OpenSIN-Code · Delqhi · Jun 16, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -4,9 +4,11 @@
 > Read this file completely before making any change. If reality and this file
 > diverge, fix the divergence in the same PR (code or doc — whichever is wrong).
 >
-> **Last verified against main:** v3.14.0 in progress (2026-06-13) —
-> unified config subsystem (#34). Tool inventory and repo layout in sections 6 and
-> 10 are sourced from `go test ./...` and `cmd/sin-code/main.go` AddCommand list.
+> **Last verified against main:** v3.17.0 (2026-06-16) —
+> bundled skills reorganized into category directories and renamed to
+> `skill-<category>-<name>`; `github-skills/` category added; 34 bundled skills
+> embedded in the binary. Branch protection on `main` permanently relaxed to
+> `required_approving_review_count: 0` for solo-maintainer workflow.
 
 ---
 
@@ -263,8 +265,20 @@ SIN-Code/
 │       SIN-Code-SCA-Tool-Go, SIN-Code-Secrets-Scanner
 │
 ├── src/sin_code_bundle/       ← Python companion: `sin` CLI + `sin-serve`
+├── skills/                    ← 34 bundled skills in category directories
+│   ├── browser-skills/
+│   ├── code-skills/
+│   ├── debug-skills/
+│   ├── design-skills/
+│   ├── ecosystem-skills/
+│   ├── github-skills/
+│   ├── infrastructure-skills/
+│   ├── memory-skills/
+│   ├── planning-skills/
+│   ├── process-skills/
+│   └── shop-skills/
 ├── tests/                     ← Go + Python tests
-└── scripts/                   ← org-cleanup.sh, promote-to-sin-code.sh
+└── scripts/                   ← org-cleanup.sh, promote-to-sin-code.sh, validate_skill.py
 ```
 
 ---
@@ -342,6 +356,27 @@ updates `homebrew-sin` formula, and ships to GitHub Releases.
 - The string "SIN-Code-Bundle" may only appear in CHANGELOG history and
   migration notes — never in code, config, or new docs (mandate M5).
 
+### Bundled skill naming rules
+
+All bundled skills live under `skills/<category>-skills/` and are named
+`skill-<category>-<descriptive-name>`. Examples:
+
+| Category | Directory | Skill name |
+|---|---|---|
+| Code | `code-skills/` | `skill-code-audit`, `skill-code-build`, `skill-code-create` |
+| GitHub | `github-skills/` | `skill-github-actions`, `skill-github-account`, `skill-github-app` |
+| Memory | `memory-skills/` | `skill-memory-honcho`, `skill-memory-infisical` |
+| Process | `process-skills/` | `skill-process-goal`, `skill-process-grill` |
+| Shop | `shop-skills/` | `skill-shop-cj-dropshipping`, `skill-shop-stripe` |
+
+Each skill **must** contain:
+- `SKILL.md` with frontmatter (`name`, `description`, `license`, `compatibility`, `metadata`)
+- `context/`, `frameworks/`, `tasks/`, `templates/` directories
+- `LICENSE` file
+
+Skills ported from external repos (e.g. `Infra-SIN-OpenCode-Stack`) must include
+`lifecycle: external` and `sources:` in their metadata.
+
 ### CLI subcommands (verified `cmd/sin-code/main.go`, v3.5.0)
 
