanically rather than by prompt, adversarial doer/reviewer pairs per task, an auditable YAML blackboard, and an explicit circuit breaker, the one OSS example that documents the stop-the-line mechanism (governance question 2) I had flagged as rarely documented. Framed strictly as a reference architecture, not a dependency to adopt, given tiny adoption and no third-party production evidence. New evaluation file scores it 3/5 and keeps it distinct from the earlier liza-mas-token-saving-cli-tools.md (2026-06-10) that rejected the org's satellite CLIs (scip-search, mdtoc, functional-clusters, stacklit-cli), a different object. Fact-checked and corrected two undercounts in Liza's own README against live API: it cites BMAD "~45.2k stars" (actual 50,374) and CrewAI "45k" (actual 55,377), and its "L4 alongside BMAD/BEADS" positioning is a single IBM-exec quote, not an independent benchmark, both flagged in the evaluation.

(guide/workflows/spec-first.md, guide/ops/ai-unit-economics.md, docs/resource-evaluations/liza-mas-framework.md): a Perplexity deep-research pass surfaced peer-review-adjacent evidence that was missing from the governance section. Added *Refute-or-Promote* (arXiv:2604.19049, Abhinav Agarwal, verified live against arxiv.org) to governance question 1 in spec-first.md: a 31-day adversarial defect-discovery campaign, agents assigned to refute not confirm, mandatory empirical (PoC) gate, ~79% of 171 candidates killed, 4 real CVEs, and the decisive anecdote that ten LLM reviewers unanimously endorsed a Bleichenbacher padding oracle that did not exist, caught only by the empirical gate. This converts the "deterministic gate beats LLM self/peer grading" claim from assertion to sourced evidence. Added multi-agent token-cost orders of magnitude to ai-unit-economics.md (3-10x single-agent per naive-multi-agent task, 30-80% clawback via contracts/compression/KV-cache sharing), flagged as vendor-internal and analytical, not peer-reviewed. Corrected a factual error I introduced earlier in the Liza evaluation: Soufiane Keli is VP Software Engineering at Octo Technology (Accenture), not IBM; Perplexity independently confirmed no formal L1-L5 maturity model is published by him or anywhere, reinforcing the "do not cite as external validation" flag. Note: the earlier Liza changelog entry above still says "IBM-exec quote", left as-is as the historical record; the evaluation file carries the correction.

(machine-readable/reference.yaml, guide/core/methodologies.md, guide/workflows/spec-first.md): the additions above had not been indexed. Added 15 new keys (bmad_method_*, spec_kitty_*, openhands_*, ai_software_factories_*) with anchor-verified links. Found and fixed a real duplication risk the user flagged: methodologies.md already documents BMAD-METHOD as a Tier 1 methodology (constitution.md, when to use/avoid) but had no link to the newly added installation instructions in spec-first.md, and its only source link pointed to a Claude-Code-specific fork (24601/BMAD-AT-CLAUDE) rather than the canonical bmad-code-org/BMAD-METHOD repo. Added bidirectional cross-links between the two sections and the canonical repo URL with verified star count. Also caught and fixed two stale line-number references in reference.yaml (resource_evaluations_appendix pointed to ultimate-guide.md:20886, an unrelated llms.txt discussion; the real Appendix C is at line 26294. resource_evaluations_readme_section pointed to README.md:307, mid-quiz-section; the actual "151 Resource Evaluations" heading is at line 354) and flagged a larger pre-existing gap without fixing it: docs/resource-evaluations/README.md's index table lists 43 rows against 160 actual evaluation files on disk, a discrepancy that predates this session and needs a dedicated audit pass.

(guide/ecosystem/context-engineering-tools.md, guide/ecosystem/mcp-vs-cli.md, guide/ops/ai-unit-economics.md): the existing Edgee entry described the pre-V2 generic "composable edge layer" positioning. Replaced it with the actual three-layer Compressor V2 architecture (brevity, Tool Surface Reduction, tool result trimming) from Edgee's July 2, 2026 blog post, its explicit RTK lineage for the trimming layer, and a sourced critique of the post's methodology: SWE-bench Lite's resolution rate is never measured, the "50%" headline traces closest to brevity's raw aggregate rather than a combined end-to-end measurement, and the n=6/n=8 sign-test sample sizes are flagged against their significance ceiling (a perfect 6-of-6 score is the only outcome that clears p<0.05 at n=6). Added three previously uncovered academic prompt-compression techniques to context-engineering-tools.md §4 (Selective Context, AutoCompressors/Gisting, RECOMP), each flagged research-only vs. production-adopted per source verification. Added LiteLLM and GPTCache to §5 (AI Gateways), and a KV-cache-compression research-frontier note (eviction/quantization/low-rank families, ChunkKV, TurboQuant) to §8. Added Klavis AI/Strata and Arcade.dev to the MCP tool-surface-reduction table in mcp-vs-cli.md, both with vendor-reported figures flagged as unverified. Added a new §6 to ai-unit-economics.md, "How to read a vendor's cost-reduction claim" (paired vs. unpaired comparisons, sign test vs. paired t-test, the significance ceiling at small n, reading bootstrap confidence intervals, median vs. aggregate, and a checklist), generalizing the Edgee critique into a reusable framework for evaluating any vendor's benchmark claims.

