Multica Workspace Skills

What this is. Source-of-truth copy of the Multica workspace skills that have been added (or are queued to be added) at multica.longwoodlabs.com/objectuve/skills. Workspace skills are auto-injected into every agent run regardless of CLI; they don't otherwise live in git — this file gives them version history.

Workspace skills vs .claude/skills/

	.claude/skills/ (local)	Multica workspace skills
Where it lives	.claude/skills/<name>/SKILL.md in the repo	Created in Multica's UI; not in git
When it loads	Auto-discovered by Claude Code; description-triggered	Auto-injected into every agent run
CLI scope	Claude Code only (and similar CLIs that respect the convention)	Any CLI Multica supports
Best for	Tactical, situational expertise (e.g., creating-ui-mockups)	Always-on context (voice, north star, handoff rules)

The bar for promoting something to a workspace skill: "is this context every agent should have on every run, regardless of whether the task description triggers it, regardless of CLI?"

If yes → workspace skill. If no → .claude/skills/.

A third pattern — the on-demand workspace skill. "Auto-injected into every agent run" above describes an assigned workspace skill. Multica assigns skills per-agent (multica agent skills), so a workspace skill that is created but left unassigned is not injected into any run — it lives in the library and is pulled on demand (multica skill list for the id, then multica skill get <id>). Use this to keep a heavy detail-skill out of every-run context while still referencing it by name from an always-on skill. Skill 9 (ui-evidence-native-surfaces) is the first of these: unassigned, pulled only when a handoff touches a native surface, and pointed to by the always-on gate (skill 8).

Discipline

Each assigned workspace skill is paid in tokens on every run. Keep each one ≤400 words. Bloat compounds across the crew. If a skill is becoming long, it probably belongs in .claude/skills/ (description-triggered), in an on-demand workspace skill (created unassigned; see the third pattern above), or in a regular doc. The ≤400-word budget is a per-run-cost rule, so it binds hardest on assigned skills; an on-demand skill is pulled only when needed, so a larger body there costs nothing until it is loaded (though brevity is still a courtesy).

Per-agent assignment matrix (OBJ-2052). Multica assigns skills per-agent (multica agent skills), not "every skill to every agent." The scoping note that used to live here flagged skills 4 & 7 as borderline always-on and proposed per-agent assignment as the eventual fix — that model is now live for every skill in this file, not just those two. Current assignment (12 agents):

Agent	Skills
Orion	brand-voice, handoff-protocol, north-star, gsd-workflow, crew-roster
Codi	brand-voice, handoff-protocol, hallmark, ui-evidence, north-star, enkidu-non-negotiables, gsd-workflow, keystone, bastion, throughline
Roy	brand-voice, handoff-protocol, hallmark, ui-evidence, north-star, enkidu-non-negotiables, gsd-workflow, crew-roster, keystone, bastion, signal, atlas
Dave	brand-voice, handoff-protocol, north-star, enkidu-non-negotiables, gsd-workflow, signal
Vicki	brand-voice, handoff-protocol, north-star, gsd-workflow, crew-roster
Maggie	brand-voice, handoff-protocol, ui-evidence, north-star, gsd-workflow, crew-roster, compass
Dori	brand-voice, handoff-protocol, north-star, gsd-workflow, atlas
Desi	brand-voice, handoff-protocol, hallmark, ui-evidence, north-star, gsd-workflow, throughline, compass
Riley	brand-voice, handoff-protocol, north-star, gsd-workflow
Penny	brand-voice, north-star, compass
Sage	brand-voice, north-star, compass
Tess	brand-voice, handoff-protocol, north-star, enkidu-non-negotiables, gsd-workflow, signal

ui-evidence-native-surfaces (9) stays unassigned by design — see the on-demand pattern above. Skill counts here should match the Crew roster table in multica-state.md; if they diverge, the live workspace wins and this table needs reconciling. Roy carries the most (12) — breadth across every audit pillar is the reviewer's job.

---

Status

#	Skill	Tier	Status	Skill ID	Added to Multica
1	brand-voice-and-philosophy	1	Deployed	e99dbd15-1802-4eac-ab5c-5a1e7042053c	2026-04-22
2	multica-handoff-protocol	1	Deployed	27b95344-150a-459b-abea-dfaf9d7844a3	2026-08-12 (git-remotes-origin-only rule, OBJ-2477; previously 2026-07-31 push-before-handoff, OBJ-1915; previously 2026-07-03 wake mechanics + never-block-as-escalation)
3	north-star-and-pbc-floor	1	Deployed	26433a4a-b0f5-4f17-9657-78d73d706bbd	2026-05-13
4	enkidu-codebase-non-negotiables	1	Deployed	4138e561-c53e-443d-96a7-a58166673916	2026-05-13
5	gsd-workflow-quickref	2	Deployed	362eaf59-89ce-43ab-87dd-39710d0c31ae	2026-05-13
6	crew-roster-and-routing	2	Deployed	394ef2b9-258e-4a05-995b-e703f0cd5ddf	2026-05-13
7	objectuve-hallmark-quickref	2	Deployed	3ddbb076-5c8d-46de-bdda-50bfc8b6f68f	2026-05-22
8	ui-evidence-and-critique	2	Deployed	e1008cb0-2821-475e-a78f-7beae7e380ab	2026-07-07
9	ui-evidence-native-surfaces	2	Deployed · on-demand (unassigned)	3364e8a2-4fe3-43c0-a5e8-1abb048a59f3	2026-07-20 (split out of skill 8)
10	objectuve-keystone-quickref	2	Deployed	d53f93c5-ed96-4575-9622-3696516a3462	2026-08-02
11	objectuve-bastion-quickref	2	Deployed	e0becca1-0129-4088-b5fb-0340bed43a65	2026-08-02
12	objectuve-signal-quickref	2	Deployed	88537be0-8697-442a-b1db-ace8ae5d2799	2026-08-02
13	objectuve-throughline-quickref	2	Deployed	0bb48fd8-1663-49e4-943e-b499b57636af	2026-08-02
14	objectuve-atlas-quickref	2	Deployed	826da1f7-40be-4dff-b3b0-b23ee9ff8efe	2026-08-02
15	objectuve-compass-quickref	2	Deployed	45bc952b-c9de-4f9e-914c-04939d724e36	2026-08-02

Source of truth: the live Multica workspace is authoritative (it is what actually injects into agent runs). This file is a version-controlled mirror for review and drift detection. When you change a skill's body, push it to Multica via multica skill update <id> --content "$(extracted-body)" AND update the body below so the mirror matches. If the two ever disagree, live wins — re-extract from multica skill get <id> and update this file. (This matches the source-of-truth rule in multica-state.md.)

---

1. brand-voice-and-philosophy

Tier: 1 · Description for Multica: Universal brand-voice and product-philosophy rules for every Objectuve agent. Always-on context — applies to every run that produces user-facing copy, design, code that touches strings, or product / routing decisions.

Body:

# Brand voice and philosophy

Apply these to every artifact, comment, decision, or piece of copy you produce — code, docs, microcopy, release notes, plan, review.

## Voice — coach-who's-also-a-friend

- **Action-forward.** Lead with verbs: "Mark today done," "Set a goal," not "Goal setting interface."
- **Brief.** One sentence is the target. Two if needed. Never three.
- **Celebratory without empty praise.** Honor real progress; never inflate.
- **Direct, never corporate.** Avoid "leverage," "synergy," "best-in-class," "delight," "world-class."
- **Honest about cost and effort.** "Takes 30 seconds" beats "easy."

## Hard rules — the never list

- **Never use "AI" in consumer-facing copy.** Always say "Coach." The Coach serves the user, not the reverse.
- **Never recommend paywalling individual features.** Free-tier completeness is a PBC charter obligation.
- **Never write generic motivational copy.** "You've got this!" "Believe in yourself!" "Keep pushing!" — banned.
- **Never use FOMO, urgency, or dark patterns.** No "X people are waiting," no "Last chance," no fake scarcity.
- **Never use the words "engaged" / "engagement" as a goal.** We optimize for goals achieved, not engagement.

## When in doubt

- Read the relevant string out loud. Does it sound like a coach who's also a friend? If not, rewrite.
- Ask: would this appear in a competitor's marketing email? If yes, it's wrong for Objectuve.
- Reference: `docs/brand/brand.md`, `MISSION.md`.

---

2. multica-handoff-protocol

Tier: 1 · Description for Multica: Universal handoff rules for every Multica crew agent. Always-on context — describes how to pass work between agents, change status, and stay inside the routing chain.

Body:

---
name: multica-handoff-protocol
description: "Universal handoff rules for every Mutica crew agent. Always-on context — describes how to pass work between agents, change status, and stay inside the routing chain."
---

# Multica handoff protocol

Every Multica crew agent (Maggie, Orion, Desi, Codi, Riley, Roy, Dave, Tess, Vicki, Dori) ends every run with a handoff. Follow this protocol exactly.

## Final-action order — always this sequence

1. **Push first.** If your run created any commits, push the branch to `origin` before you comment. See "Push before you hand off" below.
2. **Comment second.** Post your structured output via `multica issue comment add <ISSUE_ID> --content-stdin <<'EOF' ... EOF`.
3. **Status third.** `multica issue status <ISSUE_ID> <new_status>`.
4. **Assign last.** `multica issue assign <ISSUE_ID> --to "<Next Agent>"`.
5. **Then exit.**

Never reassign before commenting. The next agent reads your comment to get context — flipping the assignee first can wake them before the brief lands.

## Push before you hand off — non-negotiable

**A commit that only exists locally does not exist for the next agent.** Every run gets its own isolated working directory, and consecutive runs on one issue can land on different hosts. Commit locally, hand off without pushing, and the next agent opens a checkout where your work simply isn't there — which reads as data loss and burns a round of investigation before anyone works out that the commit was fine all along, just stranded (OBJ-1915).

Before your final comment:

```
git -c user.name="<Your Agent Name>" -c user.email="<your-agent>@objectuve.com" commit -m "..."
git push -u origin <your-branch>
git log origin/<your-branch>..<your-branch>    # must print nothing
```

- The `git log origin/<branch>..<branch>` check is the proof. If it prints anything, you are not done — push again.
- Name the pushed branch explicitly in your handoff comment so the next agent can `git fetch && git checkout` it without guessing.
- If the push genuinely fails (auth, protected ref, network), do **not** hand off silently. Say so in your comment, quote the error, and leave the issue with Maggie.
- This applies to every git-mutating run, including "trivial change committed inline" runbook paths.

Wake mechanics (verified 2026-07-04): a task is dispatched only when the assignee actually CHANGES. Re-assigning an issue to its *current* assignee dispatches nothing — it is not a wake. To wake the current assignee, use `multica issue rerun <ISSUE_ID>`; `multica issue runs <ISSUE_ID>` is ground truth for whether a task dispatched.