 ```

diff --git a/BACKLOG.md b/BACKLOG.md
@@ -0,0 +1,33 @@
+# Backlog
+
+> Active work queue for SIN-Code. Items are roughly prioritized; references to GitHub issues use `#NN`. Items saved in the local `coverage/save-local` branch are marked accordingly.
+
+## In Progress / Near-term
+
+- **Fix golden help test** — `cmd/sin-code/testdata/golden/help.golden` is out of sync with the current subcommand list (new subcommands from the `coverage/save-local` work: `instinct`, `hooks`, `assets`, `evalset`, `prp`).
+- **Fix coverage branch test failures** — `coverage/save-local` has missing test hooks (`mcpHookVars`, `autoHookVars`) causing `go test ./cmd/sin-code` to fail. Resolve and merge back to `main` when green.
+- **Skill lifecycle markers** (#139) — add `lifecycle: native|external|deprecated` and `sources:` metadata to every bundled skill.
+- **Fusion: goal-mode into native `sin-code goal`** (#140) — port `SIN-Code-Goal-Mode-Skill` functionality into the native `sin-code goal` subcommand.
+- **Fusion: grill-me into native `sin-code grill`** (#141) — port `SIN-Code-Grill-Me-Skill` to a native subcommand.
+- **Integrate shop-skills** (#142) — plan fusion of `SIN-Shop-Center` skills (CJ Dropshipping, Stripe, TikTok Shop) into the binary or keep as external docs.
+
+## Technical Debt
+
+- **LSP framing bug** — `internal/lsp/client.go` cannot handle interleaved JSON-RPC notifications from gopls v0.20+; rewrite `Call` with a scanner split function (see `docs/lsp-known-issues.md`).
+- **Runtime DB locations** (#62) — migrate TUI session/lessons store and code index from repo-relative paths to `os.UserConfigDir()` so they are never accidentally committed.
+- **AGENTS.md / README drift** — keep these files in sync with the actual binary after every subcommand/tool change.
+- **Branch protection note** — `main` now requires `CEO Audit (QUICK, grade≥B)` status check and `required_approving_review_count: 0` for the solo-maintainer workflow.
+
+## Docs & Process
+
+- Update `README.md` and `AGENTS.md` whenever a new subcommand or bundled skill lands.
+- Update `CHANGELOG.md` with every user-facing change in the same PR.
+- Keep `ECOSYSTEM.md` in sync with `registry.go` and `permission_defaults.go` (CI `ecosystem-sync.yml` enforces this).
+
+## Completed (latest)
+
+- ✅ Reorganize all bundled skills into category directories and rename to `skill-<category>-<name>`.
+- ✅ Add `github-skills/` category with 4 GitHub-focused skills.
+- ✅ Merge PR #138 into `main` and relax branch protection for solo workflow.
+- ✅ Save local WIP coverage/docs work to `coverage/save-local` branch.
+- ✅ Add global AGENTS.md rule banning destructive git commands (`git checkout`, `git reset`, etc.) without explicit permission.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,83 @@
 
 All notable changes to the SIN-Code unified binary will be documented in this file.
 
