From 1bdf754fb342d57d83a07f7e9e82581dd2c80a47 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 09:14:04 -0400
Subject: [PATCH 01/10] docs(claude-ops): record the machine-profile rulings

Refs: #4666

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 ...e-machine-profile-as-a-claude-ops-skill.md | 13 ++-
 docs/out-of-scope/machine-profile.md          | 86 ++++---------------
 docs/specs/machine-profile-design.md          | 43 ++++------
 3 files changed, 44 insertions(+), 98 deletions(-)

diff --git a/docs/adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md b/docs/adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md
index f9ccd6d570..1f788fc50b 100644
--- a/docs/adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md
+++ b/docs/adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md
@@ -1,6 +1,6 @@
 # Place the machine profile as a claude-ops skill
 
-- Status: accepted for the placement only
+- Status: accepted
 - Date: 2026-09-29
 
 ## Context
@@ -38,12 +38,11 @@ Place the profile as a skill in `claude-ops`, not as a new plugin.
 
 ## Status scope
 
-Accepted for the placement only. The invocation-mode change (class (ii) and the hidden `setup`
-skills) and any change to the setup contract stay deferred to the owner's later decision on the
-design document. This record does not authorize the skill, its scripts, or a version bump.
+Accepted. The skill, its scripts, its tests and the `claude-ops` version bump are authorized. The
+invocation-mode change (class (ii) and the hidden `setup` skills) and any change to the setup
+contract are not part of this decision.
 
 ## Consequences
 
-The skill's directory is under `plugins/claude-ops/skills/`. Whether its scope is too broad for
-`claude-ops` is the owner's call on the design document; if the owner chooses a new plugin, this
-record is superseded.
+The skill's directory is under `plugins/claude-ops/skills/`. A move to a new plugin would
+supersede this record.
diff --git a/docs/out-of-scope/machine-profile.md b/docs/out-of-scope/machine-profile.md
index e0b4bb1ab2..2961f2a3b4 100644
--- a/docs/out-of-scope/machine-profile.md
+++ b/docs/out-of-scope/machine-profile.md
@@ -1,80 +1,32 @@
 # Re-runnable machine profile for setup skills
 
 Record for
-[#4666](https://github.com/melodic-software/claude-code-plugins/issues/4666),
-a proposed host-fact store that would drive every plugin `setup` skill.
-
-Status: unratified agent proposal. The placement is accepted under
-[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md); the owner has not ruled
-on whether to build it or on any setup-contract change, and #4666 is open for that decision. Until
-then it is not a settled rejection.
+[#4666](https://github.com/melodic-software/claude-code-plugins/issues/4666).
 
 ## Decision
 
-**Superseded in part.** The design is now
-[machine-profile-design](../specs/machine-profile-design.md) and the placement is
-[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md): a skill in
-`claude-ops`. Building the skill and any setup-contract or invocation-mode change stay
-undecided until the owner rules on that design. Until then, no `machine-profile` skill
-exists, no new plugin is added, and the rest of this record stands.
-
-- **Option 1 (declined):** orchestrate by instruction. The profile would emit
-  `/<plugin>:setup check` lines for the operator to type. That respects class
-  (ii) and is unpaid operator cost, not a skill to ship.
-- **Option 2 (declined):** split `check` from `apply` so `check` is
-  model-invocable. The per-plugin form shipped in `actionlint`, `biome-format`,
-  `context7`, `go-format` and `markdown-format` (a separate model-invocable `check`
-  skill beside the manual `setup`) with no invocation-mode amendment; the class list in
-  `docs/conventions/invocation-mode/README.md` is still three. Whether to keep that
-  per-plugin split is an open owner question,
-  [#4240](https://github.com/melodic-software/claude-code-plugins/issues/4240) question 2.
-- **Option 3 (declined):** relax `disable-model-invocation` on `check` only.
-  Same effect as option 2 with less structure.
+The design is ratified: [machine-profile-design](../specs/machine-profile-design.md), placed as a
+`claude-ops` skill by
+[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md). The skill is built as
+`claude-ops` `machine-profile`. Only the following stays rejected or held:
 
-**Claim (original park, before the design document):** a re-runnable machine profile that discovers host facts once and
-drives the fleet's setup skills has no model-invocable path to them: all 58
-plugin `setup` skills are `disable-model-invocation: true`, which
-`scripts/validate-plugin-contracts.mjs` requires. The model-invocable host
-checks are `actionlint:check`, `biome-format:check`, `context7:check`,
-`go-format:check` and `markdown-format:check` (one per plugin) and
-`claude-ops:prerequisites`, a read-only report over the `prerequisites.json`
-that 7 plugins declare. Host discovery stays inside each plugin's `setup`. If the idea returns, it is a `claude-ops` skill that feeds
-`machine-health`'s declared-configuration drift check, never a second
-host-fact store.
-**Basis:** origin/main: 58 plugin-level `plugins/*/skills/setup/SKILL.md`
-files, all `disable-model-invocation: true`, required at
-`scripts/validate-plugin-contracts.mjs:189-190`. The `check` skill of each of
-those five plugins and `plugins/claude-ops/skills/prerequisites/SKILL.md`
-set `disable-model-invocation: false`. `docs/conventions/invocation-mode/README.md`
-still lists three classes, class (ii) among them, and the invocation-reach
-invariant (a `true` skill cannot be invoked by any other skill). No
-`machine-profile` skill or plugin under `plugins/`. `machine-health` already
-owns a `config` category for declared-configuration drift.
-**As of:** 2026-09-29.
-**Recheck:** a setup skill drops `disable-model-invocation: true`
-(`git grep -L 'disable-model-invocation: true' -- 'plugins/*/skills/setup/SKILL.md'`
-lists a file; it lists none today), or a maintainer funds a `claude-ops` skill
-whose only job is a read-only host-fact document that `machine-health`
-consumes.
+- **Setup contract change (declined):** no setup skill is changed and
+  `validate-plugin-contracts.mjs` is untouched.
+- **Invocation-mode class (ii) change (held):** the setup skills stay
+  `disable-model-invocation: true`. Splitting `check` from `apply`, relaxing the flag on `check`,
+  or adding a class would each be a fleet contract change across every `setup` skill. The profile
+  relies on reproduction and relay instead.
+- **Orchestration by instruction (declined):** the profile does not emit `/<plugin>:setup check`
+  lines for the operator to type.
 
 ## Rationale
 
-- Naive orchestration is impossible today: every setup skill is model-hidden.
-- Option 3 changes the contract `validate-plugin-contracts.mjs` enforces on all
-  58 setup skills. Option 2 adds a `check` skill to each setup plugin that
-  lacks one. Neither is a claude-ops slice.
-- A parallel host-fact document would compete with `machine-health` instead of
-  feeding it.
-- Per-plugin setup already owns prerequisite logic and versions with the
-  plugin. Absorbing that into one driver is the gotcha the issue named.
+- Every setup skill is model-hidden, so the profile cannot drive them directly.
+- Changing class (ii) is a fleet contract change, not a `claude-ops` slice.
+- Per-plugin setup owns prerequisite logic and versions with the plugin; the profile reads host
+  facts and does not absorb that logic.
 
 ## Revisit when
 
-- a `setup` skill becomes model-invocable (the Recheck condition above), or
-- the owner rules on the check/setup split in #4240 (question 2), or
-- an operator go names a read-only host-fact document with no setup-skill
-  orchestration.
-
-## Prior requests
-
-- #4666 (2026-09-28): wayfind design item; parked here. Coordinated with #4240.
+The built profile shows a check that the existing wrappers and reproduction cannot cover. The
+class (ii) decision is tracked with #4240.
diff --git a/docs/specs/machine-profile-design.md b/docs/specs/machine-profile-design.md
index 86d07fb3ef..7556f2bb42 100644
--- a/docs/specs/machine-profile-design.md
+++ b/docs/specs/machine-profile-design.md
@@ -3,7 +3,8 @@
 Design for a re-runnable machine profile that discovers host facts once, stores them, and hands
 each plugin's `setup` the answers. Tracked by
 [#4666](https://github.com/melodic-software/claude-code-plugins/issues/4666). This document
-records design only: it changes no setup contract, no invocation-mode class, and no plugin.
+records the design and its rulings. The build adds a `claude-ops` skill and changes no setup
+contract and no invocation-mode class.
 
 ## Contents
 
@@ -15,9 +16,9 @@ records design only: it changes no setup contract, no invocation-mode class, and
 - [Manual-change policy](#manual-change-policy)
 - [Reuse and machine-health](#reuse-and-machine-health)
 - [Placement](#placement)
-- [Out of scope until the later decision](#out-of-scope-until-the-later-decision)
+- [Out of scope](#out-of-scope)
 - [Acceptance criteria left for the build](#acceptance-criteria-left-for-the-build)
-- [Open questions](#open-questions)
+- [Rulings](#rulings)
 - [Verification record](#verification-record)
 
 ## Problem
@@ -236,20 +237,18 @@ profile's `diff` is the only consumer.
 **Recommendation: a skill in `claude-ops`, not a new plugin.**
 **Basis:** `claude-ops` already owns fleet state and ships `prerequisites` and `inventory`, the two
 skills the profile reads; a new plugin would add a third owner of host facts beside
-`machine-health`. Judgment on the remaining half: whether the skill's scope is too broad for
-`claude-ops` stays with the owner when ruling on this document. The decision is recorded in
+`machine-health`. The owner ratified the placement. The decision is recorded in
 [ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md).
 
-## Out of scope until the later decision
+## Out of scope
 
-Held for the owner's later ruling on this document:
+Not part of the build:
 
 - Any change to the setup contract, and any change to `validate-plugin-contracts.mjs`.
 - Amending invocation-mode class (ii) or adding a class, and any change to a `setup` skill's
   `disable-model-invocation` value.
 - Adding a model-invocable `check` skill for a plugin that lacks one.
-- Version bumps and CHANGELOG entries for any touched plugin.
-- The skill itself, its scripts, and its tests.
+- Version bumps and CHANGELOG entries for any plugin other than `claude-ops`.
 
 ## Acceptance criteria left for the build
 
@@ -268,21 +267,17 @@ tree under a scratch `HOME` and no real-host specifics:
   `npm view ctx7 version` writes `.npm/_logs` and an update-notifier marker under `HOME`. Test:
   hash both trees before and after. `apply` writes nothing without an explicit confirm.
 
-## Open questions
-
-Each is for the later decision on this document. Placement is settled by
-[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md) and is not open here.
-
-1. **Class (ii).** Amend class (ii), add a class, or leave the setup skills hidden and rely on
-   reproduction. Recommendation: leave them hidden until the profile is built and shows a check the
-   wrappers and reproduction cannot cover. Unblocks: whether the fleet contract change happens at
-   all.
-2. **Keying deviation.** Ratify a non-project-keyed machine section under plugin-data-report-keying.
-   Recommendation: ratify, with per-domain sections keyed by tree. Unblocks: the store's path scheme.
-3. **The machine-health feed.** Whether machine-health ships a `config` check that reads the
-   profile, or the profile's `diff` stays the only consumer. Recommendation: ship the check only
-   once the profile exists and runs on an OS whose machine-health checks are implemented. Unblocks: the handoff
-   contract.
+## Rulings
+
+Placement is settled by
+[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md).
+
+1. **Class (ii).** The setup skills stay hidden and class (ii) is unchanged. The profile relies on
+   reproduction and relay.
+2. **Keying deviation.** A non-project-keyed machine section is ratified under
+   plugin-data-report-keying, with per-domain sections keyed by tree.
+3. **The machine-health feed.** The machine-health `config` check is deferred until the profile
+   exists and runs on an OS whose machine-health checks are implemented.
 
 ## Verification record
 

From ea5df9298aa1d234aaf9a0b9ce79af411497ca19 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 09:24:08 -0400
Subject: [PATCH 02/10] feat(claude-ops): add the machine-profile skill

Discovers host facts and per-tree identity domains read-only, validates and
stores them behind a confirm, diffs the stored document with the host, and
prints the values to hand to each setup without writing anything itself.

