Promote Develop to Main: Settle Three Disagreeing Hub Sources

.agents/skills/agent-conduct/SKILL.md

@@ -38,7 +38,7 @@ Claims about a pull request being reviewed, clean, or mergeable are owned by the
 ## When a Failure Surfaces a Lesson
 
 - **Durable knowledge lands in the committed docs, not in agent memory**, as part of the change that surfaced it, per `GOVERNANCE.md` "Durable Knowledge and Self-Improvement". Memory does not survive a new session or machine, so it holds only environment nuance and in-flight state.
-- **Where the governing doc is carried from the hub, file the finding against `ptr727/ProjectTemplate`** rather than only patching it locally. A local fix leaves every sibling repo with the same trap. Search open and closed issues first, then update the matching issue or file a new one.
+- **Where the governing doc is carried from the hub, file the finding against `ptr727/ProjectTemplate`.** Patching the local copy leaves every sibling repo with the same trap. Search open and closed issues first, then update the matching issue or file a new one.
 - **A review flags an instance, so fix the class**: sweep for the siblings before replying, because reviewers sample rather than enumerate.
 - **A rule that keeps needing restating** is usually a stale or missing skills install, so run `python3 scripts/skills_install.py --report` from a hub checkout (the `fleet-conformance-check` skill) before concluding the rule does not exist.
 

.agents/skills/dotnet-codestyle/SKILL.md

@@ -49,8 +49,14 @@ All builds must complete without warnings, enforced three ways:
   surfaced as a warning fails the build and must be fixed or deliberately suppressed at the
   narrowest scope that fits (see Analyzer suppressions below), never left to accumulate.
 - **CI lint backstop.** CI runs the clean-compile checks on every PR as the authoritative gate.
-  The .NET mechanism for a local hook is Husky.Net, wired from the canonical
-  `catalog/snippets/husky/` config in the hub, hub-local and not carried into every fleet repo.
+  Husky.Net is wired from the canonical `catalog/snippets/husky/` config in the hub, hub-local
+  and not carried into every fleet repo. Its hook needs a .NET tool manifest declaring
+  Husky.Net, which the snippet does not ship. A repo keeping no such manifest takes the other
+  canonical shape, `catalog/snippets/pre-commit/`, and so does a repo that simply prefers the
+  `pre-commit` framework. Each shape carries whichever language checks its own repo keeps. A repo may also wire an equivalent hook of its own at `.husky/pre-commit`,
+  enabled with `core.hooksPath` and sourcing nothing, since the husky snippet's own hook sources
+  a file only `dotnet husky install` generates. That path and `.pre-commit-config.yaml` are the
+  two the audit reads.
   GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section
   carries the obligation itself, what the hook must cover, its audit treatment, and the
   per-clone enablement steps.
@@ -81,7 +87,7 @@ in place.
 ### Build tasks
 
 Run these from VS Code's task runner (Terminal -> Run Task) or an agent's task-running tool. The
-three clean-compile tasks are carried verbatim, and a repo adds its own convenience tasks (tool
+three clean-compile tasks are carried unchanged, and a repo adds its own convenience tasks (tool
 updates, dependency upgrades, benchmarks) on top:
 
 - `.NET Build`: build with diagnostic verbosity *(clean-compile)*
@@ -97,9 +103,12 @@ updates, dependency upgrades, benchmarks) on top:
   `dotnet format style --verify-no-changes --severity=info --verbosity=detailed`.
 - **`dotnet-outdated-tool`** checks for dependency updates, and Nerdbank.GitVersioning owns
   version management.
-- CI is the authoritative lint backstop. The .NET mechanism for a local pre-commit hook is
-  Husky.Net, wired from `catalog/snippets/husky/` in the hub, hub-local and not carried into every
-  fleet repo, and covering the shared doc gates alongside the language checks.
+- CI is the authoritative lint backstop. A repo already keeping a .NET tool manifest declaring
+  Husky.Net wires its local pre-commit hook from `catalog/snippets/husky/` in the hub, hub-local
+  and not carried into every fleet repo. A repo keeping none, or one preferring the `pre-commit`
+  framework, takes `catalog/snippets/pre-commit/` instead. Either shape covers the shared doc
+  gates alongside the language checks. Each snippet's own README names the per-clone steps and
+  the second file to copy alongside it.
 - **Required VS Code extensions**: CSharpier, markdownlint, CSpell. Use the workspace settings
   without overrides.
 