(guide/ecosystem/context-engineering-tools.md, guide/ecosystem/mcp-vs-cli.md): a follow-up WebSearch/WebFetch pass on the Edgee critique above (triggered by cross-checking a Perplexity research summary against primary sources) surfaced a second, separate set of numbers on Edgee's own docs page (edgee.ai/docs/introduction/why-edgee, distinct from the blog post): production averages across real customer traffic put brevity at ~6.5% and tool result trimming at ~19%, against the blog's 6-task benchmark figures of ~30% and ~10% respectively, with tool surface reduction at ~25% but still labeled "in development." The same docs page answers the resolution-rate gap with "zero measurable drift on SWE-Bench Verified samples," a claim with no sample size, no definition of "measurable," and no confidence interval, added to the guide as a documented example of an unquantified rebuttal to a statistically grounded critique. Separately, direct WebFetch verification of edgee-ai/compression-lab's README confirmed it contains zero mentions of SWE-Bench Verified, drift, or resolution rate, ruling out that the production claim lives in the benchmark repo itself. Also corrected the Klavis AI/Strata row in mcp-vs-cli.md from a vague "+13% accuracy" figure to the actual named benchmark (MCPMark: +15.2% pass@1 vs. the official GitHub MCP server, +13.4% vs. Notion, 85-100x token reduction), and added Arcade.dev's vendor comparison against Composio (7,426 vs. 747,083 tokens across 8 CRM queries) which had previously been described only qualitatively. LLMLingua-2's exact figures (2x-5x compression, 1.6x-2.9x end-to-end latency speedup, ACL 2024 Findings) and ChunkKV's confirmed 26.5% throughput gain (arXiv 2502.00299) were independently verified against primary sources during the same pass.

(guide/core/context-engineering.md, guide/ecosystem/context-engineering-tools.md, guide/ecosystem/mcp-servers-ecosystem.md, guide/ecosystem/third-party-tools.md): synced against two dated research passes (context-engineering-concepts-2026-07.md, context-engineering-tools-panorama-2026-07.md). Added the disputed authorship of the term "context engineering" (Karpathy vs. Dex Horthy/12-Factor Agents' "dumb zone"), a refinement note on context rot (NIAH underestimates degradation on semantically ambiguous queries, per the MonitorBench 98.6%→88% data point), a cross-reference from the dynamic-context section to the already-documented Managed Agents brain/hands/session-log architecture (ai-ecosystem.md §14) plus the April 2026 Anthropic posts on it, and a new research subsection covering ACON, Less Context Better Agents, AMA-Bench, Agent Memory characterization, ContextBudget, Classifier Context Rot, Context Kubernetes, and Recursive Language Models, each tagged with its actual confidence level (single-paper claim, prototype-only, independently reproduced, etc). Added a new Optical/Visual Context Compression pattern (DeepSeek-OCR lineage) cross-linked to a new **pxpipe** tool profile. Added **Cloudflare Code Mode MCP** (99.9% tool-schema-loading reduction via a two-meta-tool code-execution pattern), **TOON** (Token-Oriented Object Notation, format-dependent gains), and a new "ghost tokens" / context-quality-after-compaction concept (alexgreensh/token-optimizer). Refreshed GitHub star counts via the tools' own verification method (gh api, 2026-07-07): RTK 446→69,042, Headroom 43,000→57,223 (plus its org move from chopratejas/headroom to headroomlabs-ai/headroom), context-mode 14,149→18,654 (12→17 supported platforms), cc-statistics 87→109. Added a new MCP protocol roadmap subsection (stateless core, Extensions, Tasks, deprecation policy, per the 2026-07-28 release candidate) and the NSA's June 2026 MCP security guidance to mcp-servers-ecosystem.md. Every rapid-growth or self-reported figure (RTK's 2.8x star jump, Headroom's "$700K saved" claim) is flagged with its verification caveat rather than stated as fact, matching the source research's own hedging.

(docs/for-product-managers.md, for-tech-leads.md, for-cto.md, for-cio-ceo.md): the four role pages were only readable on GitHub. The landing build script (prepare-guide-content.mjs) now pulls them from docs/ and serves them at /guide/for-product-managers/, /guide/for-tech-leads/, /guide/for-cto/, and /guide/for-cio-ceo/, with a "For Your Role" section on the /guide/ index, sitemap and RSS entries, and Cmd+K search coverage. Deep links like ultimate-guide.md#35-team-configuration-at-scale now resolve to the correct chapter page instead of landing on the chapter index (new resolveUltimateGuideAnchors pass, applied to all served pages).

(guide/ultimate-guide.md §9.13): added a structured overview of the 6 cost levers (monitoring, output compression, model routing, prompt caching, batch processing, semantic pre-indexing) with Native vs. API/SDK columns and cross-links to existing documented sections. Includes RouteLLM citation (lm-sys, ICLR 2025, arXiv 2406.18665: 85% cost reduction on MT-Bench vs always-strong routing).

added semble_* entries (upstream, guide, evaluation, purpose, vs_grepai note), cost_levers_table pointer (§9.13 new subsection), batch_api_cost_lever, routellm_citation (arXiv:2406.18665). Updated updated date to 2026-06-10, resource_evaluations_count to 86.

(machine-readable/claude-code-releases.yaml, guide/core/claude-code-releases.md, mcp-server/content/claude-code-releases.yaml, mcp-server/package.json, landing src/data/releases.ts): added the five releases published between 2026-08-14 and 2026-08-19. v2.1.233 removes the todo and task tools (TaskCreate/Get/Update/List, TodoWrite) on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models behind CLAUDE_CODE_ENABLE_TODO_TOOLS=1, reverts the v2.1.232 Bash permission changes for Cygwin-style symlinks and input redirections, and closes the NT \??\ device-prefix bypass of UNC path validation. v2.1.234 extends that rejection to remote file reads, session restore, CLAUDE.md includes, workflow scripts, and uploads, adds a GitLab merge request badge to the footer and statusline, makes sessions resume themselves when a claude.ai usage limit resets, drops the "Default teammate model" setting, and cuts the built-in claude-api skill from roughly 200K tokens to 25K. v2.1.235 adds an optional spellcheck setting and makes permission dialogs state what a grant actually covers. v2.1.236 adds ANTHROPIC_DEFAULT_MODEL and notify_when_idle on cross-session SendMessage, and gives macOS wildcard read-deny rules precedence inside allowed read regions. v2.1.237 adds the built-in "Concise" output style. Recorded v2.1.234 as a milestone, added four behavior entries and one security entry to breaking_summary, bumped the MCP server package to 1.2.10 and rebuilt it, and regenerated the landing guide search and content indexes. No RSS entry: the landing feed reads releases.ts directly, so a manual entry would duplicate.