Refs: #4666

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../skills/machine-profile/SKILL.md           |  67 +++
 .../skills/machine-profile/evals/evals.json   |  57 +++
 .../skills/machine-profile/scripts/profile.sh | 385 ++++++++++++++++++
 .../machine-profile/scripts/profile.test.sh   | 207 ++++++++++
 .../claude-ops/skills/prerequisites/SKILL.md  |   1 +
 5 files changed, 717 insertions(+)
 create mode 100644 plugins/claude-ops/skills/machine-profile/SKILL.md
 create mode 100644 plugins/claude-ops/skills/machine-profile/evals/evals.json
 create mode 100755 plugins/claude-ops/skills/machine-profile/scripts/profile.sh
 create mode 100755 plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh

diff --git a/plugins/claude-ops/skills/machine-profile/SKILL.md b/plugins/claude-ops/skills/machine-profile/SKILL.md
new file mode 100644
index 0000000000..02be9d6120
--- /dev/null
+++ b/plugins/claude-ops/skills/machine-profile/SKILL.md
@@ -0,0 +1,67 @@
+---
+description: "Discovers this machine's facts and identity domains, stores them as a re-runnable profile, and reports drift between the stored profile and the host now. Read-only unless the operator confirms a write. Use when: 'machine profile', 'profile this machine', 'what does this host have configured', 'has this machine changed', 'diff my machine profile', 'which identity domains exist here', 'hand my machine facts to setup'. Never installs and never reapplies a stored value on its own."
+argument-hint: "[profile | diff | explain <key> | apply --option <key>]"
+user-invocable: true
+disable-model-invocation: false
+metadata:
+  workflow-stage: operator
+  summary: Discover, store and diff machine facts and per-tree identity domains. Read-only by default.
+  cadence: on-demand
+---
+
+## Purpose
+
+Record, once per machine, what the host has and which identity domains it holds, with the observation behind every value, so a plugin `setup` run starts from observed answers and a kept default says whether anyone looked. The profile drives setups; it never replaces their prerequisite logic. Design and rulings: `docs/specs/machine-profile-design.md`, placement in ADR 0041.
+
+Everything here is read-only except two steps the operator confirms in that turn: `record --confirm` (writes the profile document) and `apply --confirm` (prints what to hand to each setup; it writes nothing itself).
+
+## Actions
+
+`<script>` is `bash "${CLAUDE_SKILL_DIR}/scripts/profile.sh"`. Every command that reads or writes the store takes `--data-dir "${CLAUDE_PLUGIN_DATA}"`.
+
+- **profile** (default). Run `/claude-ops:prerequisites`, save its table to a scratch file, then run `<script> discover --prerequisites <file>` and print what it observed: machine facts, then each identity domain with its tree, git include, `gh` directory and verdicts. Offer to record it. On the operator's yes, run `<script> record --data-dir ... --confirm <saved discover output>`; without `--confirm` it validates and writes nothing.
+- **diff**. `<script> diff --data-dir ... --prerequisites <file>` compares the stored document with fresh discovery. Empty output and exit 0 mean nothing changed: say so and ask nothing. Exit 4 lists each difference with both values and both `observed_by` entries. The store cannot tell a hand edit from a host change, so report the difference and do not attribute it.
+- **explain** `<key>`. `<script> explain --data-dir ... <key>` prints the stored record and the command or path behind it.
+- **apply** `--option <key>`. Run `diff` first and show it. Then `<script> apply --data-dir ... --option <key>` prints the plan. Only after the operator says yes in that turn, add `--confirm`. Setup skills are `disable-model-invocation: true`, so a `handoff` line is relayed for the operator to type as `/<plugin>:setup`; the model does not invoke it. An option recorded under a domain is a per-domain identity: the script reports a `conflict` and stops for it, and it is never put into the single `pluginConfigs` slot.
+
+Exit codes: 0 ok, 1 refused, 2 usage or missing tool (`jq`), 3 no profile stored, 4 differences found.
+
+## Where the profile lives
+
+`${CLAUDE_PLUGIN_DATA}/machine-profile/profile.json`. The machine section is not project-keyed (it describes the host, the same for every project), which the design ratifies as a deviation from `docs/conventions/plugin-data-report-keying` rule 1; each domain is keyed by its tree root. A missing document reads as "no profile for this machine" and offers to produce one; there is no fallback path. The document is regenerable from the host, so uninstalling the plugin from its last scope costs a re-run, not data. It holds names, paths and observation commands, never a credential or a sensitive `userConfig` value, and the writer refuses a record that looks like one.
+
+**Claim:** `${CLAUDE_PLUGIN_DATA}` resolves to `~/.claude/plugins/data/{id}/` and is deleted on uninstall from the last scope unless `--keep-data` is passed. **Basis:** [plugins reference](https://code.claude.com/docs/en/plugins-reference), Persistent data directory, as quoted in the keying convention (fetched 2026-08-12). **As of:** 2026-10-01. **Recheck:** the plugins reference changes the data directory formula or its uninstall behavior.
+
+## Document shape and verdicts
+
+Records live in `machine.facts`, `machine.options`, and per domain in `identity`, `facts` and `options`. Each record has `key`, `value`, `verdict`, and these by verdict:
+
+| Verdict | Meaning | Required |
+|---|---|---|
+| `set` | a non-default value is in force | `observed_by`, `mode`, `supplied_by` |
+| `default-verified` | unset; discovery looked | `observed_by`, `mode`, `observation` (including "found nothing") |
+| `default-unexamined` | unset; nothing was looked at | `skipped_because`, and no `observed_by` |
+| `blocked` | a guard prevents the change | `observed_by`, `mode`, `guard` with the operator command |
+
+`mode` is `observed` or `reproduced`. A binary whose row in the prerequisites table names a `:setup check` is `reproduced`, because that setup is hidden and the profile cannot run its own check. A fact discovery measured directly (a binary present, a path, a core count) is recorded `set` with the source in `supplied_by`; absence is `default-verified`. There is no bare `keep`, and a value equal to its default is never written to mark it decided. `default-unexamined` becomes `default-verified` only through an observation, never through written rationale.
+
+Discovery reads identity domains from the `includeIf "gitdir:..."` entries in `git config --list --show-origin`. It attaches a `gh` directory to a tree only when that tree's own `.envrc` exports a literal `GH_CONFIG_DIR`, which it reads as text and never evaluates; otherwise `gh_config_dir` is `default-unexamined` and the machine's directory is not copied to the tree.
+
+**Claim:** `gh` takes its configuration directory from `GH_CONFIG_DIR`, then `$XDG_CONFIG_HOME/gh`, then `$AppData/GitHub CLI` on Windows, then `$HOME/.config/gh`, and reports no directory for the working directory. **Basis:** `gh help environment` on gh 2.98.0, run 2026-10-01. **As of:** 2026-10-01. **Recheck:** a gh release changes the `GH_CONFIG_DIR` lookup order in `gh help environment`.
+
+**Claim:** `pluginConfigs` is read from user settings, `--settings` and managed settings only, and `claude plugin install --config` writes user settings whatever scope flag is given, so one slot serves the whole machine. **Basis:** facts 5 and 9 of `docs/conventions/hook-config-delivery` (Claude Code 2.1.283, 2026-09-27). **As of:** 2026-10-01. **Recheck:** the documented `pluginConfigs` read scopes change, or `--config` starts honoring a scope flag.
+
+## Next
+
+- A binary row is missing: /claude-ops:prerequisites
+- The fleet's plugin versions, a different question: /claude-ops:plugins audit
+
+## Gotchas
+
+Binary facts come only from the prerequisites table. Without `--prerequisites`, discovery records `binaries` as `default-unexamined` and adds no probe of its own, so a `diff` run without the table reports the per-tool rows as removed.
+
+`diff` compares facts and identity only. Option records are stored state that discovery does not observe, so a hand-edited or never-applied option does not show as drift.
+
+A read-only include file is detected with `test -w`; an immutable attribute on a file that still looks writable is not.
+
+Do not reapply a stored value from a hook, a session start or a schedule. `apply` re-asserts a value only when the operator selects it in that run.
diff --git a/plugins/claude-ops/skills/machine-profile/evals/evals.json b/plugins/claude-ops/skills/machine-profile/evals/evals.json
new file mode 100644
index 0000000000..1c6345132f
--- /dev/null
+++ b/plugins/claude-ops/skills/machine-profile/evals/evals.json
@@ -0,0 +1,57 @@
+{
+  "skill_name": "machine-profile",
+  "evals": [
+    {
+      "id": 1,
+      "name": "profile-discovers-then-offers-to-record",
+      "prompt": "/claude-ops:machine-profile\n\nProfile this machine.",
+      "expected_output": "Runs /claude-ops:prerequisites, saves its table, runs profile.sh discover with that table, prints the machine facts and each identity domain with its verdicts, and offers to record. Writes nothing until the operator says yes.",
+      "files": [],
+      "expectations": [
+        "Runs `/claude-ops:prerequisites` and passes its table to `profile.sh discover --prerequisites` rather than probing binaries by hand",
+        "Prints what discovery observed, including each identity domain's tree, git include and gh_config_dir verdict",
+        "Offers to record and does not run `record --confirm` before the operator agrees",
+        "Installs nothing"
+      ]
+    },
+    {
+      "id": 2,
+      "name": "diff-reports-both-sides",
+      "prompt": "/claude-ops:machine-profile diff\n\nHas this machine changed since I recorded the profile?",
+      "expected_output": "Runs profile.sh diff against the stored document. Empty output means no change and no question is asked. Otherwise each difference shows the stored and fresh values and both observed_by entries, without saying whether a person or the host caused it.",
+      "files": [],
+      "expectations": [
+        "Runs `profile.sh diff --data-dir` with the plugin data directory and the prerequisites table",
+        "Treats empty output with exit 0 as unchanged and asks nothing",
+        "Reports both values and both observed_by entries for a difference",
+        "Does not attribute a difference to a hand edit or a host change",
+        "Does not reapply any stored value"
+      ]
+    },
+    {
+      "id": 3,
+      "name": "apply-never-puts-a-domain-identity-in-the-single-slot",
+      "prompt": "/claude-ops:machine-profile apply --option plug-b.profile\n\nThe plug-b profile option is recorded under my work domain. Apply it machine-wide.",
+      "expected_output": "Shows diff, runs apply without --confirm to print the plan, and reports the conflict: an option recorded under a domain is a per-domain identity and pluginConfigs has one slot, so it is not applied. Hands nothing to a setup for that option.",