.agents/skills/python-codestyle/SKILL.md

@@ -96,9 +96,15 @@ those. These are documented commands, and the hub's `vscode-tasks-python.json` s
 VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is
 `type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror
 runs the same on any task shell. CI runs the same clean-compile commands as the authoritative
-backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the
-canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet
-repo. That directory's own README names the second file to copy alongside the config.
+backstop. A repo that keeps no .NET tool manifest declaring Husky.Net, or one that prefers the
+`pre-commit` framework, wires its local hook from the canonical `catalog/snippets/pre-commit/` directory,
+hub-local and not carried into every fleet repo. Any repo may instead wire an equivalent hook of
+its own at `.husky/pre-commit`, enabled with `core.hooksPath` and sourcing nothing. That path and
+`.pre-commit-config.yaml` are the two the audit reads. The runner is bounded by the toolchain the
+repo already keeps rather than by the languages the hook checks, so a repo keeping a Husky.Net
+manifest may run these same Python checks from the `catalog/snippets/husky/` shape instead. Each
+shape carries whichever language checks its own repo keeps. The `pre-commit` directory's own
+README names the second file to copy alongside the config.
 GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries
 the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement
 steps.

.claude-plugin/fleet-skills/.source-digest

@@ -1 +1 @@
-fe834763b58313f7
+a7bfc794d16c14d0

.claude-plugin/fleet-skills/skills/agent-conduct/SKILL.md

@@ -38,7 +38,7 @@ Claims about a pull request being reviewed, clean, or mergeable are owned by the
 ## When a Failure Surfaces a Lesson
 
 - **Durable knowledge lands in the committed docs, not in agent memory**, as part of the change that surfaced it, per `GOVERNANCE.md` "Durable Knowledge and Self-Improvement". Memory does not survive a new session or machine, so it holds only environment nuance and in-flight state.
-- **Where the governing doc is carried from the hub, file the finding against `ptr727/ProjectTemplate`** rather than only patching it locally. A local fix leaves every sibling repo with the same trap. Search open and closed issues first, then update the matching issue or file a new one.
+- **Where the governing doc is carried from the hub, file the finding against `ptr727/ProjectTemplate`.** Patching the local copy leaves every sibling repo with the same trap. Search open and closed issues first, then update the matching issue or file a new one.
 - **A review flags an instance, so fix the class**: sweep for the siblings before replying, because reviewers sample rather than enumerate.
 - **A rule that keeps needing restating** is usually a stale or missing skills install, so run `python3 scripts/skills_install.py --report` from a hub checkout (the `fleet-conformance-check` skill) before concluding the rule does not exist.
 

.claude-plugin/fleet-skills/skills/dotnet-codestyle/SKILL.md

@@ -49,8 +49,14 @@ All builds must complete without warnings, enforced three ways:
   surfaced as a warning fails the build and must be fixed or deliberately suppressed at the
   narrowest scope that fits (see Analyzer suppressions below), never left to accumulate.
 - **CI lint backstop.** CI runs the clean-compile checks on every PR as the authoritative gate.
-  The .NET mechanism for a local hook is Husky.Net, wired from the canonical
-  `catalog/snippets/husky/` config in the hub, hub-local and not carried into every fleet repo.
+  Husky.Net is wired from the canonical `catalog/snippets/husky/` config in the hub, hub-local
+  and not carried into every fleet repo. Its hook needs a .NET tool manifest declaring
+  Husky.Net, which the snippet does not ship. A repo keeping no such manifest takes the other
+  canonical shape, `catalog/snippets/pre-commit/`, and so does a repo that simply prefers the
+  `pre-commit` framework. Each shape carries whichever language checks its own repo keeps. A repo may also wire an equivalent hook of its own at `.husky/pre-commit`,
+  enabled with `core.hooksPath` and sourcing nothing, since the husky snippet's own hook sources
+  a file only `dotnet husky install` generates. That path and `.pre-commit-config.yaml` are the
+  two the audit reads.
   GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section
   carries the obligation itself, what the hook must cover, its audit treatment, and the
   per-clone enablement steps.
@@ -81,7 +87,7 @@ in place.
 ### Build tasks
 
 Run these from VS Code's task runner (Terminal -> Run Task) or an agent's task-running tool. The
-three clean-compile tasks are carried verbatim, and a repo adds its own convenience tasks (tool
+three clean-compile tasks are carried unchanged, and a repo adds its own convenience tasks (tool
 updates, dependency upgrades, benchmarks) on top:
 
