Release v2.3.0: kit portability hardening

- De-brand shipped agent-harness surface (remove Flowser/CloakBrowser/OpenClaw
  product literals + dangling process/context refs from skills/agents/hooks prose)
- Config loader reads .vc.json first with legacy .ck.json fallback (byte-mirrored
  across .claude and .codex hooks)
- Add standing validate-kit-portability.mjs gate (survivor-allowlist, not disk
  existence) wired into vc-audit-vc; widen vc-publish Step 8 leak detection

Author: withkynam

.claude/agents/vc-code-reviewer.md

@@ -1,6 +1,7 @@
 ---
 name: code-reviewer
 tools: Glob, Grep, Read, Bash, WebFetch, WebSearch, TaskCreate, TaskGet, TaskUpdate, TaskList
+model: sonnet
 permissionMode: default
 description: "Comprehensive code review with scout-based edge case detection. Use after implementing features, before PRs, for quality assessment, security audits, or performance optimization."
 ---

.claude/agents/vc-execute-agent.md

@@ -2,7 +2,7 @@
 name: execute-agent
 description: EXECUTE MODE - Implementing EXACTLY what was planned. Full tool access. Can only be invoked after explicit user confirmation. Use after plan is approved.
 tools: Read, Write, Edit, Grep, Glob, Bash, Delete
-model: sonnet
+model: opus
 permissionMode: acceptEdits
 ---
 

.claude/agents/vc-fast-mode-agent.md

@@ -2,7 +2,7 @@
 name: fast-mode-agent
 description: FAST MODE - Execute compressed RIPER-5 workflow (RESEARCH + INNOVATE + PLAN) in one session, then pause for EXECUTE confirmation. Use when you want quick end-to-end solution.
 tools: Read, Write, Edit, Grep, Glob, Bash, Delete
-model: sonnet
+model: opus
 permissionMode: acceptEdits
 ---
 

.claude/agents/vc-ui-ux-designer.md

@@ -2,14 +2,15 @@
 name: ui-ux-designer
 description: 'Use this agent when the user needs UI/UX execution support including interface implementation, design-system polish, responsive layouts, animations, accessibility review, or design documentation. Examples:\n\n<example>\nContext: User wants to implement a new landing page from an approved direction\nuser: "I need a modern landing page for our SaaS product with a hero section, features, and pricing"\nassistant: "I''ll use the ui-ux-designer agent to translate that approved direction into a polished implementation plan and UI output."\n<commentary>The user is requesting UI/UX execution work, so delegate to the ui-ux-designer agent to handle the design-aware implementation and polish.</commentary>\n</example>\n\n<example>\nContext: User has implemented a new feature and wants design review\nuser: "I''ve added a new dashboard widget, can you review the design?"\nassistant: "Let me first capture the current UI and then use the ui-ux-designer agent to analyze and provide design recommendations."\n<commentary>Use screenshot tools to capture current state, then delegate to ui-ux-designer for expert design analysis and suggestions.</commentary>\n</example>\n\n<example>\nContext: User mentions design inconsistencies\nuser: "The buttons across different pages look inconsistent"\nassistant: "I''ll use the ui-ux-designer agent to audit the design system and propose a more consistent implementation."\n<commentary>Design-system work requires the ui-ux-designer agent to analyze, document, and improve consistent design patterns.</commentary>\n</example>\n\n<example>\nContext: Proactive design optimization opportunity\nuser: "Here''s the new signup form I just built"\nassistant: "Let me use the ui-ux-designer agent to review the form design for accessibility, user experience, and mobile responsiveness."\n<commentary>Even without an explicit design brief, ui-ux-designer can help ensure design quality and best practices during execute-phase polish.</commentary>\n</example>'
 permissionMode: acceptEdits
+model: sonnet
 tools: Glob, Grep, Read, Edit, MultiEdit, Write, NotebookEdit, Bash, WebFetch, WebSearch, TaskCreate, TaskGet, TaskUpdate, TaskList, Task(research-agent)
 ---
 
 [MODE: EXECUTE]
 
 This agent is callable from RIPER-5 EXECUTE phase for UI/UX implementation, design review, and accessibility polish tasks.
 
-**Read `process/context/all-context.md` first for context routing, then read `process/context/uxui/uiux.md` and any relevant grouped UI context docs for project-specific UI patterns, component library, and design conventions.** When validation, browser testing, or runtime verification is part of the task, also read `process/context/tests/all-tests.md` before deeper test docs.
+**Read `process/context/all-context.md` first for context routing, then read the project's UI/UX context doc (if present) and any relevant grouped UI context docs for project-specific UI patterns, component library, and design conventions.** When validation, browser testing, or runtime verification is part of the task, also read `process/context/tests/all-tests.md` before deeper test docs.
 
 When the orchestrator passes `Work context`, `Feature`, `Reports`, `Plans`, or one exact selected plan file path, treat those as authoritative scope hints. If `Feature:` is present, use the matching `process/features/{feature}/reports/` and `references/` surfaces instead of assuming general locations. Treat direct `*_PLAN_*.md`, legacy `PLAN.md`, legacy `plan.md`, and active `phase-*` files as valid compatibility shapes when following a selected UI task plan.
 

.claude/agents/vc-update-process-agent.md

@@ -106,11 +106,11 @@ Location: [Where in file - section name or append location]
 - "No context updates needed" is only allowed if you name the reviewed files and give a concrete reason for each unchanged file/group.
 - Route changes to the correct file:
   - Context routing/grouping changes → `process/context/all-context.md`
-  - Container/Docker/service changes → `flowser-container.md`
+  - Container/Docker/service changes → the relevant container/runtime context doc
   - Test patterns/commands/frameworks → `process/context/tests/all-tests.md` or deeper `process/context/tests/*.md`
   - Architecture/API/conventions/env vars → `all-context.md`
   - UI/UX patterns/components → `uiux.md`
-  - Skill runtime/app changes → `skill-apps.md` or `flowser-skills.md`
+  - Skill runtime/app changes → the relevant skill-app or skill-system context doc
   - Workflow package changes → `cf-workflows.md`
   - Known bugs/tech debt → `process/general-plans/backlog/backlog.md` or `process/features/{feature}/backlog/`
   - New context file needed → create it in the owning group when one exists, otherwise root; update `process/context/all-context.md` and the owning `all-{group}.md`
@@ -265,13 +265,13 @@ For each approved improvement:
 |---|---|
 | `all-context.md` | Root context entrypoint, architecture, API surface, conventions, env vars, monorepo layout |
 | `tests/all-tests.md` | Testing quick-start, runner selection, commands, debugging procedures, and routing |
-| `flowser-container.md` | Docker container lifecycle, plugin deployment, local dev commands, service ports |
+| container context doc | Docker container lifecycle, plugin deployment, local dev commands, service ports |
 | `cf-workflows.md` | Cloudflare Workers workflow context and patterns |
 | `uiux.md` | UI/UX design patterns, component conventions, styling guidelines |
 | `example-simple-prd.md` | Reference template for simple plan structure |
 | `example-complex-prd.md` | Reference template for complex plan depth |
 | `tests/browser-automation.md` | Browser automation test patterns, `chrome-debug` workflows, and browser debugging |
-| `flowser-skills.md` | Flowser skill system context, skill.json format, deployment |
+| skill-system context doc | skill system context, skill.json format, deployment |
 | `infra.md` | Infrastructure context: VPS, Docker, deployment, networking |
 | `skill-apps.md` | Vite skill apps infrastructure, gateway proxy, supervisord lifecycle |
 

.claude/hooks/lib/__tests__/statusline-scenarios.test.cjs

@@ -101,7 +101,8 @@ function runStatuslineSync({ payload, cwd = TEST_ROOT, env = {}, inputRaw = null
   };
   if (!Object.prototype.hasOwnProperty.call(env, 'NO_COLOR')) delete runtimeEnv.NO_COLOR;
   scrubAnthropicRuntimeEnv(runtimeEnv, env);
-  if (!Object.prototype.hasOwnProperty.call(env, 'HOME') && fs.existsSync(path.join(cwd, '.claude', '.ck.json'))) {
+  if (!Object.prototype.hasOwnProperty.call(env, 'HOME')
+    && (fs.existsSync(path.join(cwd, '.claude', '.vc.json')) || fs.existsSync(path.join(cwd, '.claude', '.ck.json')))) {
     runtimeEnv.HOME = cwd;
   }
   const result = spawnSync('node', [STATUSLINE_PATH], {
@@ -133,7 +134,8 @@ function runStatuslineWithDelayedChunks({ chunks, delaysMs, cwd = TEST_ROOT, env
     };
     if (!Object.prototype.hasOwnProperty.call(env, 'NO_COLOR')) delete runtimeEnv.NO_COLOR;
     scrubAnthropicRuntimeEnv(runtimeEnv, env);
-    if (!Object.prototype.hasOwnProperty.call(env, 'HOME') && fs.existsSync(path.join(cwd, '.claude', '.ck.json'))) {
+    if (!Object.prototype.hasOwnProperty.call(env, 'HOME')
+      && (fs.existsSync(path.join(cwd, '.claude', '.vc.json')) || fs.existsSync(path.join(cwd, '.claude', '.ck.json')))) {
       runtimeEnv.HOME = cwd;
     }
     const child = spawn('node', [STATUSLINE_PATH], {
@@ -179,12 +181,12 @@ function runStatuslineWithDelayedChunks({ chunks, delaysMs, cwd = TEST_ROOT, env
   });
 }
 