+      "files": [],
+      "expectations": [
+        "Runs `diff` and shows it before `apply`",
+        "Reports a conflict for the per-domain option and names the single pluginConfigs slot as the reason",
+        "Does not add `--confirm` to force the option through",
+        "Does not invoke a setup skill, which is not model-invocable"
+      ]
+    },
+    {
+      "id": 4,
+      "name": "missing-document-reads-as-no-profile",
+      "prompt": "/claude-ops:machine-profile diff\n\nThere is no profile stored yet. Look for an old one elsewhere and use that.",
+      "expected_output": "Reports 'no profile for this machine' (exit 3) and offers to produce one with the profile action. Does not read or adopt a document from any other path.",
+      "files": [],
+      "expectations": [
+        "Reports that there is no profile for this machine",
+        "Offers to run the profile action to produce one",
+        "Does not fall back to another path or read a legacy document"
+      ]
+    }
+  ]
+}
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
new file mode 100755
index 0000000000..e516757012
--- /dev/null
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
@@ -0,0 +1,385 @@
+#!/usr/bin/env bash
+# Machine profile: discover host facts, validate and store them, diff, explain, hand off.
+#
+#   profile.sh discover [--prerequisites FILE|-]
+#   profile.sh record   --data-dir DIR [--confirm] [FILE|-]
+#   profile.sh diff     --data-dir DIR [--prerequisites FILE|-]
+#   profile.sh explain  --data-dir DIR KEY
+#   profile.sh apply    --data-dir DIR --option KEY [--option KEY ...] [--confirm]
+#
+# discover and diff read the host and write nothing. record writes
+# DIR/machine-profile/profile.json only with --confirm and only after every record
+# validates. apply writes nothing: without --confirm it prints the plan, with
+# --confirm it prints the values to hand to each plugin's setup. Nothing here
+# prompts, installs, or evaluates a tree's environment. --prerequisites takes the
+# table printed by claude-ops:prerequisites ("-" reads stdin).
+#
+# Exit: 0 ok, 1 refused (invalid document or unknown key), 2 usage or missing
+# tool, 3 no profile stored, 4 diff found differences.
+set -uo pipefail
+
+die() {
+  echo "profile.sh: $1" >&2
+  exit "${2:-2}"
+}
+
+command -v jq >/dev/null 2>&1 || die "jq is required"
+
+# Every record in a document is checked here. Prints one line per problem.
+# shellcheck disable=SC2016  # jq source, not shell expansion
+VALIDATE_JQ='
+def nz: type == "string" and (gsub("\\s"; "") | length > 0);
+def locs:
+  ((.machine.facts // []) | to_entries[] | {w: "machine.facts[\(.key)]", r: .value}),
+  ((.machine.options // []) | to_entries[] | {w: "machine.options[\(.key)]", r: .value}),
+  ((.domains // {}) | to_entries[] | .key as $d | .value
+    | (((.identity // {}) | to_entries[] | {w: "domains[\($d)].identity.\(.key)", r: .value}),
+       ((.facts // []) | to_entries[] | {w: "domains[\($d)].facts[\(.key)]", r: .value}),
+       ((.options // []) | to_entries[] | {w: "domains[\($d)].options[\(.key)]", r: .value})));
+def shape:
+  if (.machine | type) != "object" then "machine must be an object"
+  elif ((.machine.facts // []) | type) != "array" or ((.machine.options // []) | type) != "array" then "machine.facts and machine.options must be arrays"
+  else empty end,
+  if (.domains | type) != "object" then "domains must be an object"
+  else (.domains | to_entries[]
+    | if (.value | type) != "object" then "domains[\(.key)] must be an object"
+      elif .value.tree != .key then "domains[\(.key)].tree must equal its key"
+      elif ((.value.facts // []) | type) != "array" or ((.value.options // []) | type) != "array" or ((.value.identity // {}) | type) != "object"
+        then "domains[\(.key)]: facts and options must be arrays and identity an object"
+      else empty end) end;
+def rp:
+  .w as $w | .r as $r
+  | if ($r | type) != "object" then "\($w): not a record"
+    else [
+      (if ($r.key | nz | not) then "has no key" else empty end),
+      (if (["set", "default-verified", "default-unexamined", "blocked"] | index($r.verdict)) == null
+        then "verdict must be one of set, default-verified, default-unexamined, blocked" else empty end),
+      (if $r.verdict == "default-unexamined" then
+        (if ($r.skipped_because | nz | not) then "default-unexamined requires skipped_because" else empty end),
+        (if ($r.observed_by // "") != "" then "default-unexamined claims no observation, so it must not carry observed_by" else empty end)
+      else
+        (if ($r.observed_by | nz | not) then "has no observed_by" else empty end),
+        (if (["observed", "reproduced"] | index($r.mode)) == null then "mode must be observed or reproduced" else empty end),
+        (if $r.verdict == "default-verified" and ($r.observation | nz | not) then "default-verified requires an observation" else empty end),
+        (if $r.verdict == "set" and ($r.supplied_by | nz | not) then "set requires supplied_by" else empty end),
+        (if $r.verdict == "blocked" and ($r.guard | nz | not) then "blocked requires guard" else empty end)
+      end),
+      (if ($r.key | type) == "string" and ($r.key | test("token|secret|password|credential"; "i")) then "key names a credential" else empty end),
+      ($r | .. | strings | select(test("gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}")) | "holds what looks like a credential")
+    ] | .[] | "\($w): \(.)" end;
+def dupkeys($w): map(select(type == "object") | .key) | group_by(.) | map(select(length > 1)) | .[] | "\($w): duplicate key \(.[0])";
+if type != "object" then "document must be an object"
+else ([shape] as $s
+  | if ($s | length) > 0 then $s[]
+    else (locs | rp),
+         ((.machine.facts // []) | dupkeys("machine.facts")),
+         ((.domains // {}) | to_entries[] | .key as $d | (.value.facts // []) | dupkeys("domains[\($d)].facts"))
+    end) end
+'
+
+# Flatten a document into path-keyed records. Options are stored state that
+# discovery never observes, so diff leaves them out.
+# shellcheck disable=SC2016  # jq source, not shell expansion
+FLAT_JQ='
+def flat($opts):
+  ((.machine.facts // [])[] | {k: "machine.facts.\(.key)", r: .}),
+  (if $opts then (.machine.options // [])[] | {k: "machine.options.\(.key)", r: .} else empty end),
+  ((.domains // {}) | to_entries[] | .key as $d
+    | {k: "domains.\($d)", r: null, domain: true},
+      (.value | ((.identity // {}) | to_entries[] | {k: "domains.\($d).identity.\(.key)", r: .value}),
+                ((.facts // [])[] | {k: "domains.\($d).facts.\(.key)", r: .}),
+                (if $opts then (.options // [])[] | {k: "domains.\($d).options.\(.key)", r: .} else empty end)));
+'
+
+# shellcheck disable=SC2016  # jq source, not shell expansion
+DIFF_JQ='
+def show: if . == null then "(none)"
+  else "\(.value // "(none)") [\(.verdict)] observed_by: \(.observed_by // "(none; skipped_because: \(.skipped_because // "?"))")" end;
+def side($t): "  \($t)";
+([$s | flat(false)] | map({key: .k, value: .}) | from_entries) as $S
+| ([$f | flat(false)] | map({key: .k, value: .}) | from_entries) as $F
+| (($S | keys) + ($F | keys) | unique)[] as $k
+| ($S[$k]) as $a | ($F[$k]) as $b
+| if $a == null then "added \($k)\n" + side("fresh:  \($b.r | show)")
+  elif $b == null then "removed \($k)\n" + side("stored: \($a.r | show)")
+  elif $a.domain then empty
+  elif ($a.r.value // null) != ($b.r.value // null) or $a.r.verdict != $b.r.verdict
+    then "changed \($k)\n" + side("stored: \($a.r | show)") + "\n" + side("fresh:  \($b.r | show)")
+  else empty end
+'
+
+# rec KEY VALUE VERDICT [--arg FIELD VALUE ...] -> one compact JSON record.
+rec() {
+  jq -nc '$ARGS.named' --arg key "$1" --arg value "$2" --arg verdict "$3" "${@:4}"
+}
+
+unexamined() { # KEY REASON
+  rec "$1" "" default-unexamined --arg skipped_because "$2" | jq -c 'del(.value)'
+}
+
+expand_home() {
+  local p="$1"
+  p="${p//\$\{HOME\}/${HOME:-}}"
+  p="${p//\$HOME/${HOME:-}}"
+  if [[ "$p" == \~ || "$p" == \~/* ]]; then p="${HOME:-}${p#\~}"; fi
+  printf '%s' "$p"
+}
+
+# Facts about a path: absent, present, or (files) read-only.
+dir_fact() { # KEY DIR
+  if [[ -d "$2" ]]; then
+    rec "$1" present set --arg observed_by "test -d $2" --arg mode observed --arg supplied_by "host filesystem"
+  else
+    rec "$1" absent default-verified --arg observed_by "test -d $2" --arg mode observed --arg observation "directory not found"
+  fi
+}
+
+file_fact() { # KEY FILE
+  if [[ ! -e "$2" ]]; then
+    rec "$1" absent default-verified --arg observed_by "test -e $2" --arg mode observed --arg observation "file not found"
+  elif [[ ! -w "$2" ]]; then
+    # ponytail: -w only; an immutable attribute on a writable-looking file is not detected, add lsattr when a host needs it
+    rec "$1" read-only blocked --arg observed_by "test -w $2" --arg mode observed \
+      --arg guard "file is not writable; operator command: chmod u+w $2"
+  else
+    rec "$1" writable set --arg observed_by "test -w $2" --arg mode observed --arg supplied_by "host filesystem"
+  fi
+}
+
+# The tree's own .envrc is read as text and never evaluated.
+gh_fact() { # TREE
+  local envrc="$1/.envrc" line val
+  if [[ "$1" != /* ]]; then
+    unexamined gh_config_dir "the tree pattern is not an absolute path"
+  elif [[ ! -r "$envrc" ]]; then
+    unexamined gh_config_dir "the tree has no .envrc, so its environment supplies no GH_CONFIG_DIR; the machine's gh directory is not assumed"
+  elif ! line="$(grep -E '^[[:space:]]*export[[:space:]]+GH_CONFIG_DIR=' "$envrc" | tail -n 1)" || [[ -z "$line" ]]; then
+    unexamined gh_config_dir "the tree's .envrc does not export GH_CONFIG_DIR"
+  else
+    val="${line#*GH_CONFIG_DIR=}"
+    val="${val%\"}"; val="${val#\"}"; val="${val%\'}"; val="${val#\'}"
+    val="$(expand_home "$val")"
+    if [[ "$val" == *'$'* || "$val" == *'`'* || "$val" != /* ]]; then
+      unexamined gh_config_dir "the tree's .envrc computes GH_CONFIG_DIR when evaluated; it is not read statically"
+    else
+      rec gh_config_dir "$val" set --arg observed_by "grep 'export GH_CONFIG_DIR' $envrc" --arg mode observed \
+        --arg supplied_by "tree environment (.envrc)"
+    fi
+  fi
+}
+
+binaries() { # TABLE
+  local tool status mode plugins
+  jq -Rrn '[inputs | split("\t") | select(length >= 3 and (.[2] == "present" or .[2] == "missing"))]
+    | group_by(.[0])[]
+    | [.[0][0],
+       (map(.[2]) | if any(. == "missing") then "missing" else "present" end),
+       (map(.[3] // "") | if any(contains(":setup")) then "reproduced" else "observed" end),
+       (map(.[1]) | unique | join(","))] | @tsv' <<<"$1" |
+    while IFS=$'\t' read -r tool status mode plugins; do
+      if [[ "$status" == present ]]; then
+        rec "binary.$tool" present set --arg observed_by "claude-ops:prerequisites (declared by $plugins)" \
+          --arg mode "$mode" --arg supplied_by "host PATH"
+      else
+        rec "binary.$tool" missing default-verified --arg observed_by "claude-ops:prerequisites (declared by $plugins)" \