 - `.NET Build`: build with diagnostic verbosity *(clean-compile)*
@@ -97,9 +103,12 @@ updates, dependency upgrades, benchmarks) on top:
   `dotnet format style --verify-no-changes --severity=info --verbosity=detailed`.
 - **`dotnet-outdated-tool`** checks for dependency updates, and Nerdbank.GitVersioning owns
   version management.
-- CI is the authoritative lint backstop. The .NET mechanism for a local pre-commit hook is
-  Husky.Net, wired from `catalog/snippets/husky/` in the hub, hub-local and not carried into every
-  fleet repo, and covering the shared doc gates alongside the language checks.
+- CI is the authoritative lint backstop. A repo already keeping a .NET tool manifest declaring
+  Husky.Net wires its local pre-commit hook from `catalog/snippets/husky/` in the hub, hub-local
+  and not carried into every fleet repo. A repo keeping none, or one preferring the `pre-commit`
+  framework, takes `catalog/snippets/pre-commit/` instead. Either shape covers the shared doc
+  gates alongside the language checks. Each snippet's own README names the per-clone steps and
+  the second file to copy alongside it.
 - **Required VS Code extensions**: CSharpier, markdownlint, CSpell. Use the workspace settings
   without overrides.
 

.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md

@@ -96,9 +96,15 @@ those. These are documented commands, and the hub's `vscode-tasks-python.json` s
 VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is
 `type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror
 runs the same on any task shell. CI runs the same clean-compile commands as the authoritative
-backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the
-canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet
-repo. That directory's own README names the second file to copy alongside the config.
+backstop. A repo that keeps no .NET tool manifest declaring Husky.Net, or one that prefers the
+`pre-commit` framework, wires its local hook from the canonical `catalog/snippets/pre-commit/` directory,
+hub-local and not carried into every fleet repo. Any repo may instead wire an equivalent hook of
+its own at `.husky/pre-commit`, enabled with `core.hooksPath` and sourcing nothing. That path and
+`.pre-commit-config.yaml` are the two the audit reads. The runner is bounded by the toolchain the
+repo already keeps rather than by the languages the hook checks, so a repo keeping a Husky.Net
+manifest may run these same Python checks from the `catalog/snippets/husky/` shape instead. Each
+shape carries whichever language checks its own repo keeps. The `pre-commit` directory's own
+README names the second file to copy alongside the config.
 GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries
 the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement
 steps.

.github/copilot-instructions.md

@@ -22,8 +22,7 @@ put a release-bump magnitude in the title. The full contract is in
 
 Follow the fidelity declared for the file. A byte-locked reference to shared infrastructure that
 this repository does not carry is intentional, not a broken link. Raise substantive defects in
-canonical content, but locate the fix at its canonical source instead of proposing a local edit
-that its fidelity rejects.
+canonical content, but locate the fix at its canonical source instead of proposing a local edit.
 
 ## GitHub Copilot Review Runbook
 

.github/skills/agent-conduct/SKILL.md

@@ -38,7 +38,7 @@ Claims about a pull request being reviewed, clean, or mergeable are owned by the
 ## When a Failure Surfaces a Lesson
 
 - **Durable knowledge lands in the committed docs, not in agent memory**, as part of the change that surfaced it, per `GOVERNANCE.md` "Durable Knowledge and Self-Improvement". Memory does not survive a new session or machine, so it holds only environment nuance and in-flight state.
-- **Where the governing doc is carried from the hub, file the finding against `ptr727/ProjectTemplate`** rather than only patching it locally. A local fix leaves every sibling repo with the same trap. Search open and closed issues first, then update the matching issue or file a new one.
+- **Where the governing doc is carried from the hub, file the finding against `ptr727/ProjectTemplate`.** Patching the local copy leaves every sibling repo with the same trap. Search open and closed issues first, then update the matching issue or file a new one.
 - **A review flags an instance, so fix the class**: sweep for the siblings before replying, because reviewers sample rather than enumerate.
 - **A rule that keeps needing restating** is usually a stale or missing skills install, so run `python3 scripts/skills_install.py --report` from a hub checkout (the `fleet-conformance-check` skill) before concluding the rule does not exist.
 