(guide/core/hooks-events-reference.md): new comprehensive reference for all 30 Claude Code hook events. Covers matcher field per event type (different events match on different fields), exit code 2 behavior for all 30 events, decision control format per event (top-level decision vs hookSpecificOutput vs path return), key input fields per event, handler configuration fields for all 5 types (command, http, mcp_tool, prompt, agent), asyncRewake field, CLAUDE_ENV_FILE availability, terminalSequence, path placeholders, and common gotchas (Stop hook 8-block cap, UserPromptSubmit 30s default, WorktreeCreate replaces git entirely, and more).

(examples/skills/eval-agents/SKILL.md): new audit skill for Claude Code agent fleets. Scores agents on 5 criteria (name, description specificity, model tier, tools scoping, system prompt quality) out of 15 pts with a +1 hardening bonus. Detects description overlap between agents that causes non-deterministic orchestrator dispatch, flags missing tools: fields (unconstrained session tool inheritance), identifies human-in-the-loop anti-patterns that break headless pipelines, and checks model-task alignment using the haiku/sonnet/opus matrix. Follows the same interactive review pattern as eval-hooks and eval-rules.

(guide/core/context-engineering.md, 2026-05-27): New "Real-World Session Benchmarks" subsection in Section 15 with practitioner-sourced data. Per-turn ranges by task type (10-30K simple question, 100-300K feature, 300K-1M+ heavy investigation) and per-session ranges (100-300K quick fix, 500K-2M complete PR, 5M-20M+ long session with compaction). Sourced from community discussion (May 2026, Max 200 / Opus 4.7 at high effort).

(whitepapers/fr/12-agent-engineering.qmd and whitepapers/en/12-agent-engineering.qmd, 2026-05-27): New section "L'Écosystème des Agents en 2026" / "The Agent Ecosystem in 2026" added to both FR and EN versions. Covers terminal coding agents (Codex CLI, Hermes Agent, Aider), autonomous agents (Devin, SWE-agent, claude -p), multi-agent frameworks (CrewAI, LangGraph, AutoGen/MAF), and a decision matrix with situation-to-tool mapping. Fiche récap updated with a sixth bullet. Cross-ref to guide/ecosystem/agentic-tools.md.

(guide/ecosystem/agentic-tools.md, 2026-05-27): Comprehensive coverage of the agent tool field, organized in five sections. Section 1 covers terminal coding agents (Codex CLI at 86K stars, Hermes Agent formerly OpenClaw at 170K stars, Aider at 45K stars, Goose cross-ref). Section 2 covers autonomous coding agents (Devin with cloud sandbox and ACU billing, SWE-agent Princeton NeurIPS 2024, Claude Code headless cross-ref). Section 3 covers multi-agent frameworks (CrewAI 52K stars, LangGraph 33K stars, AutoGen/Microsoft Agent Framework). Section 4 covers orchestration tooling (Conductor Gemini methodology, Conductor Microsoft YAML CLI, Hermes Control Room community template). Section 5 is a decision framework with a full comparison matrix (10 tools across 7 dimensions) and a situation-to-tool guide. Cross-refs added to ai-ecosystem.md (Section 11, Section 11.3), third-party-tools.md (Multi-Agent Orchestration), and guide/README.md navigation.

New reference page covering the nine-component framework (while-loop engine, context management, tool registry, sub-agent management, built-in skills, session persistence, dynamic prompt assembly, lifecycle hooks, permission enforcement) and the three foundational properties from arXiv 2605.18747 (executability, inspectability, statefulness). Includes the Lethal Trifecta security model (Willison), CI/CD agentic patterns comparison (GitHub Agentic Workflows / AWS Bedrock AgentCore / GitLab Duo), digital twin testing landscape by service (Slack-Mock, Mockoon, WireMock), OTel GenAI observability stack (gen_ai.client stable, gen_ai.agent experimental as of May 2026), test distribution anti-pattern (70% effort on deterministic / <5% on LLM reasoning), and creator-verifier pattern (+12 to +26% correctness improvement). 8 new anchors added to machine-readable/reference.yaml.

New section "The L0-L5 Scale: Where Is Your Team?" documenting the six-level framework by Dan Shapiro (CEO Glowforge, January 2026, factorydark.com) with correct attribution. Includes adoption data (Stack Overflow 2025 n=49,000+: 84% declared adoption but 77% don't use vibe coding, 31% use agents — estimated L3+ penetration under 10%), the J-curve from McElheran/Yang/Kroff/Brynjolfsson 2025 (-1.33 TFP point at short-term, Census Bureau data), METR RCT calibration (n=16, 246 tasks, +19% measured slowdown vs -20% perceived, 39-point perception gap), DeputyDev longitudinal cohort (arXiv 2509.19708: 4% month 1, 83% month 6, 60% steady-state, -31.8% PR cycle time), and level-specific investment guidance.

Added sections 17 (Spec Engineer), 18 (Agent Identity Architect), 19 (AI Eval Engineer) with full responsibilities, required skills, entry paths, and salary estimates. Updated Career Decision Matrix and salary benchmark table. Old sections 17-20 renumbered to 20-23. New roles added to machine-readable/reference.yaml.

New section "SDD vs TDD vs BDD" with comparative table on governing artifacts, Factory.ai Missions architecture (orchestrator + workers + adversarial validators, 81 problems caught pre-merge on documented Slack clone generating 34% of implementation work), multi-file pass@1 failure rates, and spec drift as the primary open problem.

Extended guide/core/context-engineering.md with five new sections covering the operational mechanisms that close the gap between Level 4 and Level 5 in the maturity model. (1) Signal taxonomy and causal attribution: five-category friction taxonomy (syntactic/semantic/procedural/alignment/performance) replacing the flat errors × 3 + retries × 2 score, plus a YAML event schema and per-pattern tracking dict. (2) Loop closure: PR-based Curator mechanism generating config-change PRs with diff, canary A/B results, friction evidence, and suggestion escalation; multi-timescale operation (real-time/weekly/quarterly); signal locality trade-offs (local cron vs pushed store vs hosted env). (3) Ejection: automated detection of dormant rules and negative-ROI skills for archival — three heuristics: activation threshold, ROI tracking, profile overlap. (4) Constitutional and self-consistency audits: pre-PR rule conflict check against an explicit constitution.md, plus a weekly check verifying that ACE documentation claims match the measured state. (5) Multi-dev profile reconciliation: detection of rules present in more than 50% of individual profiles with hoist-to-shared-config proposals; Bash script included. Old sections 10-12 renumbered to 15-17. ACE disambiguation (vs arXiv:2510.04618 inference-time technique) added to Section 6 and glossary. Five new anchors added to machine-readable/reference.yaml. Cross-link added in guide/roles/ai-roles.md. Landing /context-engineering/ updated with ACE Operations category. Landing /context/ result screen updated with two new deep links.