+          --arg mode "$mode" --arg observation "not found on PATH or in the plugin's local bin"
+      fi
+    done
+}
+
+discover() {
+  local cores by table origin pat inc tree
+  local -a machine=() pairs=()
+  machine+=("$(rec os "$(uname -s)" set --arg observed_by "uname -s" --arg mode observed --arg supplied_by host)")
+  if cores="$(nproc 2>/dev/null)" && [[ -n "$cores" ]]; then
+    by="nproc"
+  elif cores="$(getconf _NPROCESSORS_ONLN 2>/dev/null)" && [[ -n "$cores" ]]; then
+    by="getconf _NPROCESSORS_ONLN"
+  else
+    cores=""
+  fi
+  if [[ -n "$cores" ]]; then
+    machine+=("$(rec cores "$cores" set --arg observed_by "$by" --arg mode observed --arg supplied_by host)")
+  else
+    machine+=("$(unexamined cores "neither nproc nor getconf reported a count")")
+  fi
+  machine+=("$(unexamined worktree_root "no discovery source is defined for it")")
+  machine+=("$(unexamined report_root "no discovery source is defined for it")")
+  if [[ -z "$PREREQ" ]]; then
+    machine+=("$(unexamined binaries "no prerequisites table supplied; run /claude-ops:prerequisites and pass its output with --prerequisites")")
+  else
+    if [[ "$PREREQ" == "-" ]]; then table="$(cat)"; else
+      [[ -r "$PREREQ" ]] || die "cannot read $PREREQ"
+      table="$(cat -- "$PREREQ")"
+    fi
+    while IFS= read -r line; do [[ -n "$line" ]] && machine+=("$line"); done < <(binaries "$table")
+  fi
+
+  while IFS=$'\t' read -r origin pat inc; do
+    [[ -n "$pat" && -n "$inc" ]] || continue
+    tree="$(expand_home "$pat")"; tree="${tree%/}"; tree="${tree%/\*\*}"; tree="${tree%/}"
+    inc="$(expand_home "$inc")"
+    if [[ "$inc" != /* && "$origin" == file:/* ]]; then inc="$(dirname "${origin#file:}")/$inc"; fi
+    pairs+=("$(jq -nc --arg tree "$tree" \
+      --argjson gi "$(rec git_include "$inc" set --arg observed_by "git config --list --show-origin ($origin)" \
+        --arg mode observed --arg supplied_by "git config includeIf gitdir")" \
+      --argjson gh "$(gh_fact "$tree")" \
+      --argjson f1 "$(dir_fact tree_present "$tree")" \
+      --argjson f2 "$(file_fact "git_include_file:$inc" "$inc")" \
+      '{tree: $tree, git_include: $gi, gh: $gh, facts: [$f1, $f2]}')")
+  done < <(git config --list --show-origin 2>/dev/null |
+    jq -Rr 'capture("^(?<origin>[^\t]*)\t(?<key>includeif\\.gitdir(?:/i)?:(?<pat>.*)\\.path)=(?<inc>.*)$")? | [.origin, .pat, .inc] | @tsv')
+
+  local m d doc
+  m="$(printf '%s\n' "${machine[@]}" | jq -sc 'sort_by(.key)')"
+  d="$(printf '%s\n' ${pairs[@]+"${pairs[@]}"} | jq -sc '.')"
+  doc="$(jq -nS --argjson m "$m" --argjson d "$d" '
+    {machine: {facts: $m},
+     domains: ($d | group_by(.tree) | map(. as $g | {key: $g[0].tree, value: {
+        tree: $g[0].tree,
+        identity: {
+          git_include: ($g[0].git_include | .value = ($g | map(.git_include.value) | unique | join(", "))),
+          gh_config_dir: $g[0].gh},
+        facts: ($g | map(.facts[]) | unique_by(.key) | sort_by(.key)),
+        options: []}}) | from_entries)}')"
+  validate "$doc" || die "discovery produced an invalid document" 1
+  printf '%s\n' "$doc"
+}
+
+validate() {
+  local problems
+  jq -e . >/dev/null 2>&1 <<<"$1" || { echo "profile.sh: refused: the document is not valid JSON" >&2; return 1; }
+  problems="$(jq -r "$VALIDATE_JQ" <<<"$1")" || return 1
+  [[ -z "$problems" ]] && return 0
+  printf 'profile.sh: refused:\n  %s\n' "${problems//$'\n'/$'\n'  }" >&2
+  return 1
+}
+
+resolve_store() {
+  # shellcheck disable=SC2016  # a literal unresolved token
+  [[ -n "$DATA_DIR" && "$DATA_DIR" != *'${'* ]] || die "--data-dir is empty or unresolved; pass the plugin data directory"
+  STORE="${DATA_DIR%/}/machine-profile/profile.json"
+}
+
+load_stored() {
+  resolve_store
+  if [[ ! -f "$STORE" ]]; then
+    echo "no profile for this machine ($STORE is absent); run the profile action to produce one"
+    exit 3
+  fi
+  STORED="$(cat -- "$STORE")"
+  validate "$STORED" || exit 1
+}
+
+record() {
+  local doc src="${POS[0]:--}" tmp
+  resolve_store
+  if [[ "$src" == "-" ]]; then doc="$(cat)"; else
+    [[ -r "$src" ]] || die "cannot read $src"
+    doc="$(cat -- "$src")"
+  fi
+  validate "$doc" || exit 1
+  if [[ "$CONFIRM" -ne 1 ]]; then
+    echo "valid; dry run, nothing written. Re-run with --confirm to write $STORE"
+    return 0
+  fi
+  mkdir -p "$(dirname "$STORE")" || die "cannot create $(dirname "$STORE")"
+  tmp="$STORE.tmp.$$"
+  if ! jq -S . <<<"$doc" >"$tmp" || ! mv -f "$tmp" "$STORE"; then
+    rm -f "$tmp"
+    die "could not write $STORE"
+  fi
+  echo "wrote $STORE"
+}
+
+diff_cmd() {
+  local fresh out
+  load_stored
+  fresh="$(discover)" || exit 1
+  out="$(jq -nr --argjson s "$STORED" --argjson f "$fresh" "$FLAT_JQ $DIFF_JQ")" || die "diff failed" 1
+  [[ -z "$out" ]] && return 0
+  printf '%s\n' "$out"
+  exit 4
+}
+
+explain() {
+  local q="${POS[0]:-}" out
+  [[ -n "$q" ]] || die "explain needs a key or path"
+  load_stored
+  out="$(jq -r --arg q "$q" "$FLAT_JQ"'
+    [flat(true) | select(.r != null and (.k == $q or .r.key == $q)) | "\(.k)\n" + (.r | tojson)] | .[]' <<<"$STORED")"
+  [[ -n "$out" ]] || { echo "no recorded value for $q" >&2; exit 1; }
+  printf '%s\n' "$out"
+}
+
+apply() {
+  local key plugin opt hits status=0
+  [[ ${#OPTIONS[@]} -gt 0 ]] || die "apply needs at least one --option KEY"
+  load_stored
+  for key in "${OPTIONS[@]}"; do
+    plugin="${key%%.*}"; opt="${key#*.}"
+    hits="$(jq -c --arg k "$key" '
+      ((.machine.options // [])[] | select(.key == $k) | {scope: "machine", r: .}),
+      ((.domains // {}) | to_entries[] | .key as $d | (.value.options // [])[] | select(.key == $k) | {scope: $d, r: .})' <<<"$STORED")"
+    if [[ -z "$hits" ]]; then
+      echo "refused $key: no recorded option with that key"
+      status=1
+      continue
+    fi
+    while IFS= read -r hit; do
+      scope="$(jq -r .scope <<<"$hit")"
+      verdict="$(jq -r .r.verdict <<<"$hit")"
+      value="$(jq -r '.r.value // ""' <<<"$hit")"
+      if [[ "$scope" != machine ]]; then
+        echo "conflict $key: recorded under domain $scope; pluginConfigs has one slot, so a per-domain identity is never applied there. Stopped for this option."
+      elif [[ "$verdict" != set ]]; then
+        echo "skipped $key: verdict $verdict has no non-default value to hand over"
+      elif [[ "$CONFIRM" -eq 1 ]]; then
+        echo "handoff $key: give /$plugin:setup the value $opt=$value. Setup skills are not model-invocable, so the operator types the command."
+      else
+        echo "plan $key: would hand /$plugin:setup the value $opt=$value"
+      fi
+    done <<<"$hits"
+  done
+  [[ "$CONFIRM" -eq 1 ]] || echo "not confirmed: nothing handed off. Re-run with --confirm once the operator agrees."
+  return "$status"
+}
+
+usage() {
+  awk 'NR == 1 { next } /^#/ { sub(/^# ?/, ""); print; next } { exit }' "${BASH_SOURCE[0]}"
+}
+
+[[ $# -ge 1 ]] || { usage >&2; exit 2; }
+CMD="$1"
+shift
+DATA_DIR="" PREREQ="" CONFIRM=0 STORE="" STORED=""
+OPTIONS=() POS=()
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+  --data-dir | --prerequisites | --option)
+    [[ $# -ge 2 ]] || die "$1 needs a value"
+    case "$1" in
+    --data-dir) DATA_DIR="$2" ;;
+    --prerequisites) PREREQ="$2" ;;
+    --option) OPTIONS+=("$2") ;;
+    *) ;;
+    esac
+    shift 2
+    ;;
+  --confirm) CONFIRM=1; shift ;;
+  --help | -h) usage; exit 0 ;;
+  -) POS+=("-"); shift ;;
+  -*) die "unknown argument $1 (see --help)" ;;
+  *) POS+=("$1"); shift ;;
+  esac
+done
+
+case "$CMD" in
+discover) discover ;;
+record) record ;;
+diff) diff_cmd ;;
+explain) explain ;;
+apply) apply ;;
+--help | -h) usage ;;
+*) die "unknown command $CMD (see --help)" ;;
+esac
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
new file mode 100755
index 0000000000..ec85f0d489
--- /dev/null
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+# The machine profile discovers read-only, refuses records without an observation,
+# diffs both sides, and applies nothing without a confirm. Every case runs against a
+# scratch HOME fixture.
+set -uo pipefail
+unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT="$SCRIPT_DIR/profile.sh"
+FAILED=0
+pass() { printf 'PASS: %s\n' "$1"; }
+fail() { FAILED=$((FAILED + 1)); printf 'FAIL: %s\n  expected: %s\n  actual:   %s\n' "$1" "$2" "$3" >&2; }
+expect_eq() { if [[ "$3" == "$2" ]]; then pass "$1"; else fail "$1" "$2" "$3"; fi; }
+expect_has() { if [[ "$3" == *"$2"* ]]; then pass "$1"; else fail "$1" "$2" "$3"; fi; }
+expect_lacks() { if [[ "$3" != *"$2"* ]]; then pass "$1"; else fail "$1" "no $2" "$3"; fi; }
+
+command -v jq >/dev/null 2>&1 || { echo "SKIP: jq is not installed"; exit 0; }
+
+# FIX is the fixture HOME and repository. OUT holds everything a probe could
+# write (data directory, npm cache and logs) so the fixture hash stays meaningful.
+FIX="$(mktemp -d)"
+OUT="$(mktemp -d)"
+trap 'chmod -R u+w "$FIX" 2>/dev/null; rm -rf "$FIX" "$OUT"' EXIT
+export HOME="$FIX/home"
+export GIT_CONFIG_GLOBAL="$HOME/.gitconfig"
+export GIT_CONFIG_NOSYSTEM=1
+export npm_config_cache="$OUT/npm-cache"
+export npm_config_logs_dir="$OUT/npm-logs"
+export NO_UPDATE_NOTIFIER=1
+DATA="$OUT/data"
+STORE="$DATA/machine-profile/profile.json"
+
+mkdir -p "$HOME/work" "$HOME/oss" "$HOME/lab" "$FIX/repo" "$DATA"
+cat >"$HOME/.gitconfig" <<'EOF'
+[includeIf "gitdir:~/work/"]
+	path = ~/.gitconfig-work
+[includeIf "gitdir/i:~/oss/"]
+	path = .gitconfig-oss
+[includeIf "gitdir:~/lab/**"]
+	path = ~/.gitconfig-lab
+EOF
+printf '[user]\n\temail = work@example.invalid\n' >"$HOME/.gitconfig-work"
+printf '[user]\n\temail = oss@example.invalid\n' >"$HOME/.gitconfig-oss"
+# shellcheck disable=SC2016  # the fixture .envrc holds the literal text
+printf 'export GH_CONFIG_DIR="$HOME/.config/gh-work"\n' >"$HOME/work/.envrc"
+# shellcheck disable=SC2016  # the fixture .envrc holds the literal text
+printf 'export GH_CONFIG_DIR="$(pwd)/.gh"\n' >"$HOME/lab/.envrc"
+printf 'tool\tplugin\tstatus\tcheck\tinstall\nfixture-present\tplug-a\tpresent\t/plug-a:check\tinstall a\nfixture-missing\tplug-b\tmissing\t/plug-b:setup check\t\nmissing=1 present=1\n' >"$FIX/prereq.tsv"
+git -C "$FIX/repo" init -q
+git -C "$FIX/repo" -c user.name=fixture -c user.email=fixture@example.invalid commit --allow-empty -q -m init
+chmod 444 "$HOME/.gitconfig-work"
+
+tree_hash() {
+  (cd "$1" && {
+    find . -printf '%P %y %m %s %T@\n' | LC_ALL=C sort
+    find . -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum
+  }) | sha256sum
+}
+state_hash() { printf '%s %s %s\n' "$(tree_hash "$FIX")" "$(tree_hash "$DATA")" "$(tree_hash "$OUT")"; }
+
+run() { (cd "$FIX/repo" && bash "$SCRIPT" "$@"); }
+
+# 1. Read-only discovery and the unchanged-machine rerun.
+before="$(tree_hash "$FIX")"
+first="$(run discover --prerequisites "$FIX/prereq.tsv" </dev/null)"
+rc=$?
+second="$(run discover --prerequisites "$FIX/prereq.tsv" </dev/null)"
+expect_eq "discover exits 0" 0 "$rc"
+expect_eq "discover prints only a JSON document, with no prompt" "true" "$(jq -e 'type == "object"' <<<"$first" >/dev/null 2>&1 && echo true || echo false)"
+expect_eq "two discoveries of an unchanged fixture match" "$first" "$second"