## Status transitions

| Moving the issue to | Use status |
|---|---|
| Maggie (initial intake from a human) | `todo` (human sets this) |
| Orion / Desi / Codi / Dori / Dave / Tess / Riley actively working | `in_progress` |
| Maggie pending routing decision after handoff | `in_progress` |
| Roy or Vicki — awaiting review or ship | `in_review` |
| Any agent blocked on external input | `blocked` |
| Shipped and closed | `done` — Vicki on a `SHIP IT`, Maggie on every other completed issue (see [Who closes an issue](#who-closes-an-issue)) |
| Abandoned or duplicate | `cancelled` |

`blocked` is for the assignee to declare a REAL external dependency — never an escalation or a "stalled" marker. Blocked issues leave every active queue and the health sweep skips them, so anything parked there rots (this built an 11-issue graveyard by 2026-07-03).

### Declared CI waits

An agent waiting on external CI (PR checks, a workflow run, a merge) **may** use `blocked` for that wait — it is a real external dependency, the same as a human decision or a third-party outage. Two rules make it recoverable instead of a silent stall:

- **Must declare it.** Your *latest* comment on the issue before your run ends must name the PR number or URL you're waiting on. The workspace's wake mechanisms match on this — an undeclared block (no comment naming what it waits on) is a protocol violation, not a real wait, and gets treated as such by `Maggie — Blocked review`.
- **Must not rely on a background watcher.** A watcher process dies with your run — there is no "I'll keep checking" from inside a Multica task. `Riley — CI wake` (webhook, plus a 2h schedule backstop) and the daily `Maggie — Blocked review` sweep are what actually re-run your assignment once checks conclude or the block goes stale. Ending your run assuming something else will tap you on the shoulder is what stranded OBJ-2380 in `blocked` for ~11 hours on 2026-08-10 after its CI had already gone green — see `docs/development/ci-wake-blocked-status-postmortem.md` in the Enkidu repo for the full incident.

## Who closes an issue

`done` is the crew's terminal state, not a human inbox. An issue whose work is finished gets closed by the crew — Vicki on a `SHIP IT`, and **Maggie on every other completed issue**. Parking finished work in `in_review` "for a human to close" is a protocol violation: it is invisible to the human (nothing notifies them), and it feeds the stall-nudge sweep an issue it will re-verify forever. Sixteen issues sat that way through 2026-09-05 before Josh closed them by hand.

**Maggie closes an issue** — posts the closing synopsis, then `multica issue status <ISSUE_ID> done` — when ALL of these hold:

- every acceptance criterion on the issue is met, verified **this run** against the primary source (GitHub, the `multica` CLI, the file on `master`), not read off an earlier comment;
- every child issue is `done` or `cancelled`;
- nothing on the thread is waiting on a human answer;
- the issue is not on the escalation list below.

**Escalate to Josh instead of closing** — keep the issue `in_review`, assigned to Maggie, with an explicit @-mention naming the decision you need — only when the completed work:

1. changes production behavior a user can see, beyond what an approved UI-SPEC or acceptance criterion already covered;
2. rotates, provisions, revokes, or exposes a credential or secret;
3. changes IAM, billing, data retention, or anything that deletes user data;
4. changes the crew's own operating rules — agent instructions, workspace skills, autopilot definitions, the routing table;
5. ships, blocks, or reschedules a production release;
6. accepts a documented risk that outlives the issue — a dismissed advisory, a waived gate, a permanent exception;
7. is a milestone parent issue (Dori's milestone close covers those).

**When in doubt, close.** A routine issue closed too early is reopened in seconds. One parked wrongly costs days of re-verification and burns a stall-nudge cycle every night.

**Never re-verify the same completed issue twice.** If your check finds nothing left to do and the issue is not on the escalation list, close it in that run. "Re-confirmed, no change, awaiting human close" is not an acceptable terminal comment.

## Routing rules — non-negotiable

- **Every hop returns to Maggie.** Agents do not reassign directly to each other. Maggie is the single source of routing decisions.
  - **Two exceptions:** Vicki on `SHIP IT` may set `done` and not reassign. Maggie closes any other finished issue herself under [Who closes an issue](#who-closes-an-issue) — that is a terminal action, not a route.
- **Maggie never routes to herself.** If she needs human input, she posts the question @-mentioning the human, states explicitly that she is waiting on their answer (so the health sweep treats it as a wait-state: 24h grace, then escalation), keeps the issue's current status, and stays assigned. She does NOT set `blocked` — see the status-table note above.
- **Comment header format:** `## <Agent Name> — <action>` (e.g., `## Codi — execution report`). Makes the board scannable.
- **UI work:** screenshot evidence must be attached per the `ui-evidence-and-critique` skill before handoff — Maggie bounces a Desi UI-SPEC or Codi "done" comment lacking it.

## Maggie's context summary (required on every Maggie routing comment)

When Maggie routes work, she opens her comment with a **≤75-word "Current context" block**:

```
**Current context:** <what this issue is trying to accomplish>, <what has been decided or done so far>, <what the next agent needs to know to start>. Routing to <Next Agent> because <brief reason>.
```

Downstream agents orient from the **most recent Maggie comment only** — not the full thread. This keeps per-agent context overhead fixed regardless of how many hops have occurred.

## Loop detection

If an issue bounces between two agents more than twice, stop. Post a comment flagging the loop with the bounce history, @-mention Josh for a human decision, keep the issue's current status, and leave it assigned to Maggie. Don't try to break the loop autonomously — and never park it in `blocked`: blocked issues leave every active queue and rot.

## Scope mismatch

A **scope mismatch** is when an agent discovers mid-run that completing its assigned task as written would require exceeding its own remit. It is not a failure — the agent is functioning correctly by refusing — and it is not `blocked`, because the decision-maker is inside the crew, not outside it.

Three sub-types. Name the sub-type in the header; the umbrella term is always "scope mismatch" (do not coin variants like "scope gap" — the board is scanned on the header):

| Sub-type | Trigger | Who decides |
|---|---|---|
| **premise** | The task package asserts something about the codebase that is false, so doing the task as written does the wrong work | Orion re-decides; Josh if it is a product or strategy call |
| **authority** | The work is correct and unambiguous, but your Agent Identity does not authorize the action | Josh — either a one-off approval or an identity amendment |
| **boundary** | The work is correct and authorized in general, but belongs to another crew member's surface | Maggie re-routes; no human needed |

**The raise test — all three must hold:**

1. You found it mid-run, not at intake. At intake it is a bounce, not a mismatch.
2. The correct next action is either unknown (premise) or not yours to take (authority, boundary).
3. **You have not yet made the mutating change.** Stop before the commit, push, delete, or merge — not after. If you can complete the task correctly inside your remit, do that; a scope mismatch is not a way to defer a judgment call that is genuinely yours.

**Comment format:**

```
## <Agent> — scope mismatch (premise|authority|boundary)

**What the package asked for:** <one line>
**What is actually true / actually required:** <one line, with evidence>
**Why I stopped:** <the exact identity clause, or the exact wrong premise>
**What I did NOT do:** <the mutating action left untaken>
**Decision needed, from whom:** <Orion | Maggie | Josh> — <the question, stated as a choice between named options>

**Routing signal:** Maggie
```

- Status stays `in_progress`. **Never `blocked`** — there is no external dependency, and blocked issues leave every active queue and rot.
- Always hand back to Maggie, per the routing rules above. Maggie classifies, then routes: premise → Orion, boundary → the owning agent, authority → Josh (@-mentioned, wait-state, 24h grace).
- **Authority mismatches carry an evidence burden.** Before declining, verify the safety facts read-only and put them in the comment, so the human approving a one-off is not approving blind. Reference example: OBJ-1920 comment 13 — branch unprotected, PR merged into the branch rather than master, `gh pr list --base <branch> --state open` empty.
- A one-off human approval resolves *that* run only. If the same mismatch is likely to recur, say so and name it as an identity question, so it gets decided once instead of every time.

**Distinguish from neighbors:** `blocked` is a real external dependency (outage, missing credential, a human acting outside Multica). Loop detection is the same work bouncing twice; a mismatch is the first occurrence, and naming the decision explicitly is what prevents the bounce. A red CI check with a known mechanical fix is ordinary work — it becomes a mismatch only when the fix requires deciding something like which of two implementations is authoritative.

## Closing synopsis (mandatory on `done`)

Whoever sets status `done` MUST post a closing synopsis as their final comment, BEFORE the status transition. No exceptions. This is the comment a future agent (or Josh) reads to understand what shipped without scrolling the whole thread.

```
## <Agent> — closing synopsis

**Shipped:** <one sentence on what landed>
**Why:** <link to PRD / proposal / parent issue + 1-line rationale>
**Touchpoints:** <files, services, migrations, flags toggled, env vars changed>
**Verification:** <how this was confirmed working — make verify, manual UAT, Sentry quiet for N hours, etc.>
**Follow-ups (if any):** <new issues filed, deferred items, watch-fors>
```

In practice this is almost always Vicki on `SHIP IT`. If an issue is being marked `done` outside the normal chain (e.g., cancelled-but-actually-finished, doc-only fix Dori closed without Vicki), the agent doing the close still owes a synopsis — adapt the template.

If there's nothing to put in a field, write `n/a` — don't omit the field. A complete-but-trivial synopsis is more valuable than no synopsis.

## Comment template

```
multica issue comment add <ISSUE_ID> --content-stdin <<'EOF'
## <Your Name> — <action>

[your structured output per your role's Output format section]

**Routing signal:** <next agent + why>
EOF

multica issue status <ISSUE_ID> <new_status>
multica issue assign <ISSUE_ID> --to "<Next Agent>"
```

Reference: `docs/guides/multica-agent-crew.md` for full per-agent instructions, including each agent's Output format and Final-action paths.

## Git identity — explicit on EVERY git-mutating command

The shared runtime carries whatever git identity the last process left behind. Two production tags (`v4.0.3`, `v4.1.0`) were authored as `Desi <desi@objectuve.com>` because a leftover crew identity was ambient when the release script ran (OBJ-1473). Josh's decision (Track B, option 2) makes this rule non-negotiable for every crew agent:

- **Never rely on ambient `git config user.name` / `user.email`.** Every command that creates a git object — `git commit`, `git tag -a`, `git merge`, `git cherry-pick`, `git revert`, `git rebase`, `git stash`, `git am` — MUST carry an explicit identity inline:

  ```
  git -c user.name="<Your Agent Name>" -c user.email="<your-agent>@objectuve.com" commit -m "..."
  ```

- Use **your own crew identity** for your own work (e.g. `Codi <codi@objectuve.com>`). This applies everywhere you touch git directly, including "trivial change committed inline" runbook paths — those are exactly where the ambient identity leaks in.
- **Releases are the exception:** only `scripts/release.sh` creates release commits/tags, under `Objectuve Release Bot <release-bot@objectuve.com>`. No crew agent runs `git tag` for a `v*` release by hand, ever (the `v* tag release gate` ruleset blocks non-admin tag creation regardless).
- Do **NOT** "fix" identity with `git config user.name/user.email` (with or without `--global`) — that mutates shared runtime state for the next agent and recreates the incident. Per-command `-c` only.
- Reviewer obligations: Roy flags any PR whose commits carry an ambient or wrong identity; Riley treats an unexpected author/tagger identity on any ref as a stop-the-line signal, not a curiosity.

