Phase 1/2 orchestration groundwork: guard hook, worker roster, corrections ledger, docs manifest

[WilfordGrimley]

Description

Phase 1/2 of the repo-orchestration commission: committed hooks + a scrubbed public worker roster + a corrections ledger + a docs routing manifest.

• .claude/settings.json: wires two hooks.
  • guard_master.py (PreToolUse): gh pr merge / git merge into master blocked unconditionally, everywhere (owner-only actions, no legitimate solo-workflow exception — git merge --ff-only is exempted as a sync, not a merge decision). git push to master blocked only from worker worktree checkouts (.claude/worktrees/) — the main checkout's interactive push-to-master convention is untouched. Every deny appends a stub to corrections/.pending-stubs.jsonl.
  • session_context.sh (SessionStart): injects live branch/commit/CI/open-PR state. Uses git remote get-url origin (not gh repo view/gh pr list's default, which resolve to the upstream parent repo) and the Checks API (not the legacy Status API, which silently hides Actions failures).
• .claude/agents/worker-{backend,frontend,docs,upstream}.md: four scrubbed, public specialist agent definitions (tight tool allowlist, isolation: worktree, model: sonnet).
• docs/reports/schema.json: tiered (summary/detail) structured mirror of the six-field standing report format.
• corrections/: blameless CORR-NNNN incident ledger, seeded with 7 entries from this week's real history (2 pre-existing repo incidents researched and verified against git history, 5 caught live while building this branch — including a real false-positive bug in guard_master.py's own regex, found and fixed with regression tests).
• docs/MANIFEST.md: a routing table (path/purpose/governs-what-surface/authority) over docs/.
• .gitignore: carved explicit exceptions into the blanket /.claude/ ignore so any of the above could be tracked at all.
• docs/infrastructure.md: documents the branch-protection trade-off (a real backstop requires no admin-bypass, which removes push-straight-to-master for the owner too) — described, not applied.

Not included: branch protection itself (owner's to click), the constitution document (routed to a private repo, not yet created), and the GitHub-issues task-ledger migration (explicitly sequenced for later).

Checklist

• I have installed pre-commit and installed the hooks with pre-commit install before creating any commits.
• I have updated any related tests for code I modified or added new tests where appropriate. (.claude/hooks/test_guard_master.py, 17 fault-injection cases, all passing.)
• I have manually tested my changes as follows:
  • Ran .claude/hooks/test_guard_master.py directly (17/17 pass) after every change, including two regression cases added after a real bug (git merge-base false-positive) was caught mid-session.
  • Ran session_context.sh directly against this repo's live state and confirmed it correctly reports the actual PR list and actual CI state (catching two bugs in the process — see corrections/CORR-0005 and CORR-0006).
  • Spawned a real subagent (worktree-isolated) instructed to follow worker-backend.md's conventions on a real task, confirming worktree isolation and report format work end-to-end (full native-registry + harness-level-allowlist-enforcement proof still needs a fresh session — not yet done).
• I have updated any relevant documentation or created new documentation where appropriate.