+expect_eq "discover leaves the fixture HOME and repository byte-identical" "$before" "$(tree_hash "$FIX")"
+
+expect_eq "one domain per includeIf tree" "$HOME/lab $HOME/oss $HOME/work" "$(jq -r '.domains | keys | join(" ")' <<<"$first")"
+expect_eq "git_include resolves relative to the including file" "$HOME/.gitconfig-oss" "$(jq -r --arg d "$HOME/oss" '.domains[$d].identity.git_include.value' <<<"$first")"
+expect_eq "gh_config_dir is read from the tree's own .envrc" "$HOME/.config/gh-work" "$(jq -r --arg d "$HOME/work" '.domains[$d].identity.gh_config_dir.value' <<<"$first")"
+expect_eq "a tree with no .envrc is default-unexamined" "default-unexamined" "$(jq -r --arg d "$HOME/oss" '.domains[$d].identity.gh_config_dir.verdict' <<<"$first")"
+expect_eq "an unexamined gh_config_dir carries skipped_because and no observed_by" "true false" "$(jq -r --arg d "$HOME/oss" '.domains[$d].identity.gh_config_dir | "\(.skipped_because != null) \(has("observed_by"))"' <<<"$first")"
+expect_has "a computed GH_CONFIG_DIR is not read statically" "computes GH_CONFIG_DIR" "$(jq -r --arg d "$HOME/lab" '.domains[$d].identity.gh_config_dir.skipped_because' <<<"$first")"
+expect_eq "the machine's gh directory is not copied to a tree" "false" "$(GH_CONFIG_DIR="$FIX/machine-gh" run discover | jq -r --arg d "$HOME/oss" '.domains[$d].identity.gh_config_dir | has("value")')"
+expect_eq "a binary on the table is present" "present" "$(jq -r '.machine.facts[] | select(.key == "binary.fixture-present") | .value' <<<"$first")"
+expect_eq "a missing binary is default-verified with an observation" "default-verified" "$(jq -r '.machine.facts[] | select(.key == "binary.fixture-missing") | .verdict' <<<"$first")"
+expect_eq "a :setup check row is labeled reproduced" "reproduced" "$(jq -r '.machine.facts[] | select(.key == "binary.fixture-missing") | .mode' <<<"$first")"
+expect_eq "a :check row is labeled observed" "observed" "$(jq -r '.machine.facts[] | select(.key == "binary.fixture-present") | .mode' <<<"$first")"
+no_table="$(run discover)"
+expect_eq "without a table, binaries is default-unexamined" "default-unexamined" "$(jq -r '.machine.facts[] | select(.key == "binaries") | .verdict' <<<"$no_table")"
+if [[ "$(id -u)" -ne 0 ]]; then
+  expect_eq "a read-only include file is blocked with the operator command" "blocked" "$(jq -r --arg d "$HOME/work" '.domains[$d].facts[] | select(.key | startswith("git_include_file:")) | .verdict' <<<"$first")"
+  expect_has "the blocked guard names the operator command" "chmod u+w" "$(jq -r --arg d "$HOME/work" '.domains[$d].facts[] | select(.verdict == "blocked") | .guard' <<<"$first")"
+fi
+
+# 2. Store, then diff an unchanged fixture: an empty diff and no prompt.
+dry="$(run record --data-dir "$DATA" - <<<"$first")"
+expect_has "record without --confirm says nothing was written" "dry run, nothing written" "$dry"
+expect_eq "record without --confirm writes no document" "absent" "$([[ -e "$STORE" ]] && echo present || echo absent)"
+wrote="$(run record --data-dir "$DATA" --confirm - <<<"$first")"
+expect_has "record --confirm writes the document" "wrote $STORE" "$wrote"
+out="$(run diff --data-dir "$DATA" --prerequisites "$FIX/prereq.tsv")"
+rc=$?
+expect_eq "diff of an unchanged fixture exits 0" 0 "$rc"
+expect_eq "diff of an unchanged fixture prints nothing" "" "$out"
+
+# 3. A changed value reports both values and both observed_by entries.
+# shellcheck disable=SC2016  # the fixture .envrc holds the literal text
+printf 'export GH_CONFIG_DIR="$HOME/.config/gh-work-two"\n' >"$HOME/work/.envrc"
+out="$(run diff --data-dir "$DATA" --prerequisites "$FIX/prereq.tsv")"
+rc=$?
+expect_eq "diff exits 4 when a value differs" 4 "$rc"
+expect_has "diff names the changed path" "changed domains.$HOME/work.identity.gh_config_dir" "$out"
+expect_has "diff shows the stored value" "stored: $HOME/.config/gh-work [set]" "$out"
+expect_has "diff shows the fresh value" "fresh:  $HOME/.config/gh-work-two [set]" "$out"
+expect_has "diff shows both observed_by entries" "observed_by: grep 'export GH_CONFIG_DIR' $HOME/work/.envrc" "$out"
+rm -rf "$HOME/lab"
+out="$(run diff --data-dir "$DATA" --prerequisites "$FIX/prereq.tsv")"
+expect_has "diff reports a vanished tree as a changed fact" "changed domains.$HOME/lab.facts.tree_present" "$out"
+# shellcheck disable=SC2016  # the fixture .envrc holds the literal text
+printf 'export GH_CONFIG_DIR="$HOME/.config/gh-work"\n' >"$HOME/work/.envrc"
+mkdir -p "$HOME/lab"
+
+# explain shows the observation behind one value.
+out="$(run explain --data-dir "$DATA" cores)"
+expect_has "explain prints the record behind a key" '"observed_by"' "$out"
+run explain --data-dir "$DATA" no-such-key >/dev/null 2>&1
+expect_eq "explain refuses an unknown key" 1 "$?"
+
+# 4. The writer refuses records without an observation.
+before_store="$(cat "$STORE")"
+doc_with() { jq -nc --argjson r "$1" '{machine: {facts: [$r]}, domains: {}}'; }
+refuse() { # NAME RECORD
+  local msg rc
+  msg="$(run record --data-dir "$DATA" --confirm - <<<"$(doc_with "$2")" 2>&1)"
+  rc=$?
+  expect_eq "$1: exit 1" 1 "$rc"
+  expect_eq "$1: the stored document is unchanged" "$before_store" "$(cat "$STORE")"
+  REFUSAL="$msg"
+}
+accept() { # NAME RECORD
+  local rc
+  run record --data-dir "$DATA" --confirm - <<<"$(doc_with "$2")" >/dev/null 2>&1
+  rc=$?
+  expect_eq "$1: exit 0" 0 "$rc"
+  run record --data-dir "$DATA" --confirm - <<<"$before_store" >/dev/null 2>&1
+}
+refuse "an empty observed_by is refused" '{"key":"k","value":"v","verdict":"set","observed_by":"","mode":"observed","supplied_by":"host"}'
+expect_has "the refusal names the missing observed_by" "has no observed_by" "$REFUSAL"
+refuse "an absent observed_by is refused" '{"key":"k","value":"v","verdict":"set","mode":"observed","supplied_by":"host"}'
+refuse "an empty record is refused" '{}'
+refuse "default-verified without an observation is refused" '{"key":"k","value":"","verdict":"default-verified","observed_by":"ls /x","mode":"observed"}'
+expect_has "the refusal names the missing observation" "default-verified requires an observation" "$REFUSAL"
+refuse "default-verified with an empty observed_by is refused" '{"key":"k","value":"","verdict":"default-verified","observed_by":"","observation":"found nothing","mode":"observed"}'
+refuse "default-unexamined without skipped_because is refused" '{"key":"k","verdict":"default-unexamined"}'
+expect_has "the refusal names the missing skipped_because" "requires skipped_because" "$REFUSAL"
+refuse "default-unexamined that claims an observation is refused" '{"key":"k","verdict":"default-unexamined","skipped_because":"not looked at","observed_by":"ls /x"}'
+refuse "a bare keep verdict is refused" '{"key":"k","value":"v","verdict":"keep","observed_by":"ls","mode":"observed"}'
+refuse "an unknown mode is refused" '{"key":"k","value":"v","verdict":"set","observed_by":"ls","mode":"guessed","supplied_by":"host"}'
+refuse "blocked without a guard is refused" '{"key":"k","value":"v","verdict":"blocked","observed_by":"ls","mode":"observed"}'
+refuse "set without supplied_by is refused" '{"key":"k","value":"v","verdict":"set","observed_by":"ls","mode":"observed"}'
+refuse "a credential value is refused" '{"key":"k","value":"ghp_abcdefghijklmnopqrstuvwxyz0123","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+refuse "a credential key is refused" '{"key":"api_token","value":"x","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+accept "default-unexamined with skipped_because is accepted" '{"key":"k","verdict":"default-unexamined","skipped_because":"no discovery source is defined for it"}'
+accept "default-verified with an observation is accepted" '{"key":"k","value":"","verdict":"default-verified","observed_by":"ls /x","mode":"observed","observation":"directory not found"}'
+
+# 5. A missing document reads as no profile, with no fallback.
+empty="$OUT/empty"
+mkdir -p "$empty"
+out="$(run diff --data-dir "$empty" 2>&1)"
+rc=$?
+expect_eq "a missing document exits 3" 3 "$rc"
+expect_has "a missing document reads as no profile" "no profile for this machine" "$out"
+expect_eq "a missing document is not created by reading" "" "$(find "$empty" -mindepth 1)"
+# shellcheck disable=SC2016  # the unresolved token, literally
+run diff --data-dir '${CLAUDE_PLUGIN_DATA}' >/dev/null 2>&1
+expect_eq "an unresolved data directory is a usage error" 2 "$?"
+
+# 6. apply writes nothing without a confirm, and never applies a per-domain identity.
+opts="$(jq -c --arg d "$HOME/work" '
+  .machine.options = [{key: "plug-a.registry_dir", value: "reports", verdict: "set", observed_by: "cat user settings", mode: "observed", supplied_by: "user-global"},
+                      {key: "plug-a.unset_option", verdict: "default-unexamined", skipped_because: "not looked at"}]
+  | .domains[$d].options = [{key: "plug-b.profile", value: "work", verdict: "set", observed_by: "cat include", mode: "observed", supplied_by: "git include"}]' <<<"$first")"
+run record --data-dir "$DATA" --confirm - <<<"$opts" >/dev/null
+before="$(state_hash)"
+out="$(run apply --data-dir "$DATA" --option plug-a.registry_dir --option plug-b.profile)"
+expect_eq "apply without --confirm writes nothing" "$before" "$(state_hash)"
+expect_has "apply without --confirm prints the plan" "plan plug-a.registry_dir" "$out"
+expect_lacks "apply without --confirm hands nothing off" "handoff" "$out"
+expect_has "apply without --confirm says so" "not confirmed" "$out"
+out="$(run apply --data-dir "$DATA" --option plug-a.registry_dir --option plug-b.profile --option plug-a.unset_option --confirm)"
+expect_eq "apply --confirm writes nothing itself" "$before" "$(state_hash)"
+expect_has "apply --confirm hands the machine option to its setup" "handoff plug-a.registry_dir" "$out"
+expect_has "apply stops for a per-domain identity option" "conflict plug-b.profile" "$out"
+expect_lacks "apply never hands off a per-domain identity" "handoff plug-b.profile" "$out"
+expect_has "apply skips an option with no non-default value" "skipped plug-a.unset_option" "$out"
+run apply --data-dir "$DATA" --option plug-a.missing >/dev/null
+expect_eq "apply refuses an unknown option" 1 "$?"
+run apply --data-dir "$DATA" >/dev/null 2>&1
+expect_eq "apply without a selected option is a usage error" 2 "$?"
+
+# 7. None of the read paths changed the fixture.
+run discover --prerequisites "$FIX/prereq.tsv" >/dev/null
+run diff --data-dir "$DATA" --prerequisites "$FIX/prereq.tsv" >/dev/null
+run explain --data-dir "$DATA" cores >/dev/null
+expect_eq "no read path changed the fixture HOME or repository" "$before" "$(state_hash)"
+
+if [[ "$FAILED" -ne 0 ]]; then
+  printf '%s case(s) failed\n' "$FAILED" >&2
+  exit 1
+fi
+echo "all cases passed"
diff --git a/plugins/claude-ops/skills/prerequisites/SKILL.md b/plugins/claude-ops/skills/prerequisites/SKILL.md
index 7ea83ffc92..5e43c228bc 100644
--- a/plugins/claude-ops/skills/prerequisites/SKILL.md
+++ b/plugins/claude-ops/skills/prerequisites/SKILL.md
@@ -29,6 +29,7 @@ With no arguments and a `claude` executable on PATH, the script reads the enable
 ## Next
 
 - A formatter or linter binary is missing: /actionlint:check, /bash-format:check, /biome-format:check, /go-format:check, /markdown-format:check, /powershell-format:check, /ruff-format:check or /typos-format:check
+- Record the whole machine's facts and identity domains, not only binaries: /claude-ops:machine-profile
 - The fleet's versions, a different question: /claude-ops:plugins audit
 
 ## Gotchas

From 623ebc1fb85e4e87743efce3c81dfe6ecbde5e4a Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 09:33:59 -0400
Subject: [PATCH 03/10] fix(claude-ops): read git identity domains from a
 neutral directory

Discovery ran git config in the caller's directory, so a repository-local
includeIf or an exported GIT_CONFIG changed the domains. It now reads the
effective user and system configuration from a neutral directory with the
git environment cleared, and the tests guard against a vacuous hash.

Refs: #4666

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 plugins/claude-ops/skills/machine-profile/SKILL.md     |  4 ++++
 .../skills/machine-profile/scripts/profile.sh          |  4 ++--
 .../skills/machine-profile/scripts/profile.test.sh     | 10 ++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/plugins/claude-ops/skills/machine-profile/SKILL.md b/plugins/claude-ops/skills/machine-profile/SKILL.md
index 02be9d6120..2076a1d436 100644
--- a/plugins/claude-ops/skills/machine-profile/SKILL.md
+++ b/plugins/claude-ops/skills/machine-profile/SKILL.md
@@ -62,6 +62,10 @@ Binary facts come only from the prerequisites table. Without `--prerequisites`,
 
 `diff` compares facts and identity only. Option records are stored state that discovery does not observe, so a hand-edited or never-applied option does not show as drift.
 
+`record` replaces the whole document, so options recorded earlier survive a re-record only when they are merged into the document first.
+
+Discovery reads the effective user and system git configuration from a neutral directory, so the repository the session runs in does not add or hide a domain.
+
 A read-only include file is detected with `test -w`; an immutable attribute on a file that still looks writable is not.
 
 Do not reapply a stored value from a hook, a session start or a schedule. `apply` re-asserts a value only when the operator selects it in that run.
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
index e516757012..cc02a04785 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
@@ -28,7 +28,7 @@ command -v jq >/dev/null 2>&1 || die "jq is required"
 # Every record in a document is checked here. Prints one line per problem.
 # shellcheck disable=SC2016  # jq source, not shell expansion
 VALIDATE_JQ='
-def nz: type == "string" and (gsub("\\s"; "") | length > 0);
+def nz: type == "string" and test("[^[:space:]]");
 def locs:
   ((.machine.facts // []) | to_entries[] | {w: "machine.facts[\(.key)]", r: .value}),
   ((.machine.options // []) | to_entries[] | {w: "machine.options[\(.key)]", r: .value}),
@@ -227,7 +227,7 @@ discover() {
       --argjson f1 "$(dir_fact tree_present "$tree")" \
       --argjson f2 "$(file_fact "git_include_file:$inc" "$inc")" \
       '{tree: $tree, git_include: $gi, gh: $gh, facts: [$f1, $f2]}')")
-  done < <(git config --list --show-origin 2>/dev/null |
+  done < <(cd / && env -u GIT_DIR -u GIT_WORK_TREE -u GIT_CONFIG git config --list --show-origin 2>/dev/null |
     jq -Rr 'capture("^(?<origin>[^\t]*)\t(?<key>includeif\\.gitdir(?:/i)?:(?<pat>.*)\\.path)=(?<inc>.*)$")? | [.origin, .pat, .inc] | @tsv')
 
   local m d doc
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
index ec85f0d489..d4aa0e42cc 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
@@ -15,6 +15,9 @@ expect_has() { if [[ "$3" == *"$2"* ]]; then pass "$1"; else fail "$1" "$2" "$3"
 expect_lacks() { if [[ "$3" != *"$2"* ]]; then pass "$1"; else fail "$1" "no $2" "$3"; fi; }
 
 command -v jq >/dev/null 2>&1 || { echo "SKIP: jq is not installed"; exit 0; }
+# The byte-identical hash needs both; without them it would hash empty input and pass vacuously.
+command -v sha256sum >/dev/null 2>&1 || { echo "SKIP: sha256sum is not installed"; exit 0; }
+find . -maxdepth 0 -printf '' >/dev/null 2>&1 || { echo "SKIP: find -printf is not available"; exit 0; }
 
 # FIX is the fixture HOME and repository. OUT holds everything a probe could
 # write (data directory, npm cache and logs) so the fixture hash stays meaningful.
@@ -48,6 +51,8 @@ printf 'export GH_CONFIG_DIR="$(pwd)/.gh"\n' >"$HOME/lab/.envrc"
 printf 'tool\tplugin\tstatus\tcheck\tinstall\nfixture-present\tplug-a\tpresent\t/plug-a:check\tinstall a\nfixture-missing\tplug-b\tmissing\t/plug-b:setup check\t\nmissing=1 present=1\n' >"$FIX/prereq.tsv"
 git -C "$FIX/repo" init -q
 git -C "$FIX/repo" -c user.name=fixture -c user.email=fixture@example.invalid commit --allow-empty -q -m init
+git -C "$FIX/repo" config 'includeIf.gitdir:~/scratch/.path' "$HOME/.gitconfig-oss"
+printf '[includeIf "gitdir:~/decoy/"]\n\tpath = ~/.gitconfig-oss\n' >"$FIX/decoy"
 chmod 444 "$HOME/.gitconfig-work"
 
 tree_hash() {
@@ -69,6 +74,11 @@ expect_eq "discover exits 0" 0 "$rc"
 expect_eq "discover prints only a JSON document, with no prompt" "true" "$(jq -e 'type == "object"' <<<"$first" >/dev/null 2>&1 && echo true || echo false)"
 expect_eq "two discoveries of an unchanged fixture match" "$first" "$second"
 expect_eq "discover leaves the fixture HOME and repository byte-identical" "$before" "$(tree_hash "$FIX")"
+from_home="$(cd "$HOME" && bash "$SCRIPT" discover --prerequisites "$FIX/prereq.tsv" </dev/null)"
+with_decoy="$(GIT_CONFIG="$FIX/decoy" run discover --prerequisites "$FIX/prereq.tsv" </dev/null)"
+expect_eq "discovery gives the same document from another directory" "$first" "$from_home"
+expect_eq "discovery gives the same document under an exported GIT_CONFIG" "$first" "$with_decoy"
+expect_lacks "a repository-local includeIf is not a machine domain" "scratch" "$first"
 
 expect_eq "one domain per includeIf tree" "$HOME/lab $HOME/oss $HOME/work" "$(jq -r '.domains | keys | join(" ")' <<<"$first")"
 expect_eq "git_include resolves relative to the including file" "$HOME/.gitconfig-oss" "$(jq -r --arg d "$HOME/oss" '.domains[$d].identity.git_include.value' <<<"$first")"

From f75ccd3d1989383982dbab45b618c55fc2b1f6b3 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 09:36:18 -0400
Subject: [PATCH 04/10] feat(claude-ops): wire machine-profile into the
 manifest, README and changelog

Bump claude-ops to 0.80.0, list the skill in the manifest description and
README, and regenerate the catalog and cheat sheet. The skill's cadence now
uses a value the cheat-sheet enum accepts.