## Git remotes — origin only, never another task's workdir

Never `git remote add` inside a Multica-managed checkout, and never `git fetch <path>` at another task's working directory. Worktrees under one managed mirror share a common ref store and config, so a remote you add is permanent, host-global, and inherited by every later run — not scoped to your task. This is how the shared enkidu mirror accumulated 44,520 refs (vs 682 on `origin`) and ~40k reflog files from twelve task-workdir remotes, timing out the daemon's gc and browning out checkouts for 20–40 min every ~2h (OBJ-2449/OBJ-2477). Need another branch? It's on `origin` — `git fetch origin <branch>`. Think you need a second remote? That's a scope mismatch — hand back to Maggie.

---

3. north-star-and-pbc-floor

Tier: 1 · Description for Multica: The single metric Objectuve optimizes for, and the four Public-Benefit-LLC obligations that constrain every decision. Always-on context for routing, planning, shipping, and design.

Body:

# North star and PBC floor

Every decision an agent makes ladders up to one metric and is constrained by four obligations. If a proposed action conflicts with either, stop and re-route.

## North star — Goals Completed

> "Cumulative goals completed across the platform." Not signups. Not DAU. Not session time. Not MRR.

This is the metric every plan, every ship decision, every comp decision is measured against. When in doubt, ask: does this increase real goals completed by real users?

Trajectory targets (`docs/product/north-star.md`):
- 6 months: 2,500–10,000
- 1 year: 25,000–75,000
- 5 years: 2,000,000–10,000,000

## The four PBC public benefits (operating agreement, Section 1)

Objectuve Softworks, LLC is a Delaware Public Benefit LLC. Every material decision must serve (or at minimum not undermine) all four:

1. **Promoting individual well-being through ethical technology.** Anti-addictive design. Goals achieved, not minutes spent.
2. **Advancing responsible software design.** No infinite scroll, no algorithmic manipulation, no anxiety-inducing notifications, no dark patterns.
3. **Protecting user privacy and data rights.** Never sell or monetize user data. Never display ads. Full data portability and export.
4. **Ensuring equitable access.** Free tier provides the full individual experience. No paywalling features that help individuals achieve their goals.

## The five non-negotiable commitments

Mirror of the PBC obligations as everyday rules:

1. No ads, ever.
2. No data selling, ever.
3. Free for individuals, forever.
4. Anti-social design — ~10 min/day session target, gentle nudges to close.
5. No dark patterns — FOMO, infinite scroll, manufactured urgency are banned.

## Decision framework (operating agreement, Section 2.3)

Every material decision considers:

- **User Outcome Alignment** — does it optimize for goals achieved, not engagement?
- **Revenue Model Integrity** — consistent with: no paywall, no ads, no data sale, no dark patterns?
- **Privacy Preservation** — strengthens or maintains data protections / portability?
- **Accessibility and Equity** — preserves equitable access regardless of ability to pay?
- **Long-Term Sustainability** — supports continued PBC mission delivery without external funding dependency?

## Annual benefit report

Every material tension between pecuniary interests and public-benefit purposes gets logged in the annual benefit report (Section 2.5). When you propose something with a clear pecuniary upside that creates such tension, surface it explicitly — Vicki and Dori will fold it into the report.

---

4. enkidu-codebase-non-negotiables

Tier: 1 · Description for Multica: The five-line cheat sheet of Enkidu codebase patterns that are easy to mis-apply. Always-on context for code, review, and debug agents.

Body:

# Enkidu codebase non-negotiables

Five categories. Each is a known-mistake-multiplier; every Codi run, every Roy review, every Dave investigation should remember them.

## 1. IDs and lookups

- **NEVER expose database integer IDs to API clients.** Every API-exposed model inherits from `PublicRecord` which auto-generates `public_id`.
- **Use `Model.public_find(id)` for lookups, NEVER `Model.find(id)` in any API path or GraphQL resolver.**
- GraphQL types expose `public_id`, never `id`.

## 2. Business logic — Interactions

- **Use the custom `Interaction` gem (`Interaction::Base`), NEVER `ActiveInteraction`.**
- Pattern: `delegate_input :foo, :bar` for params, `def call`, `result.details = {...}` for success, `result.fail(error: '...', code: :symbol)` for failure.
- Controllers and GraphQL resolvers stay thin — call interactions, return their result.
- Side effects (jobs, gamification, notifications) happen INSIDE interactions, not in resolvers.

## 3. Auth — Clerk

- **Header is `SessionToken` (PascalCase).** NEVER `Authorization: Bearer` or `session-token`.
- Token is a Clerk RS256 JWT, valid for 10 minutes.
- Backend verifies via `ClerkJwtVerifier` (JWKS). Never roll custom JWT validation.
- `context[:current_user]` is populated in GraphQL resolvers; never re-decode tokens manually.

## 4. Ruby style (Rubocop enforced)

- Every file starts with `# frozen_string_literal: true`.
- Max line length: 140 characters.
- Max method length: 65 lines.
- Soft deletion via `acts_as_paranoid` (records get `deleted_at`, never hard-deleted by default).
- Always use `includes(:relation)` to prevent N+1 — `goldiloader` helps but be explicit on critical paths.

## 5. Frontend — Vue 3 + Ionic

- **`<script setup lang="ts">` only.** Never the Options API.
- Composables go in `src/composables/` with `use*` prefix.
- All GraphQL queries/mutations live in `src/constants/graphql/` as `gql` tagged templates (18 modules + barrel `index.js`) — never `.graphql` files.
- Use Tailwind utilities + the design tokens from `tailwind.config.js`. Never inline hex values.
- Pinia is installed but composables are the primary state pattern.

## Test coverage floor

- Backend: ≥80% line coverage (SimpleCov). Specs ship with code, never as a follow-up.
- Frontend: ≥80% statement coverage (Vitest v8). Same rule.
- E2E flows that touch user-facing journeys get a Cypress smoke test.

Reference: `CLAUDE.md` for the full set of conventions and the `naming-conventions` and `architecture-patterns` sections.

---

5. gsd-workflow-quickref

Tier: 2 · Description for Multica: Per-agent map of the GSD commands each Multica crew member uses. Quick recall when an agent inherits a task and needs to dispatch a GSD command.

Body:

# GSD workflow quickref

Every Multica crew agent routes work through GSD commands rather than ad-hoc edits. This is the recall card for which agent uses what.

## Per-agent command map

| Agent | Primary commands | Use when |
|---|---|---|
| **Maggie** | `/gsd-do`, `/gsd-next` | Routing freeform input; advancing to the next logical step |
| **Orion** | `/gsd-discuss-phase`, `/gsd-plan-phase`, `/gsd-research-phase`, `/gsd-new-milestone`, `/gsd-add-phase` | Cutting plans, kicking off phases, creating milestones |
| **Desi** | `/gsd-ui-phase`, `/gsd-ui-review` | Producing UI-SPEC; auditing implemented UI |
| **Codi** | `/gsd-execute-phase`, `/gsd-quick`, `/gsd-fast` | Executing planned phases or trivial fixes |
| **Riley** | `/gsd-pr-branch`, `/gsd-quick` | Creating PR-ready branches; trivial branch chores |
| **Roy** | `/gsd-code-review`, `/gsd-ui-review`, `/gsd-secure-phase`, `/gsd-code-review-fix` | Reviewing diffs, security audits, fix-up cycles |
| **Dave** | `/gsd-debug`, `/gsd-forensics` | Active debugging; post-mortem investigations of novel mysteries |
| **Tess** | `/gsd-add-tests`, `/gsd-debug`, `/gsd-fast` | Smoke/Cypress/CI flakes, test infra & coverage; owns the test/CI surface |
| **Vicki** | `/gsd-verify-work`, `/gsd-validate-phase`, `/gsd-audit-uat`, `/gsd-ship` | UAT, shipping |
| **Dori** | `/gsd-docs-update`, `/gsd-quick` | Doc creation/updates; trivial doc fixes |

## Milestone lifecycle commands

For epic-class work spanning multiple phases (per the `generating-project-roadmaps` skill):

- **Orion at kickoff:** `/gsd-new-milestone` → produces `.planning/milestones/v<X.Y>-ROADMAP.md`
- **Orion mid-milestone:** edit ROADMAP after each Vicki ship
- **Dori at close:** `/gsd-audit-milestone` → hand-edit `.planning/ROADMAP.md` on a short-lived branch off `master` (never `/gsd-complete-milestone` — see `docs/operations/planning-canon.md`) → write `docs/milestones/v<X.Y>-<slug>.md` from `docs/milestones/TEMPLATE.md` → hand to Riley for a normal PR

## Other useful commands

- `/gsd-pause-work` — context handoff when stopping mid-phase
- `/gsd-resume-work` — restore context from a previous session
- `/gsd-progress` — check project state and route to next action
- `/gsd-undo` — safe revert of phase/plan commits
- `/gsd-ship` — create PR + run review + prep for merge
- `/gsd-stats` — phase, plan, requirement, git metrics

## When in doubt

- Use `/gsd-do <freeform text>` to let GSD route to the right command automatically.
- Use `/gsd-help` to list everything.
- Reference: `docs/guides/multica-agent-crew.md` for each agent's full command list and Final-action paths.

---

6. crew-roster-and-routing

Tier: 2 · Description for Multica: Names and roles of the 12 Multica crew agents (10 executor + 2 proposer), plus Maggie's routing chain. Quick lookup when an agent encounters a comment referring to another crew member.

Body:

# Crew roster and routing

The 12 Multica crew agents and how work flows between them. Ten **executors** ship work along the chain; two **proposers** generate work for the chain to pick up.

## Roster — executors (in the shipping chain)

| Name | Role | Owns |
|---|---|---|
| **Maggie** | Manager — routing & dispatch | All board routing decisions; never executes |
| **Orion** | Planner | Task packages, phase plans, milestone roadmaps |
| **Desi** | Designer | UI-SPECs, brand voice in components, mockups |
| **Codi** | Coder | Code implementation; tests with code |
| **Riley** | Release Engineer | Branches, PR opening, CI monitoring |
| **Roy** | Reviewer | Code review against task package + conventions |
| **Dave** | Debugger | Novel runtime errors & mysteries (the recurring test/CI surface is Tess's) |
| **Tess** | Test Engineer | Smoke/Playwright/Cypress + `.github/workflows/`; writes & ships test/CI fixes (Dave diagnoses, Tess fixes) |
| **Vicki** | Verifier / Shipper | UAT, merge, release tag, rollback |
| **Dori** | Documenter | `docs/`, CHANGELOG, release notes, PRDs, milestone narratives |

## Roster — proposers (outside the chain, feed the backlog)

| Name | Role | Owns |
|---|---|---|
| **Penny** | Product Lead | Competitive analysis, PRD inspection, product proposals — creates backlog issues + draft PRDs |
| **Sage** | System Architect | Codebase + DDD evaluation — creates backlog issues + draft architecture proposals |

Proposers run on autopilot (Penny monthly, Sage monthly) and create backlog issues assigned to **Roy** — Roy triages and dedups, then a human greenlights before the work enters the chain. They never execute work themselves; their output is "what should we consider building?" not "build this."

## The shipping chain (happy path)

User → Maggie → Orion → Maggie → [Desi → Maggie →] Codi → Maggie → Riley → Maggie → Roy → Maggie → [Dori → Maggie →] Vicki → done

- **Desi** runs only when the work touches user-facing UI.
- **Dori** runs when the work needs `docs/`, CHANGELOG, release notes, PRDs, or milestone closure.
- **Dave** is pulled in for *novel* breaks — an unexplained failing test, runtime error, or regression. He diagnoses and hands the fix back; he never ships it.
- **Tess** owns the recurring test/CI surface — smoke/Playwright/Cypress flakes, CI-pipeline errors, test infra/coverage. Unlike Dave, she writes **and ships** the fix.
- Any ticket that hits **3 fix-rounds** without converging goes back to Orion for a respec — never a 4th round (the OBJ-706 lesson).

## Quick "who do I route this to?"

| If you saw | Route to |
|---|---|
| New ask, not yet planned | Orion |
| Planned task ready for code | Codi (after Desi for UI work) |
| Codi reports done | Riley (PR open + CI) |
| Riley reports CI green | Roy |
| Roy approves | Dori (if docs needed) → Vicki |
| Roy requests changes | Codi |
| Smoke/Playwright/Cypress flake, CI-pipeline error, test infra | Tess |
| Novel runtime error / regression / unexplained failure | Dave |
| Final phase of milestone shipped | Dori (milestone close) |
| Backlog issue created by Penny / Sage | Assigned to Roy — Roy triages, you greenlight, then Orion |

Full instructions per agent: `docs/guides/multica-agent-crew.md`.

---

7. objectuve-hallmark-quickref

Tier: 2 · Description for Multica: Always-on design-judgement quickref for every Objectuve agent that produces or reviews UI. Recall card for the locked design system, the four universal disciplines, the P/H/E/S/R/V rubric, and the audit/redesign/study verbs. Full skill lives locally at .claude/skills/objectuve-hallmark/.

Body:

# objectuve-hallmark quickref

The design-judgement bar for every Objectuve agent that produces or reviews UI. The full skill lives locally at `.claude/skills/objectuve-hallmark/`; this is the always-on recall card.

## The locked system — never invent

`DESIGN.md`, `design_system/css/tokens.css`, `design_system/tailwind-tokens.cjs`, and `docs/brand/brand.md` are the locked source of truth. Never invent a token, never inline a hex/hsl literal in app code, never propose a new theme. HSL not OKLCH; Tailwind 3.x config not v4 `@theme`. A value with no token is a finding to report, not a token to mint.

## Four universal disciplines

1. **Honest copy & UI** — no invented metrics, no fake social proof, no lorem ipsum in finished screens; every state tells the truth.
2. **Locked tokens** — named CSS vars / Tailwind classes only; a token edit is a system change (own commit, light + dark, human sanity-check).
3. **No fake chrome** — no drawn browser window, address bar, or phone bezel around a mockup.
4. **P/H/E/S/R/V self-critique** — score the output before emitting it.

## The P/H/E/S/R/V rubric

| Axis | Pass means |
|---|---|
| P — Polish | Reads as a shipped Linear / Stripe / Things 3 screen |
| H — Hierarchy | One primary action; everything else subordinate |
| E — Edge states | Loading, empty, error, success — designed, both themes |
| S — System | Every value on the 4px grid, from a real token |
| R — Restraint | Gold scarce, one accent per surface, no fake chrome |
| V — Voice | Action-forward, brief, no "AI" label, no engagement bait |

## The three verbs

- **`audit`** — score a screen/component against the slop-test gates + rubric. No edits; produces a findings list.
- **`redesign`** — rework the visual layer inside the locked brand. No new tokens.
- **`study`** — extract design DNA from a reference, diff against the locked system, produce a drift report.

## Hard rule

`DESIGN.md` + `design_system/` are locked — never invent a token, never inline a color. Run an `audit` before any UI handoff. Full gates, verbs, and the 8-state component flow live in `.claude/skills/objectuve-hallmark/`.

---

8. ui-evidence-and-critique

Tier: 2 · Description for Multica: Screenshot + motion evidence and self-critique protocol for UI work. Desi attaches mockup stills (and animated clips for animated mockups, WebP by default) to UI-SPECs; Codi attaches light+dark screenshots (plus motion clips for animated changes) after a hallmark-rubric self-critique loop; Maggie bounces UI handoffs without them.

Body:

# UI evidence and critique

Scope: for agents that produce, review, or route UI work — **Desi, Codi, Roy, Maggie**.

## The hard gate

A UI-SPEC handoff (Desi) or a UI "done" handoff (Codi) **without attached screenshots is incomplete**. Maggie bounces it back to the sender with a one-line reason. **Exemption:** trivial style tweaks (≤3-line CSS, no layout change, no copy change) — same threshold as the existing Codi-may-skip-Desi rule.

**When the change is animated, a still does not satisfy the gate on its own** — see Motion evidence below.

## Desi's obligation

If Tier 3 `render_mockup` → `store_design_asset` ran (default for new surfaces), its stills already satisfy the gate — attach/reference those, no extra step (WebP by default since OBJ-2385; PNG if `libwebp` wasn't available for the encode — see [docs/development/evidence-image-encoding.md](../development/evidence-image-encoding.md)). Otherwise (ad-hoc or trivial-tier specs):

1. `npm run build` in `ionic_frontend` (mockups use production-built CSS).
2. `node scripts/capture-mockups.mjs` — mobile/tablet/desktop × light/dark.
3. Attach via `multica issue comment add <issue> --content-stdin --attachment <webp-or-png> ...`

## Codi's obligation

Codi has no local backend, so the dev-server + `capture-ui-evidence.mjs` local login path does not work (it relies on a `.demo-btn` selector that no longer exists in `ionic_frontend/src`, and the script is fail-closed on auth). Live UI evidence instead comes from CI:

1. The `capture-ui-evidence` job in `preview.yml` runs automatically on any PR with app changes, capturing light + dark mobile screenshots against the live Firebase preview (which runs against real staging data).
2. It posts a PR comment linking the run's artifacts once capture completes (or fails loudly if capture didn't succeed — a missing/failed comment is not evidence).
3. To capture non-default routes, add a `UI-Evidence-Routes: /a,/b` line to the PR body (comma-separated, `/dashboard` is the default). All nine directive lines below (`UI-Evidence-Routes`, `UI-Evidence-Flag-Overrides`, `UI-Evidence-Motion`, `UI-Evidence-Interact`, `UI-Evidence-Platform`, `UI-Evidence-Public`, `UI-Evidence-Viewport`, `UI-Evidence-Stories`, `UI-Evidence-Mock-Graphql`) must start their own line in the PR body — a directive embedded mid-paragraph is not parsed and CI will post a `::warning::` on the run instead of silently applying it.
4. For a surface shipped dark behind a 0%-rollout feature flag, add a `UI-Evidence-Flag-Overrides: <flag-name>=on` line (comma-separated for multiple flags, e.g. `teams_leaderboards=on,better-together-interstitial=off`) to get a real flag-on screenshot instead of default flag-off evidence — see `FEATURE_FLAGS` in `ionic_frontend/src/lib/featureFlags.ts` for valid flag names. Values are `on`/`off`. This is applied via a Playwright network intercept scoped to the capture job's own browser context (not a localStorage marker read by app code), so it has no effect outside that CI job.
5. For a route whose data state should come from a deterministic fixture instead of live backend state — sidestepping smoke-account provisioning, active-team seeding, and flag-override targeting entirely — add a `UI-Evidence-Mock-Graphql: <fixture>.json` line (a bare filename, resolved against `scripts/fixtures/ui-evidence/`; same fixture format as `--mock-graphql` under [Native-gated (Capacitor) surfaces](#native-gated-capacitor-surfaces) below, keyed by GraphQL `operationName`). Applies to the authed capture pass only.

   ```
   UI-Evidence-Mock-Graphql: team-settings.json
   ```

   **Fail-loud, not fall-back:** an invalid-shaped or nonexistent fixture name fails the job with a named `::error::` before any browser launches — same posture as `UI-Evidence-Viewport`/`UI-Evidence-Stories`, not `UI-Evidence-Routes`'s silent-default fallback. An operation the fixture doesn't cover also fails loudly, naming the missing operation (see `assertNoGraphqlMockErrors` under Native-gated surfaces).
6. **Self-critique (max 2 cycles):** once the artifact is available, audit each screenshot, both themes, against the rubric in `objectuve-hallmark-quickref`. Fix, push, let CI re-capture. Stop after 2 cycles even if imperfect — ship and flag remaining gaps. Confirm each attached PNG is legible on a light review surface — an asset that is blank or near-invisible there fails the gate even if it would render on-device.
7. Reference the CI artifact link (not a re-attached PNG) in the "done" comment.

### `admin_dashboard`

`admin_dashboard` deploys on its own push-to-master-only lane and has no PR-time preview deploy to capture against, so its evidence path is a separate job rather than a `preview.yml` extension:

1. The `capture-ui-evidence` job in `admin.yml` runs automatically on any PR touching `admin_dashboard/**` or `design_system/**`. It builds the app and serves it locally via `vite preview` (no preview deploy target exists), then captures light + dark desktop screenshots against the live production GraphQL API — the same account/API the file's existing `smoke` job already exercises read-only.
2. It posts a PR comment linking the run's artifacts once capture completes (or fails loudly if any step didn't succeed) — same honest capture/legibility/upload contract as the `ionic_frontend` job above.
3. To capture non-default routes, add a `UI-Evidence-Admin-Routes: /a,/b` line to the PR body (comma-separated; `/` is the default). Named distinctly from `UI-Evidence-Routes` so a monorepo PR touching both apps can't have one directive misapplied to the other's routes — admin has far more role-gated routes than ionic has public ones, so anything beyond the landing route opts in per PR.
4. Same self-critique (max 2 cycles) and CI-artifact-reference rules as steps 5–6 above apply.