Replaced "Learning" with "Context" in main nav; reordered More dropdown (AI Roles, Methodologies, Ecosystem, Releases, Compare, Diagrams, Team Metrics, Glossary, FAQ, RSS Feed); updated announcement banner to highlight Agent Harness Engineering, ACE-v2, and new AI roles; fixed banner deep link from /guide/core/agent-harness to /guide/agent-harness/ (guide files served flat by prepare-guide-content.mjs).

35 new questions covering Agent Harness Engineering (9-component framework, Lethal Trifecta, CI/CD patterns, creator-verifier +12 to +26%, Safe Outputs toolchain, OTel GenAI status), Context Engineering (L0-L5 maturity scale, ACE-v2 signal taxonomy, loop closure PR curation, ejection thresholds, constitutional audits, self-consistency check, multi-dev profile reconciliation), and the three new AI roles (Spec Engineer, Agent Identity Architect, AI Eval Engineer). Quiz total 271 to 306 questions.

(guide/ultimate-guide.md §Skills): new subsection "claude-red: Offensive Security Skill Library" covering SnailSploit/Claude-Red (58 skills across 13 attack surface categories). Documents three usage patterns — direct session read, --system-file at launch, and project-level .claude/skills/ symlink — with emphasis on the one-shot no-install approach. Introduces the targeted prompt pattern for matching skills to a specific tech stack (Next.js/Prisma/Clerk example), and includes ethical/legal scope note.

(guide/ultimate-guide.md §5.1): new subsection "Skills and Subagents" documenting that subagents don't inherit skills automatically, built-in agents (Explorer, Plan, Verify) can't access skills at all, custom subagents need explicit skills: frontmatter field, and skills load at agent start (not on-demand). Includes frontmatter example. Based on Anthropic certification course module 05.

added missing allowed-tools to guide-recap, issue-triage, landing-page-generator, pr-triage, release-notes-generator, skill-creator, cyber-defense-team, ccboard, rtk-optimizer; removed unsupported fields (tags, category, keywords, context, agent, usage, args) from ccboard, issue-triage, landing-page-generator, pr-triage, release-notes-generator, skill-creator, rtk-optimizer, token-audit, voice-refine, audit-agents-skills, mcp-integration-reference; fixed YAML list format (comma-separated → space-delimited) in git-ai-archaeology and audit-agents-skills; added effort: medium to git-ai-archaeology; moved version to metadata.version in rtk-optimizer, cyber-defense-team, audit-agents-skills, mcp-integration-reference. Note: token-audit/skill.md uses lowercase filename — spec requires exactly SKILL.md.

(examples/skills/eval-skills/SKILL.md): added argument-hint to frontmatter, fixed allowed-tools format (comma-separated → space-delimited), added "Pre-Check" section documenting skills-ref validate CLI, added complete list of valid vs unsupported frontmatter fields, added note about allowed-tools format requirement, added model as a valid Claude Code extension field, fixed per-skill output template from /15 to /14.

(guide/ultimate-guide.md §9.13, §9.3, §2.2, §10.4; machine-readable/reference.yaml): new section covering the June 15, 2026 billing change that separates interactive and programmatic usage into distinct buckets. Documents affected tools (claude -p, Agent SDK, GitHub Actions, third-party harnesses), credit amounts per plan, the ANTHROPIC_API_KEY billing trap, pre-June-15 audit steps, and decision framework for teams running automated workflows. Cross-references added in §2.2 (Cost Awareness), §9.3 (CI/CD), and §10.4 (Troubleshooting). 13 new entries in reference.yaml.

(machine-readable/reference.yaml, guide/ultimate-guide.md:7602): updated from stale "26+" / "30+" counts based on official agentskills.io client showcase verified 2026-05-14 (35 named tools: added OpenHands, Amp, Letta, Junie, Firebender, OpenCode, Mux, Kiro, Snowflake Cortex Code, Ona, Laravel Boost, Emdash, TRAE, fast-agent, nanobot, VT Code, Qodo, Agentman, Mistral Vibe, Workshop, Command Code, pi, Piebald, Google AI Edge Gallery)

(Track C): mass version bump 3.38.1 to 3.40.0 across all 109 recap cards (52 FR + 52 EN c/m/t series, 5 EN old-format). Priority content additions to 5 cards (m09, m11, m12, m13, t12 FR+EN): /goal, /scroll-speed, hook exec form args[], continueOnBlock, PostToolUse updatedToolOutput, worktree.baseRef breaking change, alwaysLoad MCP option. Whitepapers WP09+WP10 (FR+EN) version bump 3.38.1 to 3.40.0.

(§9.17, guide/ultimate-guide.md): added native session manager introduced in v2.1.139 — claude agents, /bg, claude --bg [task], peek + inline reply. Contextualized vs tmux/Conductor/third-party tools. Updated claude agents subcommand description in CLI reference.