+## [Unreleased] - 2026-06-16
+
+### Added
+- **`internal/instinct/`** — continuous-learning subsystem (port of the
+  `continuous-learning-v2` homunculus model in a clean-room Go
+  reimplementation). Project-scoped + global Markdown-with-frontmatter
+  store, confidence 0.3–0.9, Reinforce/Contradict/Decay math with
+  `atomic.Value`-backed env-overridable tuning, heuristic + LLM-backed
+  extractors (with graceful fallback), cross-project promotion, cluster
+  evolution into Skill/Command/Agent proposals, and a system-prompt
+  block renderer that closes the learning loop. CLI: `sin instinct
+  status|projects|evolve|promote|prune|export|import|show|forget|history`.
+  Storage: `$SIN_INSTINCT_DIR | $XDG_DATA_HOME/sin-code/instinct |
+  ~/.local/share/sin-code/instinct`.
+- **`internal/hooklife/`** — native Go lifecycle-hook system (no Node
+  dependency). Phases: `PreToolUse`, `PostToolUse`, `Stop`,
+  `SessionStart`, `SessionEnd`, `PreCompact`, `UserPrompt`. `PreToolUse`
+  may `Block` (ECC exit-code-2 equivalent); other phases aggregate
+  warnings. Per-hook timeout, panic recovery. Built-in hooks:
+  `block-no-verify`, `config-protection`, `post-edit-format`,
+  `quality-gate` (against the real `verify.Gate`), `cost-tracker`,
+  `suggest-compact`. CLI: `sin hooks list|test`.
+- **`internal/assets/`** — harvested agent/command/skill loader with
+  schema validation (port of ECC CI validators, including unsafe-unicode
+  and duplicate detection), `Selector` for domain+keyword-based
+  ranking, and an `import` subcommand that harvests skills from a
+  vendored source repo with origin/license attribution. CLI:
+  `sin assets list|validate|show|import`.
+- **`internal/evalharness/`** — eval-driven development. `EvalSet` /
+  `Run` / `Result` types, pluggable `Scorer`s (exact, contains-all,
+  success-flag, LLM-judge, composite), per-case timeout, JSONL run
+  history, and `Compare` for case-by-case regression detection with
+  `--fail-on-regress` as a CI gate. CLI: `sin eval run|list|compare`.
+- **`internal/dispatch/`** — turns loaded command and agent assets
+  into executable actions. ECC-style placeholder substitution
+  (`$ARGUMENTS`, `$1..$9`, `$@`, `${flag}`), `Dispatcher` routes
+  slash-commands to `PromptSink` and agent requests to
+  `SubagentRunner`. Closes the load → select → dispatch → run
+  pipeline.
+- **`internal/prp/`** — Product Requirement Prompt workflow. Persistent
+  reviewable plans under `.sin/prp/<id>.md` driven through phases
+  (draft → planned → implementing → verifying → ready → shipped).
+  Each step persists, so a run is interruptible and resumable.
+  Verification failure kicks the PRP back to `implementing`. CLI:
+  `sin prp new|run|status|plan|implement|verify|pr`.
+- **`internal/adapters/`** — concrete adapters that implement the
+  abstract `hooklife.Verifier`, `instinct.MemorySink`, and
+  `instinct.Completer` interfaces against the real SIN-Code
+  subsystems (`verify.Gate`, `memory.Store`, `llm.Client`). Fail-soft:
+  missing subsystems degrade to no-ops, never block startup.
+- **`internal/learning/`** — bridge package between
+  `agentloop.Loop` and the new subsystems. `Learner` exposes
+  `BeforeTurn` (prepends active-instinct system block), `BeforeTool`
+  (PreToolUse dispatch, may veto), `AfterTool` (PostToolUse + observer
+  feed), `EndTurn` (observer flush), `PreCompact` (flush + hook
+  dispatch). Built once at startup via `learning.New(Options)`.
+- **`internal/wiring/`** — `Build(Deps)` assembles the full
+  `Bundle{Learner, Dispatch, Eval factory, PRP deps}` in one call.
+- **`examples/eval-sets/`** — `go-quality.json` (build, vet, test,
+  secrets scan) and `instinct-behavior.json` (end-to-end learning
+  loop validation).
+- **Five new top-level subcommands** wired into `cmd/sin-code/main.go`:
+  `sin instinct`, `sin hooks`, `sin assets`, `sin evalset`, `sin prp`.
+  (The existing `sin eval` — Golden-Dataset runner from issue #75 — is
+  preserved unchanged; the new harness lives at `sin evalset` to avoid
+  a cobra `Use:` collision.)
+
+### Notes
+- `go test -race` clean across all six new packages. No new third-party
+  dependencies (`gopkg.in/yaml.v3` was already transitively present in
+  `go.sum`).
+- The new systems are *additive* — they do not modify the existing
+  `internal/agentloop` package. The chat command can opt into the
+  learner by calling `learning.New(...)` and invoking the lifecycle
+  methods around its loop run; the default is "no learning wired" so
+  the chat behavior is unchanged for existing users.
+
 ## [v3.17.0] - 2026-06-13
 
 ### Added

diff --git a/README.md b/README.md
@@ -4,11 +4,11 @@
 
 [![test-gate](https://img.shields.io/badge/test--gate-passing-brightgreen)](#)
 [![ecosystem-sync](https://img.shields.io/badge/ecosystem--sync-passing-brightgreen)](#)
-[![version](https://img.shields.io/badge/version-v3.15.0-blue)](https://github.com/OpenSIN-Code/SIN-Code/releases)
+[![version](https://img.shields.io/badge/version-v3.17.0-blue)](https://github.com/OpenSIN-Code/SIN-Code/releases)
 
 ## Status
 
-- **Version**: [v3.15.0](https://github.com/OpenSIN-Code/SIN-Code/releases/tag/v3.15.0)
+- **Version**: [v3.17.0](https://github.com/OpenSIN-Code/SIN-Code/releases/tag/v3.17.0)
 - **Maturity**: Production
 - **Language**: Go (single static binary) + Python companion package
 - **Tests**: 200+ tests across Go and Python; `go test ./... -race -count=1` is the gate
@@ -50,7 +50,7 @@ swarm mode, skill bootstrapping, and methodology skills.
 ## MCP Integration
 