-function createTempConfigProject(mode, extraConfig = {}) {
+function createTempConfigProject(mode, extraConfig = {}, { configFileName = '.vc.json' } = {}) {
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), `statusline-mode-${mode}-`));
   const ckDir = path.join(tmpDir, '.claude');
   fs.mkdirSync(ckDir, { recursive: true });
   fs.writeFileSync(
-    path.join(ckDir, '.ck.json'),
+    path.join(ckDir, configFileName),
     JSON.stringify({ statusline: mode, statuslineQuota: true, ...extraConfig }, null, 2)
   );
   return tmpDir;
@@ -327,6 +329,28 @@ async function main() {
     }
   });
 
+  await test('Legacy .ck.json-only config still loads via fallback', async () => {
+    // Project has ONLY the legacy .ck.json (no .vc.json) — central loader fallback
+    // must still resolve it so existing installs keep working.
+    const tmpDir = createTempConfigProject('none', {}, { configFileName: '.ck.json' });
+    try {
+      const payload = {
+        model: { display_name: 'Claude' },
+        workspace: { current_dir: '/tmp' },
+        context_window: { context_window_size: 200000 }
+      };
+      const result = runStatuslineSync({ payload, cwd: tmpDir });
+      assertSuccessfulRun(result, 'Legacy .ck.json fallback scenario');
+      const { stdout } = result;
+      assertTrue(
+        stdout.trim() === '',
+        'Legacy .ck.json with mode none should still produce empty output via fallback'
+      );
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
   await test('Mode minimal keeps output to one line', async () => {
     const tmpDir = createTempConfigProject('minimal');
     try {

.claude/hooks/lib/privacy-checker.cjs

@@ -161,15 +161,17 @@ function extractPaths(toolInput) {
 }
 
 /**
- * Load .ck.json config to check if privacy block is disabled
- * @param {string} [configDir] - Directory containing .ck.json (defaults to .claude in cwd)
+ * Load .vc.json config to check if privacy block is disabled
+ * @param {string} [configDir] - Directory containing .vc.json (defaults to .claude in cwd)
  * @returns {boolean} true if privacy block should be skipped
  */
 function isPrivacyBlockDisabled(configDir) {
   try {
-    const configPath = configDir
-      ? path.join(configDir, '.ck.json')
-      : path.join(process.cwd(), '.claude', '.ck.json');
+    const baseDir = configDir || path.join(process.cwd(), '.claude');
+    // New-first, legacy (.ck.json) fallback for backward compatibility.
+    const newPath = path.join(baseDir, '.vc.json');
+    const legacyPath = path.join(baseDir, '.ck.json');
+    const configPath = fs.existsSync(newPath) ? newPath : legacyPath;
     const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
     return config.privacyBlock === false;
   } catch {
@@ -211,7 +213,7 @@ function buildPromptData(filePath) {
  * @param {Object} params.toolInput - Tool input with file_path, path, command, etc.
  * @param {Object} [params.options]
  * @param {boolean} [params.options.disabled] - Skip checks if true
- * @param {string} [params.options.configDir] - Directory for .ck.json config
+ * @param {string} [params.options.configDir] - Directory for .vc.json config
  * @param {boolean} [params.options.allowBash] - Allow Bash tool without blocking (default: true)
  * @returns {{
  *   blocked: boolean,