(guide/ecosystem/third-party-tools.md): new entry in "Alternative UIs" section — cross-platform (Windows/macOS/Linux/Web), free, multi-provider (Claude/Copilot/Bedrock/Qwen), explicit hooks + AGENTS.md compatibility. Added cross-ref in Multi-Agent Orchestration table. Covers the Windows GUI gap absent from all other listed tools.

added §9.25.1 through §9.25.5 covering OpenAI Codex team patterns: AGENTS.md as ~100-line TOC, knowledge boundary principle ("what the agent can't see doesn't exist"), docs/ knowledge base structure with exec plans and doc-gardening agent, ephemeral per-worktree observability stack, taste invariants with agent-readable linter messages, anti-entropy via background cleanup agents with QUALITY_SCORE.md, layered domain architecture enforced by linters (Types→Config→Repo→Service→Runtime→UI), and high-throughput merge philosophy. Source: Ryan Lopopolo, OpenAI Engineering blog, Feb 11, 2026. Resource evaluation: docs/resource-evaluations/2026-02-11-openai-harness-engineering.md (score 5/5).

— tools/spec-completeness-audit.md, self-contained prompt auditing how well a project is specified for safe agent delegation. Scores /100 across 5 layers (Behavioral 15pts, Interface 20pts, Architectural 30pts, Lifecycle 20pts, Cultural 15pts). Layer 3 weighted highest (most commonly missing, hardest to detect). Output: per-layer risk tier 🟢/🟡/🔴, silent-fill prediction ("what the agent will invent"), delegation verdict (Safe/Supervised/Risky/Unsafe), and 3 quick wins with templates. Based on Hamidreza Saghir's "Your coding agent is under-specified" (May 2026). tools/README.md updated.

— added ### Graphify (Codebase Knowledge Graphs) section in §8.2 (after claude-mem). Covers: three-pass extraction (AST local + faster-whisper + Claude subagents), Leiden clustering, graphify-out/ output structure, install commands, team git workflow, comparison vs GrepAI and vs claude-mem. Decision Matrix updated to 5-layer stack (added Layer 2: Structural Graph → Graphify). Stats: 42K stars, MIT, v0.7.4. Token efficiency claims flagged as self-reported/unverified. Source: github.com/safishamsi/graphify.

— added ### Caveman (Compressed AI Responses) section in §9.13 Cost Optimization (before RTK section). Covers: 4 compression modes (lite/full/ultra/wenyan), install via plugin marketplace or curl installer, companion tools (caveman-compress, caveman-commit, caveman-review, caveman-stats, caveman-shrink), honest token numbers (4-10% whole-session savings vs 75% prose-only claim), when not to use. Stats: 53K stars, MIT, created 2026-04-04. Source: github.com/juliusbrussee/caveman.

five-subsystem model (Instructions, Tools, Environment, State, Feedback), verification gap pattern, WIP=1 principle, 10-step session lifecycle, feature_list.json schema with evidence field, init.sh bootstrap contract, progress.md session handoff. Source: Learn Harness Engineering (HumanLayer, 2026). TOC updated (also adds 9.23 and 9.24 entries that were missing). Templates: examples/templates/feature-list.json, examples/claude-md/agent-progress.md.

(guide/core/architecture.md, new ## Anthropic API Patterns for Architects): Three production-critical API patterns. Message Batches API: 50% cost reduction, 24-hour processing window, 100-request batches, per-request error isolation, retry economics at scale, use-case decision matrix (sync vs streaming vs batch). tool_choice parameter: four modes (auto/any/specific/none), forced structured output pattern via tool invocation, stop_reason guard. Strict mode JSON schema: output-schema-2025-02-19 beta header, constrained decoding guarantees, nullable fields to prevent hallucination, extensible enums with companion *_detail field, detected_pattern for auditable classification pipelines.

(guide/core/architecture.md, agentic loop section): New #### Controlling loop depth with max_turns subsection. Recommended ranges (5 for simple retrieval, 20-30 for research, 50+ for extended workflows), stop_reason == "max_turns" check, and rationale for per-task-type configuration in multi-agent pipelines.

(guide/core/context-engineering.md, new ## 17. Attention Mechanics & Reliability, 238 lines): Lost-in-the-middle mechanics (Liu et al. 2023, arXiv:2307.03172, U-shaped curve, 27% vs 98% NIAH accuracy gap). Primacy/recency placement (sandwich pattern, per-section pass for documents above 50K tokens). Context window size misconception (degradation begins around 50-70K tokens regardless of window size). Persistent facts block (verbatim inclusion, prompt-cache compatible, 500-token ceiling). Scratchpad pattern (synthetic assistant message, programmatic state updates, scratchpad vs rolling summary distinction). Rolling context summaries (65% trigger threshold, facts extraction before summarizing).

(guide/workflows/production-reliability.md, new file, 558 lines): Escalation design (three canonical triggers: explicit request, policy gap, inability to progress), programmatic escalation signals vs LLM confidence scores, frustration vs explicit escalation distinction, rule-based routing from structured output fields. Circuit breaker (CLOSED/OPEN/HALF_OPEN state machine, per-document isolation). Structured error propagation (StructuredAgentError with is_retryable, error_category, alternative_approach). Partial results with coverage annotations (well-supported/partially-supported/gap). Structured human handoff (HandoffPayload with recommended_next_action). Source conflict resolution (temporal difference vs factual conflict, publication_date as mandatory field). Anti-patterns section.

(guide/workflows/agent-teams.md, new ## Advanced Orchestration Patterns, 422 lines): Hub-and-spoke coordinator (coordinator decomposes/dispatches/aggregates, never does domain work). Programmatic prerequisites (state-flag gate, phase-based dispatch with PipelinePhase enum). Dynamic subagent selection (DynamicSelector with economy/performance/balanced routing). Research space partitioning (explicit topic assignment per agent, exclusion lists). Crash recovery manifest (PipelineManifest with checkpoint() and mark_item_complete(), RecoverableOrchestrator). Iterative refinement loop (numeric target_quality and max_iterations hard budget). Narrow task decomposition (SPEC test: Specific, Programmatically Evaluable, Explicit scope, Constrained).

(guide/ecosystem/mcp-servers-ecosystem.md, new ## Advanced MCP Tool Design, 251 lines): isRetryable as application-level convention via structuredContent (not native MCP spec). isError: false + empty vs isError: true semantics table with JSON examples. MCP Resources vs Tools formal comparison (6-dimension table, Python implementation, ResourceLink bridge). Tool naming conflicts with system prompt keywords (naming rules, domain-prefix convention). Task-scoped tool profiles (exploration/analysis/execution phases, role-based access, verify_fact subagent pattern).