### Native-gated (Capacitor) surfaces

A Vue view gated on `Capacitor.isNativePlatform()` — a native branch on an **existing** view, not a separate native screen (for those, see the `ui-evidence-native-surfaces` skill below) — renders its web branch by default under headless-Chromium capture. `capture-ui-evidence.mjs --native` forces native detection via Capacitor's own supported `window.CapacitorCustomPlatform` hook, and auto-engages the same fallback-token auth `capture-flow-evidence.mjs` uses (`objectuve_fallback_token` in localStorage; `FALLBACK_AUTH_SECRET`/`SMOKE_FALLBACK_EMAIL` env, the latter defaulting to `demo@objectuve.com`) whenever no `STORAGE_STATE` is set — so, unlike the local demo-button path above, this needs no live backend. Pair it with `--mock-graphql <fixture>` — a JSON file keyed by GraphQL `operationName`, each value the full response body to fulfill that operation with verbatim (see `scripts/fixtures/ui-evidence/team-settings.json`) — to satisfy the route's GraphQL reads; an operation missing from the fixture fails loudly naming the operation, never a silent blank render. `assertAuthenticated` stays fully enforced in this mode — an additive auth path, not a bypass.

```bash
node scripts/capture-ui-evidence.mjs --routes /team-settings --native \
  --mock-graphql scripts/fixtures/ui-evidence/team-settings.json --modes light,dark
```

**Known limitation:** `--native` has been observed, in at least one local macOS sandbox, to wedge the Chromium renderer after auth/routing/data all complete successfully — every subsequent Playwright call (locator query, screenshot) then hangs. `capture-ui-evidence.mjs` wraps the affected calls in a hard timeout, so this now fails fast (~5–15s) with a diagnosed error instead of hanging the run indefinitely. Whether it reproduces on Linux CI was unconfirmed as of OBJ-1818 (that diff never exercised `Capture UI Evidence (Preview)`) — OBJ-2582 (below) wires `--native` into that job for the first time, so the first real PR that opts in is the actual test; the hard-timeout safety net still applies either way.

#### CI (`preview.yml` `capture-ui-evidence` job) — `UI-Evidence-Platform: native`

`--native` shipped in the script at OBJ-1818, but `preview.yml`'s own `capture-ui-evidence` job never passed it — every PR-time capture ran headless-Chromium-on-web regardless of what the diff touched, so a PR that only changed a Capacitor-gated branch (native sign-up/sign-in fallback, native OAuth, a native-only Settings row) got a "successful" capture that showed the web sibling the whole time, with nothing in the run or the PR comment saying so. OBJ-2580 / PR #2362 hit exactly this: the captured stills/GIF never showed the native fallback card the PR actually changed, and Roy had to verify the fix by reading source instead. Fixed at OBJ-2582 by wiring `--native` behind the same PR-body opt-in pattern as `UI-Evidence-Motion`/`UI-Evidence-Interact`:

```
UI-Evidence-Platform: native
```

Same own-line contract, same loud-unmatched-warning guard (OBJ-1708), same live `gh pr view` fetch (OBJ-1710) as the other directives. `native`/`web` are the only accepted values (`web` is also the default with no directive at all); anything else falls back to `web` with a `::warning::`. The job's existing fallback-token `storageState` (built for the account/goal/team seeding steps) satisfies `--native`'s auth requirement, so no extra secret plumbing was needed.

The PR comment now always states which platform was captured — even when this directive is **not** set, so a reviewer on a PR that touches a Capacitor-gated branch has an explicit signal ("Platform: web ... these screenshots show the web fallback, not the native branch") instead of inferring evidence coverage from a bare "Captured".

### Public (unauthenticated) routes — `UI-Evidence-Public: /sign-in`

A small set of routes render with no session at all (`meta: { public: true }` in `ionic_frontend/src/router/index.ts` — `/sign-in`, `/sign-up`, `/sso-callback`, `/public_goal/:goalId`, `/invite/:token`, `/join-team/:code`, `/u/:username`), and `capture-ui-evidence.mjs`'s auth check **cannot** target them — `assertAuthenticated()` fail-closes on any `/sign-in`-matching URL by design, since that check is the negative proof auth didn't silently fail. OBJ-2497 (sign-in password affordances) hit this wall directly: no local backend to log in with, and even a live backend wouldn't have helped, since the fail-close fires on the destination URL regardless of login success. `capture-public-pages.mjs` is not a substitute — it's a separate, bespoke docs-asset script (hardcoded `/u/:username` + `/public_goal/:id`, no CLI flags, not wired into this job's gate).

`--public` (OBJ-2505) gives the script a first-class unauthenticated mode that **inverts** the fail-close instead of relaxing it: `login()`/`assertAuthenticated()` are skipped entirely, and every capture is instead gated by a pre-flight route-allowlist rejection (`scripts/lib/public-routes.mjs`'s `PUBLIC_ROUTE_PATTERNS`, mirroring the router's `meta: { public: true }` routes exactly, with a drift test guarding the two from disagreeing) plus a post-navigation final-path-equality check and a per-route DOM landmark check — `/sign-in`'s landmark is Clerk's own `.cl-rootBox` wrapper, not `h1`, since the page's `<h1>` renders identically in both the ready and the Clerk-loading-timeout branches. `--public --routes /dashboard` still fails closed, exactly as before `--public` existed: the allowlist rejects it before a browser ever launches.

```
UI-Evidence-Public: /sign-in
```

Same own-line contract, same loud-unmatched-warning guard, same live `gh pr view` fetch as the other directives. Wired into the **same** `Capture UI evidence` step as the authed pass (not a new step), so it shares that step's `set -euo pipefail`, legibility check, artifact upload, and pipefail guard. A route named in both `UI-Evidence-Routes` and `UI-Evidence-Public` is captured once via the public pass and dropped from the authed one, with a `::warning::` naming it — otherwise the authed pass would fail-close on it and abort the whole step, killing the public pass too. The PR comment names which routes were captured unauthenticated when the directive fires; it says nothing extra when it doesn't, since silence is the normal case here (unlike `UI-Evidence-Platform`, where silence would misrepresent coverage of the *default* route). Combine with `--native` for a native-gated *public* surface (e.g. the OBJ-2580 native sign-up fallback card) — `--native`'s fallback-token auth seeding is skipped under `--public`, so `FALLBACK_AUTH_SECRET` is not required for that combination.

### Viewport override — `UI-Evidence-Viewport: 375x812`

`capture-ui-evidence.mjs --viewport` only ever accepted the two named presets, `mobile` (390×844) and `desktop` (1280×800) — there was no way to request an arbitrary width, and specifically no way to request 375px, the narrowest widely-held iPhone logical width (SE/mini class). A layout that's clean at 390 can overflow at 375, and that's exactly the regression class this gate exists to catch (OBJ-2991 — this is what actually blocked the 375px no-horizontal-scroll check in OBJ-2882, not the auth/motion gaps that phase attributed it to).

`--viewport` now also accepts an explicit `WIDTHxHEIGHT` form, dpr fixed at 2 either way:

```bash
node scripts/capture-ui-evidence.mjs --routes /dashboard --viewport 375x812
```

```
UI-Evidence-Viewport: 375x812
```

Same own-line contract, same loud-unmatched-warning guard (OBJ-1708), same live `gh pr view` fetch (OBJ-1710) as the other directives — but unlike them, **a malformed value fails the CI job loudly instead of silently falling back to `mobile`**: a viewport CI can't honor is worth stopping the run for, not silently substituting a different width than the one the PR asked to prove. `scripts/lib/viewport.mjs`'s `parseViewport` is the allowlist both the script and the workflow call directly (same posture as `motion-steps.mjs` for `UI-Evidence-Motion`) — each dimension of the explicit form must fall between 200 and 4096px, so a typo (a stray digit turning 375 into 3750, or 812 into 30000) is rejected rather than silently requesting a canvas Chromium won't honor. Absent the directive, behavior is byte-identical to before this existed: default `mobile`.

### Isolated component evidence — `UI-Evidence-Stories`

`UI-Evidence-Routes` and its siblings above all drive `capture-ui-evidence.mjs` against a **live route** — reach for `UI-Evidence-Stories` instead when the state you need evidence for is **prop-driven and no live route, and no data reachable from the signed-in smoke account, can put the app into it** (a component rendered with a prop combination nothing in staging currently produces). If a route can reach the state — even by adjusting `UI-Evidence-Flag-Overrides` or `UI-Evidence-Mock-Graphql` — use `UI-Evidence-Routes`; `UI-Evidence-Stories` is for the residual case a route structurally can't reach. This is the OBJ-3079 scenario the whole v4.49 milestone exists for (the canonical example is `RepairConfirmationModal`'s `Default` and `NoBackdropFilter` stories).

A separate, dedicated workflow (`.github/workflows/storybook-evidence.yml`, not a `preview.yml` job) captures directly from a built Storybook's `/iframe.html` — no login, no auth, no GraphQL, no Capacitor branch. Opt in with a comma-separated, own-line `UI-Evidence-Stories:` directive naming Storybook story ids (`toId()`'s `kind--name` form):

```
UI-Evidence-Stories: dashboard-repairconfirmationmodal--default,dashboard-repairconfirmationmodal--no-backdrop-filter
```

**There is no default story set** (unlike `UI-Evidence-Routes`'s `/dashboard` fallback) — with no directive, every step below the parse step is skipped (no `npm ci`, no Storybook build, no capture, no comment). Silence here means nobody asked for Storybook evidence on this PR, not "nothing to see." An invalid-shaped story id fails the job loudly (`::error::` + non-zero exit) rather than falling back to silently skipping evidence, and — since v4.49 Phase 3 (OBJ-3116) — still gets the same honest "Storybook Evidence Capture Failed" PR comment an unknown-but-valid-shaped id gets, instead of a bare red X with no explanation.

**Triggering it:** like the other directives, the job runs on `pull_request` (`opened`/`synchronize`/`reopened`) against a PR that already carries the directive when it opens. To add or edit the directive on an **already-open** PR — a body-only edit fires none of those events — dispatch the workflow manually with the PR's number:

```bash
gh workflow run storybook-evidence.yml -f pr_number=<N>
```

The parse step always re-fetches the PR body live via `gh pr view` (same OBJ-1710 pattern as the other directives), so a `workflow_dispatch` run picks up whatever the body currently says, not a stale snapshot.

**A capture never silently reports success under the wrong theme.** `assertModesDiffer()` in `scripts/capture-storybook-evidence.mjs` compares each story's light and dark captures and refuses to write one under the other's filename if they come back byte-identical — it fails the job instead. This is the milestone's "a failure must never read as a pass" posture holding on its first real exercise: Riley's live-proof run on PR #2759 hit exactly this (an unrelated, since-filed capture-script defect, OBJ-3127) and `assertModesDiffer()` caught it rather than letting a light render pass as dark.

Same own-line contract, same loud-unmatched-warning guard, same live `gh pr view` fetch as the other directives.