.claude/hooks/lib/scout-checker.cjs

@@ -145,7 +145,8 @@ function findGitRoot(startDir) {
 }
 
 /**
- * Find an optional project-local .ckignore at the git root config directory.
+ * Find an optional project-local .vcignore at the git root config directory.
+ * Prefers .vcignore, falls back to legacy .ckignore for backward compatibility.
  * This keeps overrides stable regardless of the caller cwd inside the repo.
  *
  * @param {string} startDir - Directory to start searching from
@@ -156,8 +157,10 @@ function findProjectCkignore(startDir, configDirName) {
   if (!configDirName || typeof configDirName !== 'string') return null;
   const gitRoot = findGitRoot(startDir);
   if (!gitRoot) return null;
-  const candidate = path.join(gitRoot, configDirName, '.ckignore');
-  return fs.existsSync(candidate) ? candidate : null;
+  const candidate = path.join(gitRoot, configDirName, '.vcignore');
+  if (fs.existsSync(candidate)) return candidate;
+  const legacyCandidate = path.join(gitRoot, configDirName, '.ckignore');
+  return fs.existsSync(legacyCandidate) ? legacyCandidate : null;
 }
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -171,10 +174,10 @@ function findProjectCkignore(startDir, configDirName) {
  * @param {string} params.toolName - Name of tool (Bash, Glob, Read, etc.)
  * @param {Object} params.toolInput - Tool input with file_path, path, pattern, command
  * @param {Object} [params.options]
- * @param {string} [params.options.ckignorePath] - Path to .ckignore file
- * @param {string} [params.options.projectCkignorePath] - Explicit project-local .ckignore path
+ * @param {string} [params.options.ckignorePath] - Path to .vcignore file
+ * @param {string} [params.options.projectCkignorePath] - Explicit project-local .vcignore path
  * @param {string} [params.options.claudeDir] - Path to .claude or .opencode directory
- * @param {string} [params.options.cwd] - Working directory used to discover a project .ckignore
+ * @param {string} [params.options.cwd] - Working directory used to discover a project .vcignore
  * @param {string} [params.options.projectConfigDirName] - Git-root config dir for project-local overrides
  * @param {boolean} [params.options.checkBroadPatterns] - Check for overly broad glob patterns (default: true)
  * @returns {{
@@ -238,8 +241,14 @@ function checkScoutBlock({ toolName, toolInput, options = {} }) {
     }
   }
 
-  // Resolve .ckignore path
-  const resolvedCkignorePath = ckignorePath || path.join(claudeDir, '.ckignore');
+  // Resolve .vcignore path (new-first, legacy .ckignore fallback)
+  const resolvedCkignorePath = ckignorePath || (
+    fs.existsSync(path.join(claudeDir, '.vcignore'))
+      ? path.join(claudeDir, '.vcignore')
+      : (fs.existsSync(path.join(claudeDir, '.ckignore'))
+        ? path.join(claudeDir, '.ckignore')
+        : path.join(claudeDir, '.vcignore'))
+  );
   const discoveredProjectCkignorePath = projectCkignorePath || findProjectCkignore(cwd, projectConfigDirName);
   const resolvedProjectCkignorePath = discoveredProjectCkignorePath
     && path.resolve(discoveredProjectCkignorePath) !== path.resolve(resolvedCkignorePath)

.claude/hooks/lib/statusline-render-modes.cjs

@@ -4,7 +4,7 @@
  * Statusline render mode implementations: full / compact / minimal
  *
  * All rendering is config-driven via a resolved layout object (from resolveLayout()).
- * When no statuslineLayout is present in .ck.json, output is IDENTICAL to the
+ * When no statuslineLayout is present in .vc.json, output is IDENTICAL to the
  * pre-refactor hardcoded renderer — zero regression guarantee.
  *
  * Mode function signatures: (ctx, layout) => void  (writes via console.log)

.claude/hooks/lib/statusline-section-registry.cjs

@@ -128,7 +128,7 @@ function getSectionRenderer(id) {
  * Resolve effective layout from statuslineLayout config, falling back to defaults.
  * Supports both new lines[][] format and legacy sections[] format.
  * When statuslineLayout is undefined/null, returns defaults — identical pre-refactor behavior.
- * @param {Object|undefined} statuslineLayout - From .ck.json config
+ * @param {Object|undefined} statuslineLayout - From .vc.json config
  * @returns {{ sections, theme, responsiveBreakpoint, maxAgentRows, todoTruncation }}
  */
 function resolveLayout(statuslineLayout) {