(guide/core/memory-systems.md, ~2,500 lines): Consolidates all memory content previously scattered across 15+ locations in 6+ files. Covers three tracks: Native Stack (CLAUDE.md, Auto Memory v2.1.59+, Auto Dream, Agent Memory frontmatter, session vs persistent), Cross-Session Tools (claude-mem, agentmemory, ICM, Kairn, doobidoo, OpenMemory MCP, 7 others with master comparison table), and Team Sharing (Trinity pattern, Mem0 Cloud MCP, Zep/Graphiti, Notion MCP approach, structural gap analysis). Adds net-new content not previously in the guide: agentmemory BM25+vector+graph RRF architecture, five architecture patterns, multi-agent coordination patterns (MCP blackboard, leases+signals, A2A), memory poisoning/prompt injection risk (Section 7.1), SAMEP protocol, decision flowchart (Mermaid), 18-row decision matrix, LongMemEval benchmarks, ACT-R decay model, 6 open problems.

(cc.bruniaux.com/mcp-or-cli/): 6-question quiz giving a personalized recommendation (MCP-First, CLI-First, or Hybrid Workflow). Scoring weights across six dimensions: user type, auth model, model tier, observability requirements, CLI landscape, and team scale. Results include a match percentage, actionable tips, and a link to the relevant guide section. Added to the More dropdown in the landing nav.

(guide/ecosystem/mcp-vs-cli.md): New section clarifying that most production MCP servers wrap existing REST or GraphQL APIs, confirmed by official documentation from Notion ("converted MCP tool calls into HTTP API calls to Notion's public API"), Sentry ("middleware to the upstream Sentry API"), Slack ("a wrapper around an external API, like Slack"), and GitHub ("integrates with GitHub via the GitHub API"). Explains what MCP adds on top of the raw API (OAuth token management, LLM-tuned schemas, centralized hosting, usage attribution) and sharpens the decision criterion: if a service authenticates via API key and you don't need centralized observability, a CLI calling the same API is functionally equivalent.

Comprehensive update covering two-layer architecture (input probe + Sonnet 4.6 transcript classifier), three classifier categories (scope escalation, untrusted infrastructure, prompt injection), Anthropic's production numbers (94% detection, 17% FNR), independent stress-test findings (arXiv 2604.04978: 81% FNR on adversarial workloads, 92.9% FNR gap on file edits exempt from classification), escalation mechanism (3 consecutive or 20 total blocks), red spinner signal, autoMode.allow/soft_deny/environment with "$defaults" sentinel, and when-to-use taxonomy.

(guide/ultimate-guide.md): Added subsection in the OpusPlan Mode area documenting three ways to force Opus 4.6 instead of 4.7 (settings.json direct, OpusPlan hybrid via ANTHROPIC_DEFAULT_OPUS_MODEL, per-session /model). Documents the trade-offs: losing xhigh/max effort levels and the newer knowledge cutoff. Added cross-reference from the pricing section.

(guide/ecosystem/third-party-tools.md): Added new "Skills Observability" section (#15 in TOC) covering Skillsight (PackmindHub/skillsight, v0.2.1, Apache 2.0) by Cédric Teyton (Packmind). Documents both ingestion modes (OTLP direct push from Claude Code and Loki pull from Grafana Cloud), full settings.json snippet for Claude Code configuration, 5-step setup workflow, and three mandatory deployment caveats (default JWT_SECRET/ADMIN_PASSWORD must be overridden — no boot warning; PUBLIC_BASE_URL required for CORS safety and correct onboarding snippet; Drizzle migrations not automatic at startup). Updated Known Gaps table (skills usage analytics filled), Recommendations by Persona table (team skills adoption row added), and cross-reference to Packmind ContextOps (#076). Resource evaluation: docs/resource-evaluations/2026-05-18-skillsight-packmind.md (3/5 — integrate with caveats; promote to 4/5 when boot-time default detection, separate encryption key, and automatic migrations are shipped).

(guide/ultimate-guide.md §9.17, guide/cheatsheet.md, whitepapers/en/00-series-introduction.qmd, whitepapers/en/01-effective-prompts.qmd, whitepapers/fr/00-introduction-serie.qmd, whitepapers/fr/01-prompts-efficaces.qmd): Expanded the existing stub into a full deep-dive covering the evaluator model architecture (separate Haiku model, condition-based termination vs /loop's time-based), three-element goal formulation (measurable end state + verification mechanism + constraints), /goal clear and /goal status management commands, anti-patterns (vague objectives, judgment-heavy tasks, production data), permission boundary clarification, context rot warning (~20 turns), and the Orchestrator + claude -p mitigation pattern. Added /goal to the agentic capabilities table in both introduction whitepapers (EN + FR). Added /goal section to the Automation sections of both 01-effective-prompts (EN) and 01-prompts-efficaces (FR), including callout memo entries. Added /goal row to the "Features Méconnues" table in the cheatsheet.

(guide/ecosystem/third-party-tools.md): Added "Under the hood" table explaining the 7 hidden cache files in graphify-out/ (.graphify_ast.json = tree-sitter AST, .graphify_chunk_XX.json = AI-processed batches, .chunk_manifest_XX.json = per-chunk file lists for --update targeting, .graphify_semantic.json = post-dedup embeddings, cache/ = content hashes). Added --update mechanics explanation (hash comparison, per-chunk re-processing, zero API cost for unchanged files). Expanded MCP server section with large-graph guidance (5 MB threshold, skill-only vs MCP token cost tradeoff). Added "How Claude uses the installed skill" section documenting the 3-step resolution order: GRAPH_REPORT.md first, targeted graph.json sections, then MCP tools at scale.

(guide/ecosystem/third-party-tools.md): Added new "Knowledge Graph" section (#13 in TOC) covering Graphify (safishamsi/graphify, v0.8.9, MIT, PyPI: graphifyy). Documents the full init workflow (graphify . → graphify install --platform claude → --update for incremental rebuilds), the 3 core output files (graph.html, GRAPH_REPORT.md, graph.json), query commands, god nodes/surprising connections/confidence tagging analysis features, MCP server mode, file support across 31 languages plus PDFs/videos, team workflow via committed graphify-out/, privacy model (code local via tree-sitter, docs go to AI API), and the double-y PyPI naming trap. Updated frontmatter description, TOC, and Recommendations by Persona table.

(guide/ecosystem/ai-ecosystem.md §16, guide/roles/learning-with-ai.md): Added section covering Dimitri Mérault's free 21-chapter interactive guide to LLM mechanics (stepbytoken.com). Covers all 4 parts (model anatomy, training and alignment, production, advanced topics) with a Claude Code-specific chapter relevance table highlighting context windows (ch9), agents and MCP (ch11), prompt engineering (ch12), hallucinations (ch13), extended reasoning/thinking tokens (ch17), and KV cache (ch18). Also added cross-reference link in the External Resources section of the learning-with-ai guide.

(guide/ecosystem/third-party-tools.md): Added Claude Code Usage Monitor (~7,955 stars, real-time burn-rate predictions, highest-starred tool in category), claude-spend (one-shot npx claude-spend check), cc-statistics (cross-agent dashboard covering Claude Code + Gemini CLI + Codex + Cursor), and claude-context-optimizer (context heatmaps, wasted context detection, git-aware ROI reports). Added explanatory note on the Layer 4 billing blind spot: API-level gateways cannot intercept Claude Max/Pro subscription traffic; local file-parsing tools work billing-mode-agnostically.

(guide/ecosystem/context-engineering-tools.md §3): New subsection covering context-mode (mksglu/context-mode, ~14,149 stars, ELv2), the MCP server with output sandbox compression, SQLite+FTS5 session tracking with BM25 retrieval post-/compact, and the "Think in Code" pattern. Includes comparison with RTK and Headroom. Platform count: 12 supported platforms including Claude Code plugin, Gemini CLI, Cursor, Kiro, Zed.

(guide/ecosystem/context-engineering-tools.md §7): Added mem0 (mem0ai/mem0, ~55,228 stars) as a provider-agnostic, cloud-portable alternative to ICM. Includes decision guide table (ICM vs mem0 by use case), token overhead figure (~10-15%/turn), and architectural differentiation (ICM local-first/Claude-specific vs mem0 multi-provider/portable).

(guide/ecosystem/context-engineering-tools.md §8): New subsections covering: KV tensor mechanics (Key-Value matrices in VRAM, ~500MB-1GB for 100K-token Opus prefix), Claude Code request ordering (system prompt, tool definitions, CLAUDE.md as message content, conversation history), rationale for CLAUDE.md placement (shared system prompt cache across all users), production 96% hit rate, cache anti-patterns (timestamps in system prompt, mid-session tool changes), Plan Mode cache-stable design (EnterPlanMode/ExitPlanMode rather than removing tools), and compaction vs /clear cache continuity. Added "Self-Hosted KV Cache Infrastructure" subsection header to separate Claude-specific content from vLLM/SGLang content.

(guide/core/context-engineering.md §8): New named subsection covering the pattern coined by context-mode v1.0.64 and independently described by Contieri as "Ask for the Analyst, Not the Analysis." Documents the problem (30+ file reads for an exploratory task), the pattern (write and run a script, read only the result), three bash examples, when to apply it, and relationship to sub-agents.

(guide/core/context-engineering.md §8): New named subsection covering the three-tier cascade from LangGraph's Deep Agents SDK: Tier 1 (large tool outputs over 20K tokens offloaded to filesystem with path+preview injected), Tier 2 (accumulated tool call arguments dropped when context hits mid-point), Tier 3 (lossy message history summarization as last resort). Includes Claude Code-equivalent PostToolUse hook implementation in Python that transparently intercepts large bash outputs and writes them to temp files. Summary table and highest-leverage sequence updated to include both new patterns.

(guide/core/context-engineering.md §2): New subsection establishing that the effective ceiling is approximately 92% of the advertised limit (185K for Claude Opus 4's 200K window) before accuracy degrades. Covers the context rot mechanism (30%+ degradation in mid-window positions), the signal-to-noise argument against naive 1M window reliance, and planning targets per model.

(guide/ecosystem/third-party-tools.md): Replaced simulated benchmark figures with measured data from a TypeScript/T3 monorepo (2455 files, 7063-node graph): 57.8% overall compression, 86% savings rate on ctx_read, schema.prisma 2364L → ~200 tokens (99%), cache re-reads at 13 tokens. Updated install command to the official curl script + lean-ctx setup. Added RTK vs lean-ctx two-layer comparison table (RTK = CLI output, lean-ctx = file reads + session memory), monitoring commands, and cross-reference to context-engineering.md §12. Replaced Caution warning with a measured maintenance note.

(guide/core/context-engineering.md §12): New section covering the two-layer token compression stack for Claude Code. Layer 1 (RTK): CLI output compression via PreToolUse hook, 60-90% savings on git/cargo/npm. Layer 2 (lean-ctx): file read compression via tree-sitter AST, 10 ctx_read modes with selection guide (signatures/map/full/diff/lines:N-M), cache mechanics, CCP cross-session memory, and measured benchmarks. Includes savings distribution table (85% of lean-ctx savings from file reads vs <1% from shell), per-mode guidance for when to use each, and decision criteria by project type. TOC updated to add §11 Research Patterns and §12 Token Compression Tools.

(machine-readable/reference.yaml): Added 5-key entry for lean-ctx (yvgude/lean-ctx, 1 366 stars) under Third-Party Tools — local-first Rust CLI for context compression (60-95% token reduction claimed). Status: watch list, not yet integrated (breaking changes frequent, recent security fixes). Most direct RTK competitor identified in the context engineering tool landscape.

(machine-readable/reference.yaml): Added 5-key entry for mcp2cli (knowsuchagency/mcp2cli, ~1 900 stars, Show HN Best March 2026) — CLI bridge that lazy-loads MCP/OpenAPI/GraphQL tool schemas so LLM context only receives tool list and on-demand help strings instead of full schema injection each turn. 96-99% schema-token reduction benchmarked independently by Firecrawl, Scalekit, and CircleCI. Key nuance: 4+ unrelated forks share the same name; knowsuchagency is the reference implementation. Scoped to dev/single-tenant; not a replacement for enterprise MCP gateways with per-user OAuth and audit logs.

(guide/ecosystem/third-party-tools.md): New section between Token & Cost Tracking and Session Management, documenting lean-ctx (4-dimension Rust compression CLI: file read modes, shell modules, CCP session cache, SQLite property graph; watch-list status with caveats) and mcp2cli (Python CLI bridge solving MCP schema injection via lazy loading; independently benchmarked 32× token reduction on GitHub MCP server; naming collision warning for the 4+ unrelated forks). Table of Contents and frontmatter description updated.

(claude-code-ultimate-guide-landing/.github/workflows/link-check.yml): The lychee step was missing id: lychee, so steps.lychee.outputs.exit_code was always undefined and the issue-creation condition null != 0 evaluated to false — broken links were silently ignored. Added id: lychee to the step. Validated end-to-end: a deliberate broken link triggered issue #6 automatically, then was removed. At least 5 past "fix broken link" commits confirm this silent failure had real impact.

(guide/ultimate-guide.md, guide/ultimate-guide.fr.md, guide/cheatsheet.md, guide/ecosystem/mcp-servers-ecosystem.md, examples/workflows/database-branch-setup.md, examples/config/CONTRIBUTING-ai-disclosure.md): Fixed 10+ dead URLs detected by the new link checker: florian.bruniaux.com/guides redirected to cc.bruniaux.com/whitepapers/, platform.claude.com/docs/model-deprecations corrected to full path /docs/en/release-notes/model-deprecations, neon.tech/docs/guides/branching updated to neon.com/docs/introduction/branching, docs.sentry.io/integrations/mcp/ corrected to docs.sentry.io/product/sentry-mcp/, and ai-traceability.md path fixed. Added .lycheeignore for 26 historical dead references that credit real sources. Added HTTP 202 to accepted codes in lychee workflow (europarl.europa.eu returns 202). All fixes applied in both EN and FR translation files.

(.github/workflows/link-check.yml): Monthly cron (1st of month, 08:00 UTC) scanning guide/**/*.md and examples/**/*.md. Two-step detection: (1) lychee for HTTP external links — accepts 200, 202, 206, 302, 403, 429; excludes social media, localhost, template patterns, file://; (2) markdown-link-check for internal relative file links (pointer errors) — ignores HTTP/anchors since those are already covered. Each step creates its own GitHub issue on failure.

(guide, section "Subscription Plans & Limits"): Documented the March 26, 2026 Anthropic change — session limits now drain faster during weekdays 5am–11am PT due to GPU capacity constraints. Added practical workaround (shift compute-heavy tasks to off-peak hours). Source: MacRumors, The Register, TechRadar coverage of the official Anthropic change.

(security): Added Risk 6 — Claude Desktop browser integration silent native messaging host installation. Covers what gets installed, which browsers are affected, what native messaging actually does vs. the consent failure issue, how to audit and remove the files, and the Claude Desktop/Claude Code CLI conflict bug (GitHub #51949, #53864). Factual, no "spyware" framing, includes command-line audit and cleanup steps.

(security): Updated to v2.15.0 (2026-04-24). Added 5 new CVEs from OX Security MCP STDIO chain (CVE-2026-30623 LiteLLM, CVE-2026-40933 Flowise, CVE-2026-33224 Bisheng, CVE-2025-69256 Serverless Framework, CVE-2026-6494 Red Hat AAP MCP). Added attack techniques T026 (Claudy Day session hijack) and T027 (Claude Code Supply Chain Memory Poisoning). Added 9 new sources including IBM X-Force agentic AI report, Straiker 94% prompt injection study, InfoSecurity 10 in-the-wild IPI payloads. Added litellm to minimum_safe_versions.

(major update): Added "Triple Harness Incident (Mar-Apr 2026)" resolved entry, covering three independent harness/prompt changes that degraded output quality: default effort high to medium (March 4, reverted April 7), thinking tokens cleared per-turn bug (March 26, fixed April 10 in v2.1.101), verbosity system prompt (April 16, reverted April 20 in v2.1.116). Source: Anthropic official postmortem and Boris Cherny HN comments (April 23, 2026). Updated Last Updated date.

5 new CVEs/advisories (CVE-2026-33032 MCPwn critical actively exploited, CVE-2026-27944, CVE-2025-56404, CVE-2026-30615, ADVISORY-MCP-STDIO-2026-001), T025 "Comment and Control" attack technique, 2 new scanning tools (Snyk Agent Scan, Straiker MCP Security), 9 new sources

(guide/ultimate-guide.md §2 Session Handoff Pattern): New subsection after the existing handoff template documenting the three-command protocol (create, resume, update) with per-section merge rules. Key addition: append-only Work Done log creates an auditable history across sessions. Includes the merge rules table and link to fork-ready templates.

(guide/ultimate-guide.md §6.3 Command Template): New subsection after the existing command template documenting the checkpoint pattern: a checklist of preconditions Claude must verify before executing recipe steps. Prevents mid-step failures in one-way operations.

(guide/core/skill-design-patterns.md): New section (M4 pattern) documenting the practice of committing plan/spec pairs under .claude/ as dated markdown files (YYYY-MM-DD-<slug>.md + YYYY-MM-DD-<slug>-design.md). Covers why it beats session-only plans (grep-able, resume-able, captures rationale), when to use it, and the naming convention. Inspired by the Packmind .claude/plans/ convention (Apache 2.0).

Fork-ready context bar script for Claude Code's statusCommand setting. Displays a color-coded progress bar (green/yellow/red), context percentage, git branch, and model name. Key insight documented with inline comments: subtracts 32,000 tokens from the total context window to compute the effective input window (output buffer reservation). Adapted from Packmind's .claude/statusline.py (Apache 2.0).