 - **MCP Server**: Go — `sin-code serve` (main binary, 44+ tools); Python legacy — `src/sin_code_bundle/mcp_server.py`
-- **Tools**: 39 subcommands, 12 ecosystem skill servers, and external MCP servers (websearch, browser, symfony-lens, etc.)
+- **Tools**: 39 subcommands, 34 bundled skills, 12 ecosystem skill servers, and external MCP servers (websearch, browser, symfony-lens, etc.)
 - **Register**: Add `sin-code serve` to your MCP client config (see `docs/mcp.json.example`), or register the legacy Python server via `sin mcp register sin-serve src/sin_code_bundle/mcp_server.py`
 
 ## Development
@@ -83,6 +83,33 @@ swarm mode, skill bootstrapping, and methodology skills.
 
 **Go-Native SCA (v3.15.0):** `sin security` now uses a native Go SCA client for Go projects, parsing `go.mod` and invoking `grype` JSON output directly.
 
+## Bundled Skills (v3.17.0)
+
+SIN-Code ships **34 bundled skills** embedded in the binary, installable via `sin-code skills list|install`. Skills are organized into category directories and follow a unified naming convention `skill-<category>-<name>`.
+
+```bash
+sin-code skills list          # list all bundled skills
+sin-code skills install skill-code-audit  # install a skill to ~/.config/opencode/skills
+```
+
+**Categories:**
+
+| Category | Example skills |
+|---|---|
+| `browser-skills` | `skill-browser-tools` |
+| `code-skills` | `skill-code-audit`, `skill-code-build`, `skill-code-codocs`, `skill-code-create`, `skill-code-docs`, `skill-code-mcp-builder`, `skill-code-plan`, `skill-code-refactor`, `skill-code-spec` |
+| `debug-skills` | `skill-debug-deep` |
+| `design-skills` | `skill-design-frontend`, `skill-design-image` |
+| `ecosystem-skills` | `skill-ecosystem-context`, `skill-ecosystem-marketplace` |
+| `github-skills` | `skill-github-account`, `skill-github-actions`, `skill-github-app`, `skill-github-governance` |
+| `infrastructure-skills` | `skill-infrastructure-cloudflare`, `skill-infrastructure-oci-vm`, `skill-infrastructure-supabase` |
+| `memory-skills` | `skill-memory-honcho`, `skill-memory-honcho-rollback`, `skill-memory-infisical` |
+| `planning-skills` | `skill-planning-enterprise` |
+| `process-skills` | `skill-process-goal`, `skill-process-grill`, `skill-process-scheduler` |
+| `shop-skills` | `skill-shop-cj-dropshipping`, `skill-shop-stripe`, `skill-shop-tiktok` |
+
+Each skill contains `SKILL.md`, `context/`, `frameworks/`, `tasks/`, `templates/`, and a `LICENSE` file. External skills copied from `Infra-SIN-OpenCode-Stack` are tagged with `lifecycle: external` and `sources` in their metadata.
+
 ## Quick Start
 
 ```bash

diff --git a/cmd/sin-code/internal/adapters/adapters.doc.md b/cmd/sin-code/internal/adapters/adapters.doc.md
@@ -0,0 +1,28 @@
+# adapters/ — concrete adapters to real SIN-Code packages
+
+Each file in this package owns one adapter. Together they implement
+the abstract interfaces declared by:
+
+- `internal/hooklife` (`Verifier`, `Ledger`, `TypeChecker`)
+- `internal/instinct` (`Completer`, `MemorySink`)
+
+## Wiring pattern
+
+The wiring layer (`internal/wiring`) constructs concrete adapters
+and passes them into the systems that need them. Production code in
+`cmd/sin-code` reads config / env, builds the LLM client, opens the
+memory + ledger + verify stores, and assembles the whole graph
+once at startup.
+
+## Fail-soft contract
+
+Adapters never panic. The instinct observer and the hook runner
+both already fail soft: a bad adapter call falls back to
+heuristics, an unconfigured adapter no-ops. This means a partially