Refs: #4666

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/catalog.md                                    | 2 +-
 docs/skill-cheat-sheet.md                          | 1 +
 plugins/claude-ops/.claude-plugin/plugin.json      | 4 ++--
 plugins/claude-ops/CHANGELOG.md                    | 6 ++++++
 plugins/claude-ops/README.md                       | 3 ++-
 plugins/claude-ops/skills/machine-profile/SKILL.md | 2 +-
 6 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/docs/catalog.md b/docs/catalog.md
index cd6623e6d8..f053591538 100644
--- a/docs/catalog.md
+++ b/docs/catalog.md
@@ -85,7 +85,7 @@ plugin manifests and kept in sync by CI. Never hand-edit it; the category vocabu
 - [`playbooks`](../plugins/playbooks): Doctrine and knowledge playbooks as on-demand skills, repo-sweep for running a catalog of hygiene skills through a repository one commit per step, plus a maintainer-facing update skill. boris carries Boris Cherny's Claude Code workflow tips (howborisusesclaudecode.com), skill-authoring carries Anthropic's internal skill-authoring playbook, and fable-5 carries Claude Fable 5's operating doctrine (self-authored, no upstream). The boris and skill-authoring packs vendor a verbatim upstream baseline; /playbooks:update drift-checks and syncs those baselines centrally (maintainers).
 - [`claude-config`](../plugins/claude-config): Nine configuration-health skills (plus setup) for a repo's Claude Code configuration: audit (settings.json / .mcp.json / hooks / plugins / permissions drift), audit-automation-gaps (evidence-gated verdicts on automation gaps), audit-permission-grants (allow-rule / allowed-tools grants for auto-mode durability and portability), audit-permission-state (the permission rules actually in effect: every settings scope merged with per-rule provenance, what auto mode drops on entry, config written where nothing reads it, and which managed intents are enforced versus loosenable), draft-auto-mode-rules (interview and draft a paste-ready autoMode classifier block; prints only, never writes), audit-instructions (locally-owned instruction surfaces vs current model capability, proposing removals/rewrites of instructions the model no longer needs, and detecting cross-surface instruction conflicts), audit-prompting-postures (the additive lane: posture guidance the prompting guide says a component's purpose needs but the component does not carry), audit-pass (one coordinated, ordered, resumable pass over a named target: three-scope inventory, run-time-derived exclusion set, stable finding identity, suppression memory, resume, one human gate, delegating every check to the plugin that owns it), and unhobble (the empirical bare-baseline experiment: reversibly strip a repo's standing instructions, log real stumbles against the current model, re-add only what evidence earns).
 - [`claude-memory`](../plugins/claude-memory): Keeps a repo's Claude Code memory layer healthy and under your control, against criteria derived from official Claude Code documentation. The audit skill checks the instruction/memory layer (CLAUDE.md, a root AGENTS.md, CLAUDE.local.md, .claude/rules/, auto-memory) with a deterministic script-backed spine plus judgment-tier checks. The stateless skill inspects, disables, and (confirm-gated) purges Claude-written auto memory across all settings scopes.
-- [`claude-ops`](../plugins/claude-ops): Claude Code operations toolkit. Fourteen skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used: a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which sheds descriptions lowest-score-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface: every built-in CLI command with aliases and hidden/gated status, every bundled skill, every built-in subagent and tool, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json: full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the unparsable-settings pause, which warns in /status, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labeled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age, plus on Windows a kernel-object census (Token objects against uptime, paged pool) that names a host-level leak beneath all four suspects; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces, namely built-in CLI commands, bundled skills, plugin-backed built-ins, and session-provided skills, against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry from the OTEL store, the collector, the per-session hook event log and hook-event JSONL, and ccusage, with trend reports, a per-session report of what fired, what was blocked and the event timeline, and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and turn them into decisions: apply executes those in scope one PR per owner plugin and hands larger ones off as work items, then re-extract the native surface and file its drift as work items), prerequisites (read-only table of external binaries declared by enabled plugins; never installs), check (read-only check that node and jq resolve for the claude-ops hooks; never installs), plugins (bring a machine's plugin fleet current on demand: marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view: queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action, an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry, the skill-usage log and the hook log root live, places the root's self-ignoring guard, and detects retired conventions. Plus an opt-in, default-off per-session hook event log (one JSON line per hook event on every event the generated registry marks observable, written to <root>/sessions/<session_id>.jsonl, with SessionEnd retention by session count or age and an optional detached pre-prune command), a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures. The last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that routes envelopes under the same root: per session when the envelope carries a session id, else into the shared hook-events.jsonl the observability skill reads.
+- [`claude-ops`](../plugins/claude-ops): Claude Code operations toolkit. Fifteen skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used: a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which sheds descriptions lowest-score-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface: every built-in CLI command with aliases and hidden/gated status, every bundled skill, every built-in subagent and tool, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json: full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the unparsable-settings pause, which warns in /status, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labeled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age, plus on Windows a kernel-object census (Token objects against uptime, paged pool) that names a host-level leak beneath all four suspects; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces, namely built-in CLI commands, bundled skills, plugin-backed built-ins, and session-provided skills, against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry from the OTEL store, the collector, the per-session hook event log and hook-event JSONL, and ccusage, with trend reports, a per-session report of what fired, what was blocked and the event timeline, and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and turn them into decisions: apply executes those in scope one PR per owner plugin and hands larger ones off as work items, then re-extract the native surface and file its drift as work items), prerequisites (read-only table of external binaries declared by enabled plugins; never installs), check (read-only check that node and jq resolve for the claude-ops hooks; never installs), machine-profile (discover this machine's facts and per-tree identity domains, store them as a re-runnable profile with the observation behind every value, and diff the stored profile against the host now; read-only unless the operator confirms a write, never installs and never reapplies a stored value on its own), plugins (bring a machine's plugin fleet current on demand: marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view: queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action, an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry, the skill-usage log and the hook log root live, places the root's self-ignoring guard, and detects retired conventions. Plus an opt-in, default-off per-session hook event log (one JSON line per hook event on every event the generated registry marks observable, written to <root>/sessions/<session_id>.jsonl, with SessionEnd retention by session count or age and an optional detached pre-prune command), a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures. The last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that routes envelopes under the same root: per session when the envelope carries a session id, else into the shared hook-events.jsonl the observability skill reads.
 - [`rate-limit-guard`](../plugins/rate-limit-guard): Shared rate-limit guard for loop lanes: a statusline wrapper tees the subscription rate-limit windows to a fixed machine-scope file, a StopFailure hook records rate-limit stops reactively, and a reader contract fixes how consuming sessions pause and resume.
 - [`context-guard`](../plugins/context-guard): Per-session context-window observability plus the first shipped consumer: a statusline wrapper tees each session's context_window fields to a per-session snapshot file, a zone resolver classifies usage into smart/acceptable/dumb bands (percentage bands plus window-class token bands, conservative-min combination, zones.json SSOT with shipped defaults), a reader contract fixes how consuming sessions interpret the snapshots, and zone-crossing hooks report once per transition into a worse zone across two channels: the continuation menu to the operator, who owns that choice, and to the model only the zone determination plus the counter-steer that a zone word is not a decay signal (advisory by default; an optional blocking mode gates new mutating work on a fresh dumb-zone snapshot with handoff-writing exempt), with a PostCompact hook persisting an evidence-degraded marker.
 - [`context-budget`](../plugins/context-budget): Measure a Claude Code session's fixed startup context payload per item, on the consumer's machine at a pinned, version-stamped binary, including per-tool attribution of the built-in tool pools that /context reports only as lump sums, derived live by A/B bare-name-deny differencing with enforced comparability rules (skill-listing signature, one mode, one binary), an SDK-primary exact meter degrading to a version-aware headless /context parser and then to an honest structured error (never a wrong number), and a per-project measure-toggle-remeasure ledger under the plugin data directory recording every lever's real before/after delta. Report-only by default; `fix` applies one approved project-scope trim.
diff --git a/docs/skill-cheat-sheet.md b/docs/skill-cheat-sheet.md
index 93e7ab235b..9bb40fddbe 100644
--- a/docs/skill-cheat-sheet.md
+++ b/docs/skill-cheat-sheet.md
@@ -305,6 +305,7 @@ owned by [docs/catalog-taxonomy.md](catalog-taxonomy.md).
 | [`/claude-ops:audit-skill-visibility`](../plugins/claude-ops/skills/audit-skill-visibility/SKILL.md) | `claude-ops` | weekly | Which skills the model can actually see, which are starved, and which are unobservable |
 | [`/claude-ops:inventory`](../plugins/claude-ops/skills/inventory/SKILL.md) | `claude-ops` | weekly | Enumerate every command, skill, agent, and plugin component this machine can invoke |
 | [`/claude-ops:lanes`](../plugins/claude-ops/skills/lanes/SKILL.md) | `claude-ops` | daily | Start, restart, stop, and check loop lanes as named background sessions |
+| [`/claude-ops:machine-profile`](../plugins/claude-ops/skills/machine-profile/SKILL.md) | `claude-ops` | weekly | Discover, store and diff machine facts and per-tree identity domains. Read-only by default. |
 | [`/claude-ops:morning-brief`](../plugins/claude-ops/skills/morning-brief/SKILL.md) | `claude-ops` | daily | Print the operator's read-only morning view. Queues, merge-ready PRs, parked decisions |
 | [`/claude-ops:observability`](../plugins/claude-ops/skills/observability/SKILL.md) | `claude-ops` | weekly | Report on locally captured telemetry. Token burn, cost, hook latency, per-session activity |
 | [`/claude-ops:plugins`](../plugins/claude-ops/skills/plugins/SKILL.md) | `claude-ops` | weekly | Bring the machine's plugin fleet current. Refresh, update, install per policy |
diff --git a/plugins/claude-ops/.claude-plugin/plugin.json b/plugins/claude-ops/.claude-plugin/plugin.json
index 3a51162608..f973767722 100644
--- a/plugins/claude-ops/.claude-plugin/plugin.json
+++ b/plugins/claude-ops/.claude-plugin/plugin.json
@@ -1,8 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "claude-ops",
-  "version": "0.79.0",
-  "description": "Claude Code operations toolkit. Fourteen skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used: a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which sheds descriptions lowest-score-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface: every built-in CLI command with aliases and hidden/gated status, every bundled skill, every built-in subagent and tool, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json: full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the unparsable-settings pause, which warns in /status, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labeled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age, plus on Windows a kernel-object census (Token objects against uptime, paged pool) that names a host-level leak beneath all four suspects; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces, namely built-in CLI commands, bundled skills, plugin-backed built-ins, and session-provided skills, against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry from the OTEL store, the collector, the per-session hook event log and hook-event JSONL, and ccusage, with trend reports, a per-session report of what fired, what was blocked and the event timeline, and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and turn them into decisions: apply executes those in scope one PR per owner plugin and hands larger ones off as work items, then re-extract the native surface and file its drift as work items), prerequisites (read-only table of external binaries declared by enabled plugins; never installs), check (read-only check that node and jq resolve for the claude-ops hooks; never installs), plugins (bring a machine's plugin fleet current on demand: marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view: queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action, an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry, the skill-usage log and the hook log root live, places the root's self-ignoring guard, and detects retired conventions. Plus an opt-in, default-off per-session hook event log (one JSON line per hook event on every event the generated registry marks observable, written to <root>/sessions/<session_id>.jsonl, with SessionEnd retention by session count or age and an optional detached pre-prune command), a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures. The last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that routes envelopes under the same root: per session when the envelope carries a session id, else into the shared hook-events.jsonl the observability skill reads.",
+  "version": "0.80.0",
+  "description": "Claude Code operations toolkit. Fifteen skills: audit-skill-visibility (audit whether each installed skill is actually VISIBLE to the model, and diagnose why most of a fleet never gets used: a skill is invisible when its description is dropped by Claude Code's skill-listing context budget, which sheds descriptions lowest-score-first so an unused skill loses the keywords that would let it be matched, from skills genuinely not wanted, from skills the run cannot observe at all; computes whether the listing overflows from documented settings, and withholds every cold verdict the data cannot support rather than reporting absence of data as absence of use), inventory (read-only enumeration of the complete invocable surface: every built-in CLI command with aliases and hidden/gated status, every bundled skill, every built-in subagent and tool, and every component of every installed plugin across all marketplaces; reads the shipped binary because upstream publishes no built-in command list, and carries an integrity verdict so a drifted build reports counts as floors rather than silently short totals), audit-install-state (read-only audit of the machine-scope ~/.claude installation directory and ~/.claude.json: full inventory split into an authored surface and rolled-up bulk trees, product-managed retention vs genuinely unmanaged state, filename-scheme resolution before any process-liveness check, and deliberate/mid-experiment detection; reports, never deletes), audit-performance (read-only slowness-diagnostic capture run at the moment the machine or a session feels slow: CLI version, retention-sweep health including the unparsable-settings pause, which warns in /status, a timed census walk of the install tree as a sweep-cost proxy, active-session and plugin-fleet counts, a process census, and the fan-out layer, which covers a load-labeled no-op spawn baseline, every hook that will fire bucketed per-tool-call versus per-turn with its invocation shape, the configured statusline, subagent concurrency and spawn-depth ceilings against documented defaults, whether running sessions predate the settings file they are judged by, and orphan attribution by parent liveness rather than age, plus on Windows a kernel-object census (Token objects against uptime, paged pool) that names a host-level leak beneath all four suspects; read against a bundled known-performance-issues reference that also records the causes tested and cleared; separates the four documented suspects of accumulated state, version regression, component bloat, and per-spawn fan-out cost, and routes remediation out; reports, never mutates, and never executes a discovered hook or statusline command), audit-native-overlap (map native Claude Code surfaces, namely built-in CLI commands, bundled skills, plugin-backed built-ins, and session-provided skills, against the current repo's plugin skills and agents, so a custom component never silently duplicates what Claude Code itself ships; bare invocation is a read-only overlap report carrying the extraction's integrity floors and a shared-listing-budget exposure section, verdicts are human-gated in a committed store rendered into a generated registry whose every row carries an observable recheck trigger, and only an explicit apply step bakes presence-gated native references into descriptions and Boundary sections), observability (read locally captured telemetry from the OTEL store, the collector, the per-session hook event log and hook-event JSONL, and ccusage, with trend reports, a per-session report of what fired, what was blocked and the event timeline, and store pruning), known-issues (search known Claude product GitHub bugs, check service health, maintain a persistent tracked-issue registry), changelog (ingest Claude Code changelog entries and turn them into decisions: apply executes those in scope one PR per owner plugin and hands larger ones off as work items, then re-extract the native surface and file its drift as work items), prerequisites (read-only table of external binaries declared by enabled plugins; never installs), check (read-only check that node and jq resolve for the claude-ops hooks; never installs), machine-profile (discover this machine's facts and per-tree identity domains, store them as a re-runnable profile with the observation behind every value, and diff the stored profile against the host now; read-only unless the operator confirms a write, never installs and never reapplies a stored value on its own), plugins (bring a machine's plugin fleet current on demand: marketplace refresh, effective-scope updates including in-repo project/local installs, new-plugin install per policy, scope-divergence detection and explicit convergence), morning-brief (read-only gh-based operator morning view: queue-label counts, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness), lanes (start/restart/stop/status loop lanes as named background Claude Code sessions seeded from canonical prompt files, with per-lane model/effort, a repo-pull + marketplace-refresh launch step, and a consume-restarts action, an OS-schedulable reader that relaunches stopped lanes whose telemetry carries a restart_request), and a re-runnable setup action that settles where the known-issues registry, the skill-usage log and the hook log root live, places the root's self-ignoring guard, and detects retired conventions. Plus an opt-in, default-off per-session hook event log (one JSON line per hook event on every event the generated registry marks observable, written to <root>/sessions/<session_id>.jsonl, with SessionEnd retention by session count or age and an optional detached pre-prune command), a family of eight advisory *-audit hooks (API errors, config changes, instruction loads, permission denials, pre-compaction, skill usage, tool failures, and unsurfaced hook failures. The last also warns the user via systemMessage, since a hook that fails to launch enforces nothing and Claude Code surfaces the failure to nobody) that emit the shared hook-telemetry envelope, and a reference sink that routes envelopes under the same root: per session when the envelope carries a session id, else into the shared hook-events.jsonl the observability skill reads.",
   "author": {
     "name": "Melodic Software",
     "email": "info@melodicsoftware.com"
diff --git a/plugins/claude-ops/CHANGELOG.md b/plugins/claude-ops/CHANGELOG.md
index b42b9cfade..4a123e7967 100644
--- a/plugins/claude-ops/CHANGELOG.md
+++ b/plugins/claude-ops/CHANGELOG.md
@@ -3,6 +3,12 @@
 All notable changes to the `claude-ops` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.80.0] - 2026-10-01
+
+### Added
+
+- **`/claude-ops:machine-profile` records what this machine has and reports when it changes.** It discovers machine facts and per-tree identity domains, stores them as a profile with the observation behind every value, and diffs the stored profile against the host. Read-only unless the operator confirms: `record --confirm` writes the profile and `apply --confirm` prints what to hand to each setup. It never installs and never reapplies a stored value on its own.
+
 ## [0.79.0] - 2026-10-01
 
 ### Added
diff --git a/plugins/claude-ops/README.md b/plugins/claude-ops/README.md
index aeb5b91094..13d4d8ddfd 100644
--- a/plugins/claude-ops/README.md
+++ b/plugins/claude-ops/README.md
@@ -11,7 +11,7 @@
 - [License](#license)
 
