feat: add delivery-verification — session-end quality gate

skills/delivery-verification/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: delivery-verification
+description: Session-end quality gate for Claude Code. Before Stop, verifies learning capture completeness, detects rationalization patterns, and checks disk space. Hard blocks (exit 2) when complex tasks complete without learning capture. Complements pre-task-calibration (pre-action) and persona-review (adversarial depth).
+license: MIT
+---
+
+# Delivery Verification
+
+A Stop hook that mechanically verifies session completeness before allowing Claude Code to finish. Checks file timestamps, disk usage, and transcript patterns — no AI inference, no self-assessment.
+
+## When to Activate
+
+- At every session end (Stop hook)
+- After complex tasks (3+ Edit/Write operations)
+- When learning capture discipline matters across sessions
+- As the output gate paired with pre-task-calibration's input gate
+
+## How It Works
+
+```
+Session End (Stop hook):
+  1. Disk check: <15GB → exit 2 (hard block)
+  2. Task complexity: count Edit/Write calls
+  3. Learning capture: check if growth-log updated today
+  4. Rationalization detection: regex on transcript tail
+  5. Complex task + >=3 stale libs OR growth-log stale → exit 2
+```
+
+Only blocks when: disk critical, OR complex task completed without learning capture.
+
+## What It Checks
+
+| Check | Mechanism | On Hit |
+|-------|-----------|--------|
+| Disk space <15GB | shutil.disk_usage | Block (exit 2) |
+| Stale learning libs | mtime comparison | Warn; block if >=3 stale + complex |
+| Stale growth-log | mtime comparison | Block if complex task |
+| Rationalization patterns | Regex | Warn only (never blocks) |
+
+## Install
+
+```json
+{
+  "hooks": {
+    "Stop": [{
+      "hooks": [{
+        "type": "command",
+        "command": "python3 ~/.claude/scripts/quality-gate.py",
+        "timeout": 5000
+      }]
+    }]
+  }
+}
+```
+
+## Example
+
+```
+Stop hook (complex task, 5 edits):
+→ growth-log: updated today ✓
+→ decisions/log.md: updated today ✓
+→ ratings-tracker.md: STALE (last: 2 days ago)
+→ output-index.md: STALE
+→ 2/4 stale (<3) → warn only
+→ Allow session end
+```
+
+## Integration
+
+Complements — does not replace:
+- **pre-task-calibration**: pre-action verification
+- **persona-review**: adversarial depth
+- **neural-gate**: post-session behavioral verification
+
+## Evidence
+
+Merged in ECC (226K stars) as delivery-gate (#2378) after full maintainer review. 50+ session production use. The boundary between warn and block follows one principle: "can this be fixed retroactively?" Stale database → can backfill → warn. Missing growth-log after complex task → damage done → block.

skills/self-audit/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: self-audit
+description: Audits AI output across four dimensions before delivering — completeness, consistency, groundedness, and honesty. Use this skill whenever completing a complex task, before stopping and delivering results, or whenever output quality matters. Use whenever an agent is about to finish work — even if the user has not explicitly asked for review. Use after multi-file edits, architectural decisions, or any session where sloppy thinking could slip through. Use proactively: if you are about to ship, audit first.
+---
+
+# Self-Audit
+
+Before you ship, ask yourself four questions:
+
+1. **Did I answer everything?** (Completeness)
+2. **Did I contradict myself?** (Consistency)
+3. **Did I show evidence?** (Groundedness)
+4. **Am I being honest about the limits?** (Honesty)
+
+If any answer is no -> fix it -> re-ask. Code can pass all tests with sloppy thinking behind it. These four questions catch what tests miss — they are a habit of mind, not a checklist.
+
+Tests verify code. Nothing verifies reasoning. This skill fills that gap — four questions that catch what compilers and test suites cannot.
+
+## Priority Order
+
+1. **Honesty** — Never misrepresent what was done.
+2. **Completeness** — Missing requirements cause more harm than inconsistency.
+3. **Consistency** — Contradictions confuse but rarely cause data loss.
+4. **Groundedness** — Complete honest soft evidence > evidenced but missing half.
+
+## Hard Constraints
+
+- **Never fabricate findings.** If all four dimensions pass, report PASS. If any fail, report FIXED with specifics.
+- **Never expose sensitive data.** Redact paths, secrets, tokens, PII before displaying audit output.
+- **Never block on subjective grounds.** Flag only concrete, verifiable gaps — not stylistic preferences.
+
+## When to Use
+
+- Complex task completed (3+ file edits)
+- Agent about to stop and deliver results
+- After architectural decisions with downstream impact
+- Sessions where sloppy thinking could slip through
+- Proactively: if you are about to ship, audit first
+
+## The Four Questions
+
+### 1. Completeness
+List each request. Verify response or deferral. Flag partials as full.
+
+### 2. Consistency
+Scan vs earlier. Check project rules. Flag A-and-not-A.
+
+### 3. Groundedness
+Identify claims. Evidence or words? Distinguish not-verified vs hidden.
+
+### 4. Honesty
+Check over-packaging. Edge cases mentioned? Verified without showing? Missing error handling = production ready?
+
+## Process
+
+1. COMPLETE task
+2. ASK four. Fail -> fix -> re-ask.
+3. 3+ stuck: report blocking, ask user.
+4. All pass -> stop.
+
+Output:
+
+Self-Audit:
+Completeness:  OK | FIXED [what]
+Consistency:   OK | FIXED [what]
+Groundedness:  OK | FIXED [what]
+Honesty:       OK | FIXED [what]
+
+## Failure Modes
+
+- **Overly long**: Sample 5 most critical.
+- **Data leak**: Redact before display.
+- **Fatigue**: Detail mode for shipping only.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| Simple change, no audit | Simple changes cause bugs. 30s saves hours. |
+| Checked as I went | Cross-cutting only in dedicated pass. |
+| User will catch | Users not QA. |
+| All four OK no detail | Complex tasks find >=1 issue. |
+| Verified internally | Without output = assumption. |
+
+## Red Flags
+
+- Stopping without audit
+- All OK no specifics
+- Verified without showing
+- Requirements dropped silently
+- Audit hidden in reasoning
+
+## Verification
+
+- [ ] Four questions answered with specific evidence (not "seems fine")
+- [ ] FIXED applied for every failed dimension
+- [ ] Audit output visible in the response (not buried in reasoning)
+- [ ] Hard constraints respected — no fabricated findings, no leaked data
+- [ ] No rationalized omissions (skipped work documented as skipped, not as done)
+
+## See Also
+
+- `code-reviewer` — Review code changes for correctness and quality
+- `security-review` — Identify vulnerabilities in the output