.github/skills/dotnet-codestyle/SKILL.md

@@ -49,8 +49,14 @@ All builds must complete without warnings, enforced three ways:
   surfaced as a warning fails the build and must be fixed or deliberately suppressed at the
   narrowest scope that fits (see Analyzer suppressions below), never left to accumulate.
 - **CI lint backstop.** CI runs the clean-compile checks on every PR as the authoritative gate.
-  The .NET mechanism for a local hook is Husky.Net, wired from the canonical
-  `catalog/snippets/husky/` config in the hub, hub-local and not carried into every fleet repo.
+  Husky.Net is wired from the canonical `catalog/snippets/husky/` config in the hub, hub-local
+  and not carried into every fleet repo. Its hook needs a .NET tool manifest declaring
+  Husky.Net, which the snippet does not ship. A repo keeping no such manifest takes the other
+  canonical shape, `catalog/snippets/pre-commit/`, and so does a repo that simply prefers the
+  `pre-commit` framework. Each shape carries whichever language checks its own repo keeps. A repo may also wire an equivalent hook of its own at `.husky/pre-commit`,
+  enabled with `core.hooksPath` and sourcing nothing, since the husky snippet's own hook sources
+  a file only `dotnet husky install` generates. That path and `.pre-commit-config.yaml` are the
+  two the audit reads.
   GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section
   carries the obligation itself, what the hook must cover, its audit treatment, and the
   per-clone enablement steps.
@@ -81,7 +87,7 @@ in place.
 ### Build tasks
 
 Run these from VS Code's task runner (Terminal -> Run Task) or an agent's task-running tool. The
-three clean-compile tasks are carried verbatim, and a repo adds its own convenience tasks (tool
+three clean-compile tasks are carried unchanged, and a repo adds its own convenience tasks (tool
 updates, dependency upgrades, benchmarks) on top:
 
 - `.NET Build`: build with diagnostic verbosity *(clean-compile)*
@@ -97,9 +103,12 @@ updates, dependency upgrades, benchmarks) on top:
   `dotnet format style --verify-no-changes --severity=info --verbosity=detailed`.
 - **`dotnet-outdated-tool`** checks for dependency updates, and Nerdbank.GitVersioning owns
   version management.
-- CI is the authoritative lint backstop. The .NET mechanism for a local pre-commit hook is
-  Husky.Net, wired from `catalog/snippets/husky/` in the hub, hub-local and not carried into every
-  fleet repo, and covering the shared doc gates alongside the language checks.
+- CI is the authoritative lint backstop. A repo already keeping a .NET tool manifest declaring
+  Husky.Net wires its local pre-commit hook from `catalog/snippets/husky/` in the hub, hub-local
+  and not carried into every fleet repo. A repo keeping none, or one preferring the `pre-commit`
+  framework, takes `catalog/snippets/pre-commit/` instead. Either shape covers the shared doc
+  gates alongside the language checks. Each snippet's own README names the per-clone steps and
+  the second file to copy alongside it.
 - **Required VS Code extensions**: CSharpier, markdownlint, CSpell. Use the workspace settings
   without overrides.
 

.github/skills/python-codestyle/SKILL.md

@@ -96,9 +96,15 @@ those. These are documented commands, and the hub's `vscode-tasks-python.json` s
 VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is
 `type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror
 runs the same on any task shell. CI runs the same clean-compile commands as the authoritative
-backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the
-canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet
-repo. That directory's own README names the second file to copy alongside the config.
+backstop. A repo that keeps no .NET tool manifest declaring Husky.Net, or one that prefers the
+`pre-commit` framework, wires its local hook from the canonical `catalog/snippets/pre-commit/` directory,
+hub-local and not carried into every fleet repo. Any repo may instead wire an equivalent hook of
+its own at `.husky/pre-commit`, enabled with `core.hooksPath` and sourcing nothing. That path and
+`.pre-commit-config.yaml` are the two the audit reads. The runner is bounded by the toolchain the
+repo already keeps rather than by the languages the hook checks, so a repo keeping a Husky.Net
+manifest may run these same Python checks from the `catalog/snippets/husky/` shape instead. Each
+shape carries whichever language checks its own repo keeps. The `pre-commit` directory's own
+README names the second file to copy alongside the config.
 GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries
 the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement
 steps.

.github/workflows/deploy-site-task.yml

@@ -27,7 +27,7 @@ on:
         required: true
         type: string
     secrets:
-      # The one credential that crosses this reusable workflow's boundary as a named secret.
+      # The credentials that cross this reusable workflow's boundary as named secrets.
       # The host address, the user, and the known-hosts value are GitHub Environment variables instead, since they are integrity-critical but not confidential.
       # The deploy job below reads them directly through its own environment binding.
       DEPLOY_SSH_PRIVATE_KEY: