chore(wheelhouse): cascade template@92657d8a

Author: jdalton

.claude/hooks/fleet/claude-segmentation-guard/README.md

@@ -12,7 +12,7 @@ Every entry under those four directories must live under one of:
 
 Top-level dangling entries like `.claude/skills/foo/SKILL.md` shadow the canonical `.claude/skills/fleet/foo/SKILL.md` copy and break skill resolution in unpredictable ways.
 
-Past incident: 2026-06-01 fleet-wide audit found ~200 dangling entries across 10 repos — every fleet repo had at least 18 duplicate top-level skill directories shadowing their `fleet/<name>/` counterparts. The cleanup script (`node scripts/check-claude-segmentation.mts --fix`) resolved them in bulk; this hook prevents the regression at edit time.
+Past incident: 2026-06-01 fleet-wide audit found ~200 dangling entries across 10 repos — every fleet repo had at least 18 duplicate top-level skill directories shadowing their `fleet/<name>/` counterparts. The cleanup script (`node scripts/fleet/check-claude-segmentation.mts --fix`) resolved them in bulk; this hook prevents the regression at edit time.
 
 ## What it blocks
 
@@ -39,7 +39,7 @@ Fails open on malformed payloads or unknown errors (exit 0).
 
 ## Bypass
 
-None. The autofix is always available: `node scripts/check-claude-segmentation.mts --fix` moves dangling entries into the right subdir based on the wheelhouse-canonical fleet/ set.
+None. The autofix is always available: `node scripts/fleet/check-claude-segmentation.mts --fix` moves dangling entries into the right subdir based on the wheelhouse-canonical fleet/ set.
 
 ## Test
 

.claude/hooks/fleet/claude-segmentation-guard/index.mts

@@ -11,7 +11,7 @@
 // entries across 10 repos — every fleet repo had at least 18
 // duplicate top-level skill directories shadowing their `fleet/<name>/`
 // counterparts. The cleanup script
-// (`scripts/check-claude-segmentation.mts --fix`) resolved them in
+// (`scripts/fleet/check-claude-segmentation.mts --fix`) resolved them in
 // bulk; this hook prevents the regression at edit time.
 //
 // Allowed paths:
@@ -151,7 +151,7 @@ process.stdin.on('end', () => {
         '    Repo-only:',
         `      ${targetForRepo}`,
         '',
-        '  Or run `node scripts/check-claude-segmentation.mts --fix` from the',
+        '  Or run `node scripts/fleet/check-claude-segmentation.mts --fix` from the',
         '  repo root to auto-resolve any dangling entries already on disk.',
         '',
       ].join('\n'),

.claude/hooks/fleet/lock-step-ref-guard/index.mts

@@ -362,7 +362,7 @@ async function main(): Promise<void> {
   }
   out.push('  Spec: docs/claude.md/fleet/parser-comments.md §5–6.')
   out.push(
-    '  CI gate: scripts/check-lock-step-refs.mts (run via `pnpm check`).',
+    '  CI gate: scripts/fleet/check-lock-step-refs.mts (run via `pnpm check`).',
   )
   out.push('  Bypass: "Allow lock-step bypass" in a recent user message, or')
   out.push(`  ${ENV_DISABLE}=1.`)

.claude/hooks/fleet/minimum-release-age-guard/index.mts

@@ -180,7 +180,7 @@ await withEditGuard((filePath, content, payload) => {
       '',
       "  Don't hand-edit the exclude list — run the canonical helper, which",
       '  looks up the npm publish date and writes the dated annotation for you:',
-      '    node scripts/soak-bypass.mts <pkg>@<version>',
+      '    node scripts/fleet/soak-bypass.mts <pkg>@<version>',
       '  (the daily updating-daily job removes the entry once its soak clears).',
       '',
       `  Bypass (to hand-edit anyway): type "${BYPASS_PHRASES[0]}" in a new message, then retry.`,

.claude/hooks/fleet/path-guard/README.md

@@ -24,7 +24,7 @@ them silently. Centralizing the construction in a single `paths.mts`
 per package means a refactor is a one-file diff, and divergence
 becomes impossible because every consumer imports the same value.
 
-The companion `scripts/check-paths.mts` runs a deeper whole-repo
+The companion `scripts/fleet/check-paths.mts` runs a deeper whole-repo
 scan at `pnpm check` time, catching anything this hook missed.
 
 ## What it blocks
@@ -38,12 +38,12 @@ The hook fires on `Edit` and `Write` tool calls when the target path
 ends in `.mts` or `.cts`. Other extensions (`.ts`, `.mjs`, `.js`,
 `.yml`, `.json`, `.md`) pass through — TS path code lives in `.mts`
 per fleet convention, and other file types are covered by the
-`scripts/check-paths.mts` gate at commit time.
+`scripts/fleet/check-paths.mts` gate at commit time.
 
 ## What it allows
 
 - Edits to a `paths.mts` (the canonical constructor).
-- Edits to `scripts/check-paths.mts` (the gate itself, which
+- Edits to `scripts/fleet/check-paths.mts` (the gate itself, which
   legitimately enumerates patterns).
 - Edits to this hook's own files (the test suite has to enumerate
   the same patterns).
@@ -86,7 +86,7 @@ When a new package joins the workspace, add it to
 If the hook itself crashes, it writes a log line and exits `0` —
 i.e. _the edit is allowed_. A buggy security hook that blocks
 everything is worse than one that temporarily lets things through.
-The companion `scripts/check-paths.mts` gate at commit time catches
+The companion `scripts/fleet/check-paths.mts` gate at commit time catches
 anything the hook missed.
 
 ## Testing

.claude/hooks/fleet/path-guard/segments.mts

@@ -1,5 +1,5 @@
 // Canonical path-segment vocabulary shared by the path-guard hook
-// (.claude/hooks/fleet/path-guard/index.mts) and gate (scripts/check-paths.mts).
+// (.claude/hooks/fleet/path-guard/index.mts) and gate (scripts/fleet/check-paths.mts).
 //
 // Mantra: 1 path, 1 reference. This module is the *one* place stage,
 // build-root, mode, and sibling-package vocabulary is defined. Both

.claude/hooks/fleet/path-guard/test/path-guard.test.mts

@@ -251,7 +251,7 @@ describe('path-guard — exempt files', () => {
     const source = `
       const PATTERNS = [path.join('build', 'Final', 'wasm')]
     `
-    const { code } = runHook('Write', 'scripts/check-paths.mts', source)
+    const { code } = runHook('Write', 'scripts/fleet/check-paths.mts', source)
     assert.equal(code, 0)
   })
 

.claude/hooks/fleet/paths-mts-inherit-guard/index.mts

@@ -27,7 +27,7 @@
 //     on disk (the ancestor may also be a fresh Edit in the same
 //     diff — we trust the consumer's intent).
 //
-// Repo-root scripts/paths.mts is exempt — there's no ancestor to
+// Repo-root scripts/fleet/paths.mts is exempt — there's no ancestor to
 // inherit from. We detect "is repo root" by checking whether any
 // parent dir between the file and the filesystem root contains
 // another scripts/paths.{mts,cts}.

.claude/hooks/fleet/paths-mts-inherit-guard/test/index.test.mts

@@ -34,7 +34,7 @@ let tmpRoot: string
 
 beforeEach(() => {
   tmpRoot = mkdtempSync(path.join(os.tmpdir(), 'paths-mts-inherit-guard-'))
-  // Repo-root scripts/paths.mts — ancestor exists for sub-packages.
+  // Repo-root scripts/fleet/paths.mts — ancestor exists for sub-packages.
   mkdirSync(path.join(tmpRoot, 'scripts'), { recursive: true })
   writeFileSync(
     path.join(tmpRoot, 'scripts', 'paths.mts'),
@@ -66,7 +66,7 @@ describe('paths-mts-inherit-guard', () => {
     assert.equal(r.code, 0)
   })
 
-  test('allows repo-root scripts/paths.mts (no ancestor)', () => {
+  test('allows repo-root scripts/fleet/paths.mts (no ancestor)', () => {
     const r = runHook({
       tool_name: 'Write',
       tool_input: {

.claude/hooks/fleet/plugin-patch-format-guard/README.md

@@ -1,6 +1,6 @@
 # plugin-patch-format-guard
 
-PreToolUse Edit/Write hook that blocks malformed plugin-cache patches under `scripts/plugin-patches/`.
+PreToolUse Edit/Write hook that blocks malformed plugin-cache patches under `scripts/fleet/plugin-patches/`.
 
 ## What it enforces
 
@@ -13,7 +13,7 @@ The runtime consumer is `scripts/install-claude-plugins.mts` — its `reapplyPlu
 
 ## Scope
 
-Fires only when the target `file_path` resolves under `scripts/plugin-patches/` and ends in `.patch` (normalized to `/`-separators first). Everything else passes through untouched.
+Fires only when the target `file_path` resolves under `scripts/fleet/plugin-patches/` and ends in `.patch` (normalized to `/`-separators first). Everything else passes through untouched.
 
 `Write` carries the whole file in `tool_input.content`, so it's fully validated. `Edit` only carries a `new_string` fragment — the hook can't see the surrounding file, so an `Edit` without `content` is skipped (the next `Write` or commit-time path catches it).