## Motion evidence (animated changes)

**Trigger — ask this on every UI handoff:** does the change involve an animation, a transition, an entrance/exit, a celebration, a skeleton-to-loaded swap, an expand/collapse, a drag, a scroll-linked effect, or a route transition? If yes, **stills alone do not satisfy the gate** — a frozen frame cannot show timing, easing, or whether the thing lands. Attach an animated GIF alongside the light+dark stills.

Motion evidence **supplements, never replaces**, the still set: light + dark PNGs remain mandatory, because the GIF is palette-quantized and is not what the legibility check reads.

### Desi — mockup motion

`render_mockup` takes a `--motion` flag. It records the mockup and emits a GIF per theme at mobile (light + dark), alongside the usual 6 PNGs:

```bash
node scripts/desi-render.mjs <mockup.html> --motion
node scripts/desi-render.mjs <mockup.html> --motion --motion-steps='wait:400|click:.cta|wait:1600'
node scripts/desi-render.mjs <mockup.html> --motion --motion-viewports=mobile,desktop
node scripts/desi-render.mjs <mockup.html> --motion --max-bytes=200000
```

With no `--motion-steps`, it records the mockup's own on-load entrance animation. `--motion` output is animated WebP by default since OBJ-2385 (GIF only survives as a fail-soft fallback if `libwebp` wasn't available for the encode — see [docs/development/evidence-image-encoding.md](../development/evidence-image-encoding.md)). Still captures are also budgeted to a byte ceiling by default (`--max-bytes`, defaulting to the image-size CI gate's own 400 KB threshold) — a dense board that lands over budget escalates automatically to `cwebp -size` target mode instead of needing a manual re-encode; pass `--max-bytes=0` to disable it for a deliberate one-off. Full ladder: [docs/development/evidence-image-encoding.md § Size budget](../development/evidence-image-encoding.md#size-budget). Upload the file through `store_design_asset` like any other capture and list it in the artifact payload's `screenshots[]` with `kind: 'motion'`. The UI-SPEC's state catalog must still describe the motion in words (duration, easing, `prefers-reduced-motion` fallback) — the clip shows it, the spec is what Codi builds from.

### Codi — live motion

Motion capture is opt-in per PR, because it roughly doubles the capture job's wall time. Add a line to the PR body:

```
UI-Evidence-Motion: on
UI-Evidence-Motion: wait:400|click:[data-testid=streak-pill]|wait:1600
```

`on` records each route's entrance animation. The second form supplies an interaction script (see the step grammar below). Same own-line contract as the other two directives — embedded mid-paragraph it is not parsed, and CI posts a `::warning::` rather than silently ignoring it. The CI job emits a `.gif` per route × mode next to the PNGs, plus the source `.webm`, in the same artifact. If motion was requested and no GIF was produced, the PR comment says so explicitly — that is a **not-satisfied** motion gate, not silence.

Self-critique applies to motion too, and asks different questions than the still rubric: does the transition read at a glance, does it respect the ≤300ms interactive-feedback rule, does anything jump or flash, and does the `prefers-reduced-motion` path still make sense?

### Codi — still-only interaction steps

Some states only exist behind an interaction (opening an action sheet, expanding a menu) but the change itself is not animated — there's no motion to record, so `UI-Evidence-Motion` is the wrong tool here (GIF/webm overhead, plus it wrongly claims the change is animated). `UI-Evidence-Interact` is the still-only sibling: same step grammar as motion (below), no recording, runs before every still capture instead. Add a line to the PR body:

```
UI-Evidence-Interact: click:[data-testid=room-menu]|wait:800
```

Unlike `UI-Evidence-Motion` there is no bare `on` form — a still-interaction directive with no steps has nothing to do before the capture, so only the step-script form is accepted. Same own-line contract as the other directives; CI posts a `::warning::` and skips the interaction rather than silently applying a malformed line. Combine it with `--motion`/`UI-Evidence-Motion` when the change is both interaction-gated and animated — the interaction steps run before the recording starts, so they reach the state without appearing in the GIF itself.

**Two states of one route in one PR — labeled entries (OBJ-2520).** The bare form above is global and unlabeled — it can't distinguish `/team-home`'s landing state from its `CreateCollectiveGoalModal`-open state, since both would write to the same `team-home--<mode>--<viewport>.png` path and the second write clobbers the first. A **labeled** entry adds an *additional*, distinctly-named capture of a single route instead of replacing the bare one: prefix the line with the route and a short label, each own-line like the other directives —

```
UI-Evidence-Routes: /team-home
UI-Evidence-Interact: /team-home modal-open click:[data-testid=create-collective-goal]|wait:800
```

produces both `team-home--<mode>--<viewport>.png` (the bare capture, unchanged) **and** `team-home--modal-open--<mode>--<viewport>.png` (the labeled one) in the same run, for both themes. The label must be lowercase-alphanumeric-hyphenated (`^[a-z0-9]+(-[a-z0-9]+)*$`), and its route must already appear in `UI-Evidence-Routes`. A PR body may carry several labeled `UI-Evidence-Interact` lines (one per state to evidence); at most one bare (unlabeled) line is still allowed, and it keeps its exact pre-OBJ-2520 global behavior. Same fail-loud posture as `UI-Evidence-Mock-Graphql` above: a duplicate `(route, label)` pair, a label naming a route not in `UI-Evidence-Routes`, a second bare line, or a malformed label each fail the job with a named `::error::` — none silently clobbers or drops a capture.

### Step grammar (both agents, the CI line, and `UI-Evidence-Interact`)

`<verb>:<arg>` joined by `|`, max 8 steps, max 15s of total wait:

| verb | arg | use |
|---|---|---|
| `wait` | ms | pause; also the tail pause that lets a transition finish |
| `click` | selector | Playwright selector click |
| `hover` | selector | hover-triggered motion |
| `press` | key | `Enter`, `Escape`, `ArrowDown`, … |
| `scroll` | px | scroll-linked effects (negative scrolls up) |
| `class` | `<sel>=<class>` | toggle a class to trigger a mockup animation (Desi only) |

This grammar is the CI allowlist — `scripts/lib/motion-steps.mjs` validates the PR-body line with the same parser the capture scripts use. There is no arbitrary-JS verb and there will not be one. A sequence that needs more than 8 steps is a **flow journey**, not a transition: register it under `scripts/flow-journeys/` and run `capture-flow-evidence.mjs`, which now emits a GIF per journey alongside its video and trace.

### Fail-soft

GIF conversion needs `ffmpeg`. If it is missing or conversion fails, the capture scripts still produce every still and report the reason — they do not fail the run. Surface that reason in the handoff comment; the still gate is satisfied, the motion gate is not, and Maggie's waiver rules below apply unchanged.

## Native surfaces (iOS / Android)

Native UI — WidgetKit / App Widget views, native screens, anything rendered outside the webview — has its own evidence pathway: deterministic snapshot rendering (never driving an emulator's launcher or home screen), plus the single-appearance / vibrant (Lock Screen accessory) capture rules. It lives in the linked **`ui-evidence-native-surfaces`** skill, which is **not** always-on: when a handoff touches a native surface, pull its body on demand — `multica skill list` for the id, then `multica skill get <id>`. The waiver rules there mirror the fail-open stance below.

## Filename convention

`<route-slug>--<mode>--<viewport>.png` (e.g. `dashboard--dark--mobile.png`). Both `light` and `dark` are mandatory for every screenshot set — a set with only one theme does not satisfy the gate — **except single-appearance surfaces (Lock Screen accessory / vibrant templates — see the `ui-evidence-native-surfaces` skill), which supply one legible baseline per state × size.**

Motion assets use the **same stem** with a different extension: `dashboard--dark--mobile.gif` and `dashboard--dark--mobile.webm`. Same stem is deliberate — it is how a reviewer pairs the still with its motion, and how the legibility check (which collects `*.png` only) stays scoped to stills.

**`UI-Evidence-Stories` filenames** follow the same three-token convention with the story id in place of the route slug: `<story-id>--<mode>--<viewport>.png`, e.g. `dashboard-repairconfirmationmodal--default--dark--mobile.png`. Worth stating explicitly because it looks wrong at a glance — Storybook story ids already contain their own `--` separator (`toId()`'s `kind--name` join), so the filename doubles up to four hyphens in a row. That's correct and deliberate: `check-png-legibility.mjs`'s `tokenize()` splits on runs of non-alphanumeric characters and matches `light`/`dark` as whole tokens, so the doubled separator collapses harmlessly rather than breaking the theme match.

**Labeled `UI-Evidence-Interact` filenames** (OBJ-2520) insert the label as its own token between the route slug and the mode: `<route-slug>--<label>--<mode>--<viewport>.png`, e.g. `team-home--modal-open--dark--mobile.png`. The route's bare capture (`team-home--dark--mobile.png`) is still written alongside it, never replaced — this four-token form is how one route gets more than one distinctly-named state captured in a single run. Same `tokenize()` behavior as the Stories form above: the extra `--<label>` segment collapses harmlessly against the theme match.

## Maggie's gate check

Before routing a Desi UI-SPEC or Codi "done" comment onward, confirm attachments are present. If missing (and not the trivial exemption or a logged waiver, below), bounce back with a one-line reason: "missing light+dark screenshots per ui-evidence-and-critique." Also reject any attached asset that renders blank or near-invisible on a light surface (the inbox/PR diff render on white) — that is not evidence.

**Motion check:** if the handoff describes an animation, transition, celebration, or any timing-dependent behavior and attaches only stills, bounce it with "animated change — needs a motion GIF per ui-evidence-and-critique." A stated `ffmpeg`/conversion failure is a waivable infrastructure failure like any other; "the stills look fine" is not.

## Failure stance — fail-open with audit trail

If capture infrastructure fails (dev server won't boot, Chromium missing, port bound, headless crash, ffmpeg absent) after **2 genuine attempts**, Codi (or Desi) documents the failure — exact command + error output — in the handoff comment. Maggie may then **waive** the gate, logging the waiver reason in her routing comment. A waiver covers infrastructure failure only, never "didn't try."

## Why

Screenshots prove a UI change renders as intended, in both themes, before a human or Vicki sees it. Motion GIFs prove an animated change *moves* as intended — timing, easing, and landing are invisible in a still, and "it looked right in the screenshot" is how a janky transition ships. Self-critique against the locked rubric catches drift before Roy has to.

---

9. ui-evidence-native-surfaces

Tier: 2 · Description for Multica: Native (iOS / Android) UI-evidence pathway — a linked extension of ui-evidence-and-critique. Deterministic snapshot rendering (Paparazzi / swift-snapshot-testing) for WidgetKit / App Widget / native screens, plus the single-appearance & vibrant (Lock Screen accessory) capture rules. Not always-on — load when a UI handoff involves a native surface.

Body:

# UI evidence — native surfaces

Extends the always-on `ui-evidence-and-critique` gate with the evidence pathway for **native** UI (iOS / Android): WidgetKit / App Widget views, native screens — anything rendered outside the webview. This skill is **not** always-on; the gate points here by name. Pull it on demand when a UI handoff touches a native surface — `multica skill list` for the id, then `multica skill get <id>`. Scope: **Desi, Codi, Roy, Maggie** (same as the gate).

## Native surfaces (iOS / Android)

The dev server + `capture-ui-evidence.mjs` mechanism covers browser routes only. For native UI (WidgetKit / App Widget views, native screens — anything rendered outside the webview), the evidence pathway is **deterministic rendering, never driving an emulator's launcher or home screen**:

1. **Preferred — snapshot-test artifacts from CI** *(harness not yet built for any surface as of 2026-07-07 — until it lands, use path 2 and flag the gap)*: Android layouts render via Paparazzi (JVM, no emulator); iOS SwiftUI views via swift-snapshot-testing (`xcodebuild test`). Cover every state × size × light+dark the spec defines — **except single-appearance surfaces (Lock Screen accessory families and other vibrant/monochrome templates), which get one legible baseline per state × size; see "## Single-appearance & vibrant surfaces" below.** Download the PNG artifacts from the PR's CI run (`gh run download <run-id>`) and attach them to the handoff comment — same filename convention and light+dark requirement (with the same single-appearance exception) as browser evidence.
2. **Until a snapshot harness exists for the surface:** a real compile proof (`gradlew assembleDebug` / `xcodebuild build` output) plus direct-capture screenshots if obtainable without launcher interaction (`adb exec-out screencap -p`, `xcrun simctl io booted screenshot`). Do NOT spend cycles fighting launcher UI (widget pickers, home-screen placement) in a headless emulator — ANRs there are environmental, not evidence. A missing snapshot harness for a new native surface is a follow-up task to flag in the handoff, not a gap to absorb silently.
3. Runner-environment fixes (JDK version for Gradle, stale CoreSimulatorService) are documented in `docs/operations/mobile-builds.md` § "Shared-runner gotchas" — check there before declaring capture infrastructure broken.

Waiver rules are unchanged: 2 genuine documented attempts (exact command + error), then Maggie may waive.

## Single-appearance & vibrant surfaces (Lock Screen accessories)

The light+dark rule in the `ui-evidence-and-critique` filename convention assumes a surface that has both appearances. Some native surfaces do not:

- **Lock Screen accessory widgets** (`WidgetFamily.accessoryCircular`, `.accessoryRectangular`, `.accessoryInline`) render in `WidgetRenderingMode.vibrant` — a desaturated *monochrome template* the system re-tints over the wallpaper. They have **no light/dark variant.** Pushing them through the home-screen widget's `colorScheme` matrix produces a "dark" pass that is white-on-transparent and reads as **blank** on any light review surface (the Multica inbox, a PR diff). Capture accessory surfaces **once, in vibrant rendering mode** — do not emit a `--dark--` accessory baseline.
- For any surface that is single-appearance by construction (always-monochrome templates, tint-only glyphs), one legible baseline per state × size satisfies the gate; the light+dark rule does not apply.
- **Backdrop matters for the capture.** Vibrant content is designed to sit over the Lock Screen wallpaper, so a raw white-backed snapshot can read as faint or blank even when the widget is correct. Composite the accessory capture over a representative mid-tone / Lock Screen-material backdrop (not plain white and not an arbitrary fill chosen just to pass the check) so the attached PNG is legible **and** faithful to on-device rendering.
- **Mechanical enforcement.** `scripts/check-png-legibility.mjs` runs in CI (the iOS/Android widget-snapshot jobs and the `capture-ui-evidence` job) and fails a blank / near-invisible PNG. It recognizes this carve-out by filename vocabulary via `SINGLE_APPEARANCE_PATTERNS` (currently `/^accessory$/i`, matched against separator-delimited filename tokens), keeping the permissive "legible against either backdrop" rule for a matching filename. Any other themeless filename (no `light`/`dark` token) must be legible against **both** backdrops. Extend `SINGLE_APPEARANCE_PATTERNS` only for genuine single-appearance surfaces — never loosen the thresholds to silence a failure.

---

10. objectuve-keystone-quickref

Tier: 2 · Description for Multica: Always-on structural-architecture quickref for Objectuve backend/keystone work. Recall card for the locked DDD source of truth, the four architectural disciplines, the B/C/I/L/D/O rubric, and the audit/map/trace verbs. Full skill lives locally at .claude/skills/objectuve-keystone/.

Body:

# objectuve-keystone quickref

The structure-level quality bar for Objectuve backend/architecture work — boundaries, contracts, invariants, coupling. The full skill lives locally at `.claude/skills/objectuve-keystone/`; this is the always-on recall card.

## The locked source of truth — never invent

`docs/architecture/ddd/00-overview.md`–`06-modularization-guide.md` (bounded contexts, ubiquitous language, context map, domain events), `rails_api/app/lib/domain_events.rb`, `rails_api/app/models/public_record.rb`, `rails_api/.rubocop.yml`, and `CLAUDE.md`'s Common Gotchas are the locked source of truth. Never invent a bounded context, a domain event name, or a coupling-point count. If the docs disagree with the code, or with each other, report it as a finding — never resolve it silently.

## Disciplines

1. **Honest contracts** — an id format, nullability, default, or error shape is a promise to every caller; breaking it silently is worse than breaking it loudly.
2. **Locked vocabulary** — bounded contexts, domain event names, and glossary terms come from the DDD docs; report a gap, never invent a resolution.
3. **Evidence-first** — every finding cites a `file:line`, an evidence-bundle metric, or an authority doc section — never a hunch.
4. **The B/C/I/L/D/O rubric** — the six-axis pre-emit self-critique below.

## The B/C/I/L/D/O rubric

| Axis | Pass means |
|---|---|
| B — Boundary | Business logic lives in the interaction, not the resolver/controller/model |
| C — Contract | The API tells the truth — ids, nullability, error shape, defaults |
| I — Integrity | Writes are guarded, transactional where multi-write, idempotent where retried |
| L — Language | Names match `02-ubiquitous-language.md` — no ad-hoc synonyms |
| D — Decoupling | A cross-context write goes through a domain event or documented seam, not a reach-in |
| O — Operability | Errors reach Sentry, jobs run on Sidekiq/Crono, failure stance is stated |

## The verbs

- **`audit`** — scores a scope (one or more domains, `--all`, or a diff) against the arch gates + rubric. No edits — report only.
- **`map`** — runs the evidence harvester for a scope, verifies artifacts landed. No edits — writes evidence only.
- **`trace`** — static vertical-slice map of one capability, mutation through to consumer. No edits.

## Hard rule

Never invent a bounded context, domain event name, or coupling-point count — the DDD docs and `domain_events.rb` are locked. A structural finding is behavior/architecture work, not a skill edit — keystone has no code-editing verb. Full gates, vocabulary, and probes live in `.claude/skills/objectuve-keystone/`.

---

11. objectuve-bastion-quickref

Tier: 2 · Description for Multica: Always-on trust-boundary quickref for Objectuve backend/security work. Recall card for the locked auth-architecture source of truth, the three security disciplines, the B/E/S/T/I/N rubric, and the audit/sweep verbs. Full skill lives locally at .claude/skills/objectuve-bastion/.

Body:

# objectuve-bastion quickref

The trust-boundary quality bar for Objectuve — auth guards, id-format boundaries, secret comparisons, token lifecycles. The full skill lives locally at `.claude/skills/objectuve-bastion/`; this is the always-on recall card.

## The locked source of truth — never invent

`CLAUDE.md`'s Common Gotchas (the `public_id` vs `user.id` gotcha, `SessionToken` header, AI Workforce admin-only rule), `rails_api/app/services/clerk_jwt_verifier.rb`, `rails_api/app/controllers/graphql_controller.rb` (the three `current_user` paths), `rails_api/app/graphql/concerns/authorization.rb`, `rails_api/app/models/public_record.rb`, and `rails_api/config/routes.rb` are the locked source of truth. Never invent an incident, a threshold, or a `file:line` citation.

## Disciplines

1. **Trust is earned at the boundary, not assumed from an earlier hop** — every place data crosses client→server, provider→server, or a trust level, the code at that point must verify it.
2. **Every specific claim traces to a real read** — a finding cites the exact file/line and the CLAUDE.md gotcha or sibling pattern, not a recollection.
3. **A correct-but-inconsistent guard is still a finding** — a hand-rolled check that works is a should-fix, not a pass, if it bypasses the shared `authorization.rb` concern.
4. **The B/E/S/T/I/N rubric** — the six-axis pre-emit self-critique below.

## The B/E/S/T/I/N rubric

| Axis | Pass means |
|---|---|
| B — Boundary-crossed-safely | Data crossing a trust boundary is validated at the crossing point, not assumed safe |
| E — Evidence-backed | The finding cites a real `file:line`, gotcha, or grep/read result |
| S — Scoped-to-real-risk | The finding matters given what's actually guarded (money, auth, PII) |
| T — Testable | The finding could be demonstrated with a concrete repro |
| I — Identity-correct | Server-resolved identity is correctly distinguished from client-supplied identifiers |
| N — No-new-surface | The finding's fix prefers an existing verified token shape over a new one |

## The verbs

- **`audit`** — scores a scope (registry surfaces, `--all`, or a diff) against the bastion gates + rubric. No edits — report only.
- **`sweep`** — runs the surface registry check, confirms every surface resolves to a real file/route. No edits — writes/prints evidence only.

## Hard rule

Never invent an incident, a threshold, or a citation — every finding traces to a real read. A security finding is a behavior change, not a skill edit — bastion has no code-editing verb. Full gates and the locked auth-architecture inventory live in `.claude/skills/objectuve-bastion/`.

---

12. objectuve-signal-quickref

Tier: 2 · Description for Multica: Always-on observability-truth quickref for Objectuve backend/CI work. Recall card for the locked CLAUDE.md gotcha source of truth, the four observability disciplines, the T/A/P/E/R/S rubric, and the audit/sweep verbs. Full skill lives locally at .claude/skills/objectuve-signal/.

Body:

# objectuve-signal quickref

The observability-truth layer for Objectuve — will anyone find out when it breaks? The full skill lives locally at `.claude/skills/objectuve-signal/`; this is the always-on recall card.

## The locked source of truth — never invent

`CLAUDE.md`'s Common Gotchas (PostHog flag drift, `??` vs `||` on shell env vars, staging deploy race, duplicate workflow `env:` keys, `jq -r` returning `"null"`), `docs/operations/deployment.md`, `rails_api/app/controllers/health_controller.rb`, `ionic_frontend/src/lib/featureFlags.ts`, and `rails_api/config/cronotab.rb` are locked. Never invent an incident, threshold, or flag name. If the gotchas and the code disagree, report it.