+wired binary still works — it just runs the cheaper path.
+
+## Related files
+
+- `internal/wiring/` — the builder
+- `internal/hooklife/builtin.go` — the consumer of `Verifier` / `Ledger` / `TypeChecker`
+- `internal/instinct/manager.go` — the consumer of `MemorySink`
diff --git a/cmd/sin-code/internal/adapters/adapters.go b/cmd/sin-code/internal/adapters/adapters.go
@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: MIT
+// Purpose: concrete adapters that implement the abstract hooklife /
+// instinct interfaces against SIN-Code's real packages. Each file
+// in this package owns ONE adapter.
+// Docs: adapters.doc.md
+package adapters
+
+import (
+	"context"
+	"strings"
+
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/llm"
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/memory"
+	"github.com/OpenSIN-Code/SIN-Code/cmd/sin-code/internal/verify"
+)
+
+// VerifyGate adapts the real verify.Gate to the hooklife.Verifier
+// interface. Uses the gate's Run(ctx, workdir) -> Result contract
+// (passed bool, report string, err error).
+type VerifyGate struct {
+	Gate *verify.Gate
+}
+
+// QualityGate implements hooklife.Verifier.
+func (a VerifyGate) QualityGate(ctx context.Context, workdir string) (bool, string, error) {
+	if a.Gate == nil {
+		return true, "", nil
+	}
+	res := a.Gate.Run(ctx, workdir)
+	return res.Passed, res.Report, nil
+}
+
+// MemoryBridge adapts the real memory.Store to the
+// instinct.MemorySink interface. Each instinct observation is
+// stored as a Memory{Insight, Tags=[domain]}.
+type MemoryBridge struct {
+	Store *memory.Store
+}
+
+// RecordInstinct implements instinct.MemorySink.
+func (b MemoryBridge) RecordInstinct(_ context.Context, trigger, action, domain string, confidence float64) error {
+	if b.Store == nil {
+		return nil
+	}
+	return b.Store.Add(&memory.Memory{
+		Insight: "instinct: " + trigger + " -> " + action,
+		Tags:    []string{"instinct", domain, "confidence:" + ftoa2(confidence)},
+	})
+}
+
+// BackgroundCompleter adapts the LLM client to instinct.Completer.
+// Uses the supplied cheap model alias (e.g. an Anthropic Haiku
+// alias) for mining.
+type BackgroundCompleter struct {
+	Client *llm.Client
+	Model  string
+}
+
+// Complete implements instinct.Completer. Never returns an error —
+// the LLMExtractor falls back to the heuristic pass on any failure.
+func (c BackgroundCompleter) Complete(ctx context.Context, system, user string) (string, error) {
+	if c.Client == nil {
+		return "", nil
+	}
+	model := c.Model
+	if model == "" {
+		model = "anthropic/claude-haiku-4-5"
+	}
+	resp, err := c.Client.Chat(ctx, llm.ChatRequest{
+		Model: model,
+		Messages: []llm.Message{
+			{Role: "system", Content: system},
+			{Role: "user", Content: user},
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.ExtractText(), nil
+}
+
+func ftoa2(f float64) string {
+	// 2-decimal float → "0.45" / "0.90"
+	whole := int(f)
+	frac := int((f-float64(whole))*100+0.5) * 1
+	if frac < 0 {
+		frac = -frac
+	}
+	s := intToStr(frac)
+	if len(s) < 2 {
+		s = "0" + s
+	}
+	return intToStr(whole) + "." + s
+}
+
+func intToStr(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	neg := n < 0
+	if neg {
+		n = -n
+	}
+	var b [20]byte
+	i := len(b)
+	for n > 0 {
+		i--
+		b[i] = byte('0' + n%10)
+		n /= 10
+	}
+	if neg {
+		i--
+		b[i] = '-'
+	}
+	return string(b[i:])
+}
+
+// containsAny is a small helper used by tests and adapters alike.
+func containsAny(s string, subs ...string) bool {
+	for _, sub := range subs {
+		if strings.Contains(s, sub) {
+			return true
+		}
+	}
+	return false
+}