## Disciplines

1. **A rescued exception is not the same as a reported one** — "the code didn't crash" and "an operator can find out" are different properties; only the second counts.
2. **A silent fail-open/fail-closed choice is a choice made wrong by default** — every guard must state its stance, matched to the risk it guards.
3. **Parity means every reader agrees** — a flag/config is only correct when frontend, backend, and PostHog all consume the same single evaluation.
4. **An event is only as trustworthy as its cardinality guarantee** — every trigger is either provably single-fire or silently corrupting downstream math.

## The T/A/P/E/R/S rubric

| Axis | Pass means |
|---|---|
| T — Traceable | A production failure reaches a human — Sentry, log, alert — not just a swallowed exception |
| A — Actionable | The signal names what broke and where, not a generic message |
| P — Parity | A flag/config matches on every side that reads it |
| E — Explicit | The fail-open/fail-closed stance is stated and matches the risk |
| R — Reproducible | The finding is grounded in a citation, not asserted from memory |
| S — Scoped | The finding is about invisibility, not the underlying correctness bug |

## The verbs

- **`audit`** — scores a scope (a PR/diff, feature area, or file) against the signal gates + rubric. No edits — report only.
- **`sweep`** — runs the surface registry evidence harvester for a scope. No edits — writes evidence only.

## Hard rule

Never invent an incident, threshold, or flag name — CLAUDE.md's Gotchas and the code are the locked evidence. An observability finding is a behavior change, not a skill edit — signal has no code-editing verb. Full gates and the locked gotcha inventory live in `.claude/skills/objectuve-signal/`.

---

13. objectuve-throughline-quickref

Tier: 2 · Description for Multica: Always-on flow-sequence quickref for Objectuve frontend/flow work. Recall card for the locked motion/feedback vocabulary, the four flow disciplines, the O/M/C/R/F/X rubric, and the audit/walk/trace verbs. Full skill lives locally at .claude/skills/objectuve-throughline/.

Body:

# objectuve-throughline quickref

The sequence-level quality bar for Objectuve — the line drawn through frames of a multi-step user flow. The full skill lives locally at `.claude/skills/objectuve-throughline/`; this is the always-on recall card.

## The locked source of truth — never invent

`DESIGN.md`'s Motion section (~line 704), `references/motion-vocabulary.md`'s locked motion/feedback vocabulary, `useModalAnimations`, the `useToast`/`useHaptics` tiers, and the `routeAnimated` rule are the locked source of truth. Never invent an easing curve, toast duration, or haptic tier — a pattern the flow needs but the vocabulary lacks is a gap finding, not something to silently mint.

## Disciplines

1. **Honest flows** — never claim progress that isn't saved, never celebrate before a mutation confirms, never guilt-confirm an exit, never leave a wait dishonestly unresolved.
2. **Locked vocabulary** — every motion/feedback finding cites a named `motion-vocabulary.md` entry; extending it is a design decision made outside the audit.
3. **Evidence-first** — judge from captured stills/video/trace, never from memory; run `walk` before `audit` if evidence is missing or stale.
4. **The O/M/C/R/F/X rubric** — the six-axis pre-emit self-critique below.

## The O/M/C/R/F/X rubric

| Axis | Pass means |
|---|---|
| O — Orientation | At every step, the user knows where they are, why, and what's next |
| M — Momentum | Every step earns its place — honest count, prefilled defaults, no dead ends |
| C — Continuity | Transitions and loading handoffs read as one continuous surface |
| R — Recovery | The flow survives back, refresh, abandon, offline, double-tap |
| F — Feedback | The right toast/haptic/celebration tier fires exactly once, at the confirmed moment |
| X — eXit | Completion releases the user — destination reached, no detour |

## The verbs

- **`audit`** — scores one or more journeys against the 52 flow gates + rubric. No edits — report only.
- **`walk`** — runs the flow-evidence harvester for named journeys. No edits — writes evidence only.
- **`trace`** — static code-path map of a flow: routes, guards, mutations, cache writes, celebration triggers. No edits.

## Hard rule

Never invent a motion/feedback pattern — `motion-vocabulary.md` and `DESIGN.md`'s Motion section are locked. A flow finding is a behavior change, not a skill edit — throughline has no code-editing verb; a purely visual finding routes to `objectuve-hallmark redesign`. Full gates and interruption matrix live in `.claude/skills/objectuve-throughline/`.

---

14. objectuve-atlas-quickref

Tier: 2 · Description for Multica: Always-on documentation-truth quickref for Objectuve doc/agent-context work. Recall card for the locked canonical docs, the four atlas disciplines, the C/L/A/I/M/S rubric, and the audit/sweep verbs. Full skill lives locally at .claude/skills/objectuve-atlas/.

Body:

# objectuve-atlas quickref

The documentation-truth bar for Objectuve — atlas judges the *description* of the system, not the system itself: does the map still match the territory? Full skill lives locally at `.claude/skills/objectuve-atlas/`; this is the always-on recall card.

## The locked source of truth — never invent

`CLAUDE.md` (`AGENTS.md`/`GEMINI.md` are symlinks, not copies), `docs/reference/claude-quick-ref.md`, `MISSION.md`, `DESIGN.md`, `docs/brand/brand.md`, and `docs/operations/planning-canon.md` are locked. Never invent a drift, date, or canonical form. If two docs disagree, report it — never resolve it silently.

## Disciplines

1. **A drifted doc is indistinguishable from a current one** — no feedback loop announces staleness; lean on the evidence harvester, not judgement alone.
2. **Agent-facing context is executable** — a wrong `.claude/skills/**` fact costs every future agent run that loads it, not just one reader.
3. **Two docs that agree today are one refactor from disagreeing** — the fix for a duplicated fact is never "update both," it's "pick an owner, link the rest."
4. **Atlas audits the map, never the territory** — deletion test: if the doc vanished, would the finding disappear? If not, it belongs to a sibling pillar.

## The C/L/A/I/M/S rubric

| Axis | Pass means |
|---|---|
| C — Current | The doc describes the code as it is now, footer matches its real last commit |
| L — Locatable | Cited paths, symbols, line numbers, commands, and links resolve today |
| A — Authoritative | The fact lives in exactly one place, with others linking to it |
| I — Intent-honest | It documents what exists, not what was planned or deferred |
| M — Machine-safe | An agent loading this as context would act correctly on it |
| S — Scoped | The defect is the documentation itself, not the code it describes |

## The verbs

- **`audit`** — scores a scope (a PR/diff, a doc surface, or a file) against the atlas gates + rubric. No edits — report only.
- **`sweep`** — runs the doc-evidence harvester for a scope, verifies artifacts landed. No edits — writes evidence only.

## Hard rule

Never invent a drift, date, or canonical form — every claim traces to a real read. A finding is a documentation change, not a skill edit — atlas has no doc-editing verb; it sets the bar, not the pen. Full gates and the confirmed-drift inventory live in `.claude/skills/objectuve-atlas/`.

---

15. objectuve-compass-quickref

Tier: 2 · Description for Multica: Always-on business-model-integrity quickref for Objectuve product/feature-proposal work. Recall card for the locked MISSION.md/brand.md source of truth, the four compass disciplines, the A/C/T/I/O/N rubric, and the audit/scan verbs. Full skill lives locally at .claude/skills/objectuve-compass/.

Body:

# objectuve-compass quickref

The business-model/anti-pattern integrity bar for Objectuve — does this surface still serve the user's stated goal, or has it quietly started serving engagement/retention/revenue as an end in itself? Full skill lives locally at `.claude/skills/objectuve-compass/`; this is the always-on recall card.

## The locked source of truth — never invent

`MISSION.md`'s Values and ten Commitments (several naming dark patterns explicitly), `docs/brand/brand.md`'s Anti-Social App section, `docs/product/pricing-philosophy.md`'s Principles, `useScreenTimeNudge.ts`'s `app_session_ended` anti-metric, and `docs/development/notification-surfaces.md` are locked. Never invent an incident, threshold, or policy — go read the actual source.

## Disciplines

1. **Anti-social-by-design is the default posture, not an exception list** — a new surface must justify departing from minimal/opt-in, not be built freely and audited after.
2. **A dismissed nudge must stay dismissed** — a prompt that re-fires after dismissal is a wear-down mechanic wearing a dismissible shape.
3. **Free Means Free is a hard boundary, not a spectrum** — either a feature is paywalled or it isn't; no "nudged hard" middle state satisfies this.
4. **The anti-metric is load-bearing, not decorative** — `app_session_ended` exists to trend down, never to be read as an ordinary growth metric.

## The A/C/T/I/O/N rubric

| Axis | Pass means |
|---|---|
| A — Action-forward | Points the user toward a real action on their own goal, not re-engagement for its own sake |
| C — Consented | Opt-in and dismissible — never a forced interstitial |
| T — Transparent | States the real mechanic without hidden terms or implied urgency |
| I — Impermanent | A dismissed nudge stays dismissed, no wear-down re-firing |
| O — Optional | Declining costs the user nothing functional |
| N — Necessary | Serves the user's stated goal — the product would be worse without it |

## The verbs

- **`audit`** — scores a scope against the compass gates + rubric using direct source reads. No edits — report only.
- **`scan`** — a lightweight grep pass over the surfaces registry for known anti-pattern strings; ships no evidence-harvester script. No edits — read-only.

## Hard rule

Never invent an incident, a threshold, or a policy — every claim traces to `MISSION.md`, `brand.md`, or a real shipped file. A finding is a product/business-model decision, not a skill edit — compass has no code-editing verb. Full gates and the surfaces registry live in `.claude/skills/objectuve-compass/`.

---

How to use this file

1. Adding a new workspace skill in Multica: copy the Body section into Multica's "New skill" form. Copy the Description into the description field. Use the heading number's slug as the skill name. Save.
2. Updating a skill in Multica: edit the body in Multica (or push via multica skill update), then mirror the change here so this file stays in sync. Live is authoritative; this file is the mirror.
3. Drafting a new skill: add a new numbered section here, fill in the body (≤400 words), update the status table.
4. Removing a skill from Multica: mark the entry below as Status: Removed YYYY-MM-DD rather than deleting it — useful for audit trail.

Related

• Multica Agent Crew — full per-agent instructions and final-action paths
• Multica Autopilots — scheduled crew work
• .claude/skills/ — local, description-triggered skills (Claude-Code-specific)
• MISSION.md, docs/product/north-star.md, docs/company/public-benefit-operating-agreement.md — source-of-truth docs the workspace skills distill

Last updated: 2026-09-19 (OBJ-2520: extended skill 8 ui-evidence-and-critique's UI-evidence directives with UI-Evidence-Mock-Graphql and labeled UI-Evidence-Interact entries, corrected the directive-line count, corrected the :697 "or a mock" reference, and extended the Filename convention section; this file is the mirror, the live Multica skill 8 body needs the same addition applied separately)