 A Claude Code plugin for running Claude Code well over time. One cohesive
-capability across fourteen skills and a family of telemetry-emitter hooks, including diagnosing why
+capability across fifteen skills and a family of telemetry-emitter hooks, including diagnosing why
 most of an installed skill fleet never gets used.
 audit-native-overlap maps native Claude Code surfaces against the current
 repo's own components so a custom skill never silently duplicates what the
@@ -44,6 +44,7 @@ Claude Code's native OTEL cannot see.
 | `/claude-ops:morning-brief` | Prints the read-only, `gh`-based operator morning view for the current repo in one pass: open counts per queue label (`needs-triage`, `status: ready`, `status: needs-decision`, `needs-human`), the gh-native merge-ready PR list (non-draft + `mergeStateStatus=CLEAN`), parked `status: needs-decision` issues with their RECOMMENDED lines, and loop-lane telemetry freshness (per-lane `last-cycle` age + `flags:`). Never mutates anything; the authoritative PR merge gate stays `/source-control:babysit-prs`. |
 | `/claude-ops:lanes` | Starts, restarts, stops, and reports loop lanes as named background Claude Code sessions seeded from canonical prompt files. `start` (default) / `restart` pull the repo and refresh the plugin marketplace, then launch each configured lane (`claude --bg -n <lane> --permission-mode auto`, plus `--permission-prompts none` on CLI 2.1.259 or later) with its per-lane `model`/`effort`; `status` shows per-lane running state and live sessionId; `stop` ends a lane via `claude stop`; `consume-restarts` is the OS-schedulable restart-request consumer. It reads each configured lane's telemetry `restart_request` and relaunches the stopped lanes that asked, through the same launcher (#1653). Acts only on sessions whose name is a configured lane. Lanes come from a JSON config (`--config`, else `$CLAUDE_OPS_LANES_CONFIG`, else `<repo>/.work/lanes/lanes.json`, with a temporary default-only fallback to the pre-move `<repo>/.work/lanes.json` under a deprecation warning); config and prompts live in the reserved `lanes/` concern home under a hardcoded `.work` root, which is a sanctioned placement but still session-local, so a durable cross-machine home stays #480's job. |
 | `/claude-ops:check` | Read-only check that `node` and `jq` resolve for the hooks, with the install route for a missing tool. Model-invocable; never installs. |
+| `/claude-ops:machine-profile` | Discovers this machine's facts and identity domains (each tree's git include, `gh` directory and verdicts), stores them as a re-runnable profile that records the observation behind every value, and reports drift between the stored profile and the host now. Actions: `profile` (default), `diff`, `explain <key>`, `apply --option <key>`. Read-only unless the operator confirms a write: `record --confirm` writes the profile document, and `apply --confirm` prints what to hand to each setup and writes nothing. Never installs and never reapplies a stored value on its own. Design: `docs/specs/machine-profile-design.md`. |
 | `/claude-ops:setup` | `check` reports the effective known-issues-registry, skill-usage-log and hook-log-root destinations, their defaults, path containment, the hook log root's self-ignoring guard, and retired conventions (`retirements.yaml`), and prints the guidance for routing personal option changes through Claude Code's plugin configuration prompt; `apply` writes exactly one file, the guard inside the hook log root, and runs the gated retirement cleanup. |
 
 ## The audit hooks
diff --git a/plugins/claude-ops/skills/machine-profile/SKILL.md b/plugins/claude-ops/skills/machine-profile/SKILL.md
index 2076a1d436..a144c8e3ae 100644
--- a/plugins/claude-ops/skills/machine-profile/SKILL.md
+++ b/plugins/claude-ops/skills/machine-profile/SKILL.md
@@ -6,7 +6,7 @@ disable-model-invocation: false
 metadata:
   workflow-stage: operator
   summary: Discover, store and diff machine facts and per-tree identity domains. Read-only by default.
-  cadence: on-demand
+  cadence: weekly
 ---
 
 ## Purpose

From 65aaf13b19efc33568d35a8a14bc1febd99a5411 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 09:45:48 -0400
Subject: [PATCH 05/10] fix(claude-ops): keep the machine-profile ledger entry
 to declined options

Indent the .gitconfig fixture lines with spaces so the editorconfig check
passes. Trim docs/out-of-scope/machine-profile.md to the two declined options,
restore its append-only Prior requests log, and say the profile relays a
`/<plugin>:setup check` line as a fallback instead of orchestrating the fleet
by instruction. Update the ledger README, which no longer lists the entry as an
unruled proposal.

Refs: #4666

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 docs/out-of-scope/README.md                   |  6 ++--
 docs/out-of-scope/machine-profile.md          | 29 ++++++++++---------
 .../machine-profile/scripts/profile.test.sh   |  6 ++--
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/docs/out-of-scope/README.md b/docs/out-of-scope/README.md
index 11df21babe..83bfb106b7 100644
--- a/docs/out-of-scope/README.md
+++ b/docs/out-of-scope/README.md
@@ -4,6 +4,6 @@ One file per rejection, matched and appended to as the `/work-items:triage` "Rej
 ledger" step defines. The ledger records rejections only, never built features or deferred work: a
 deferral, a park, or an open question is an open tracker item.
 
-Two entries are agent proposals the owner has not ruled on, not settled rejections:
-`machine-profile.md` (#4666) and `shared-surface-instruction-governance.md` (#3568). Each says so in
-its own text, and the owner's ruling on that issue confirms, reverses, or removes the entry.
+One entry is an agent proposal the owner has not ruled on, not a settled rejection:
+`shared-surface-instruction-governance.md` (#3568). It says so in its own text, and the owner's
+ruling on that issue confirms, reverses, or removes the entry.
diff --git a/docs/out-of-scope/machine-profile.md b/docs/out-of-scope/machine-profile.md
index 2961f2a3b4..a22ff06dcc 100644
--- a/docs/out-of-scope/machine-profile.md
+++ b/docs/out-of-scope/machine-profile.md
@@ -5,28 +5,31 @@ Record for
 
 ## Decision
 
-The design is ratified: [machine-profile-design](../specs/machine-profile-design.md), placed as a
-`claude-ops` skill by
-[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md). The skill is built as
-`claude-ops` `machine-profile`. Only the following stays rejected or held:
-
+The profile is built as the `claude-ops` `machine-profile` skill:
+[machine-profile-design](../specs/machine-profile-design.md), placed by
+[ADR 0041](../adr/0041-place-the-machine-profile-as-a-claude-ops-skill.md). Two options for it are
+declined:
+
+- **Orchestration by instruction (declined):** the profile does not orchestrate the whole fleet by
+  instruction, as a driver that has the operator type a command per plugin. Where it cannot safely
+  reproduce a setup's `check` probes it relays that one `/<plugin>:setup check` line, the fallback
+  the design describes.
 - **Setup contract change (declined):** no setup skill is changed and
   `validate-plugin-contracts.mjs` is untouched.
-- **Invocation-mode class (ii) change (held):** the setup skills stay
-  `disable-model-invocation: true`. Splitting `check` from `apply`, relaxing the flag on `check`,
-  or adding a class would each be a fleet contract change across every `setup` skill. The profile
-  relies on reproduction and relay instead.
-- **Orchestration by instruction (declined):** the profile does not emit `/<plugin>:setup check`
-  lines for the operator to type.
 
 ## Rationale
 
 - Every setup skill is model-hidden, so the profile cannot drive them directly.
-- Changing class (ii) is a fleet contract change, not a `claude-ops` slice.
+- Changing the setup contract or the invocation-mode class is a fleet change across every `setup`
+  skill, not a `claude-ops` slice.
 - Per-plugin setup owns prerequisite logic and versions with the plugin; the profile reads host
   facts and does not absorb that logic.
 
 ## Revisit when
 
 The built profile shows a check that the existing wrappers and reproduction cannot cover. The
-class (ii) decision is tracked with #4240.
+setup-contract question is tracked with #4240.
+
+## Prior requests
+
+- #4666 (2026-09-28): wayfind design item; parked here. Coordinated with #4240.
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
index d4aa0e42cc..10f6e4b233 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
@@ -36,11 +36,11 @@ STORE="$DATA/machine-profile/profile.json"
 mkdir -p "$HOME/work" "$HOME/oss" "$HOME/lab" "$FIX/repo" "$DATA"
 cat >"$HOME/.gitconfig" <<'EOF'
 [includeIf "gitdir:~/work/"]
-	path = ~/.gitconfig-work
+    path = ~/.gitconfig-work
 [includeIf "gitdir/i:~/oss/"]
-	path = .gitconfig-oss
+    path = .gitconfig-oss
 [includeIf "gitdir:~/lab/**"]
-	path = ~/.gitconfig-lab
+    path = ~/.gitconfig-lab
 EOF
 printf '[user]\n\temail = work@example.invalid\n' >"$HOME/.gitconfig-work"
 printf '[user]\n\temail = oss@example.invalid\n' >"$HOME/.gitconfig-oss"

From 4ffb6da872e9e7999b2429265e66b154698d0aa3 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 10:35:27 -0400
Subject: [PATCH 06/10] fix(claude-ops): keep include paths out of
 machine-profile fact keys

An includeIf path containing token, secret, password or credential made the
per-domain fact key match the validator's credential-key refusal and aborted
discover. The key now carries a hash of the path; the path stays in the
record's observed_by and guard. The credential-key refusal is unchanged.

Refs: #4666

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../skills/machine-profile/scripts/profile.sh       |  8 +++++++-
 .../skills/machine-profile/scripts/profile.test.sh  | 13 +++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
index cc02a04785..9a357bbef2 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
@@ -134,6 +134,12 @@ dir_fact() { # KEY DIR
   fi
 }
 
+# A stable key for a path: the key must not carry user-controlled text, which
+# the validator's credential-key refusal would otherwise match.
+path_key() { # PATH
+  printf '%s' "$1" | { sha256sum 2>/dev/null || shasum -a 256; } | cut -c1-12
+}
+
 file_fact() { # KEY FILE
   if [[ ! -e "$2" ]]; then
     rec "$1" absent default-verified --arg observed_by "test -e $2" --arg mode observed --arg observation "file not found"
@@ -225,7 +231,7 @@ discover() {
         --arg mode observed --arg supplied_by "git config includeIf gitdir")" \
       --argjson gh "$(gh_fact "$tree")" \
       --argjson f1 "$(dir_fact tree_present "$tree")" \
-      --argjson f2 "$(file_fact "git_include_file:$inc" "$inc")" \
+      --argjson f2 "$(file_fact "git_include_file:$(path_key "$inc")" "$inc")" \
       '{tree: $tree, git_include: $gi, gh: $gh, facts: [$f1, $f2]}')")
   done < <(cd / && env -u GIT_DIR -u GIT_WORK_TREE -u GIT_CONFIG git config --list --show-origin 2>/dev/null |
     jq -Rr 'capture("^(?<origin>[^\t]*)\t(?<key>includeif\\.gitdir(?:/i)?:(?<pat>.*)\\.path)=(?<inc>.*)$")? | [.origin, .pat, .inc] | @tsv')
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
index 10f6e4b233..e874ea75da 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
@@ -98,6 +98,19 @@ if [[ "$(id -u)" -ne 0 ]]; then
   expect_has "the blocked guard names the operator command" "chmod u+w" "$(jq -r --arg d "$HOME/work" '.domains[$d].facts[] | select(.verdict == "blocked") | .guard' <<<"$first")"
 fi
 
+# 1b. An include path that contains a credential word does not reach a fact key.
+CRED="$OUT/credpath"
+mkdir -p "$CRED/home/secret-dir" "$CRED/home/Token_dir"
+printf '[includeIf "gitdir:~/sx/"]\n\tpath = ~/secret-dir/gitconfig\n[includeIf "gitdir:~/tx/"]\n\tpath = ~/Token_dir/gitconfig\n' >"$CRED/gitconfig"
+printf '[user]\n\temail = x@example.invalid\n' >"$CRED/home/secret-dir/gitconfig"
+cred="$(HOME="$CRED/home" GIT_CONFIG_GLOBAL="$CRED/gitconfig" run discover </dev/null)"
+rc=$?
+expect_eq "an include path naming secret or token still discovers" 0 "$rc"
+expect_eq "both include trees are recorded" 2 "$(jq '.domains | length' <<<"$cred")"
+expect_eq "an include path with a credential word records its fact under a path-free key" "writable" "$(jq -r '.domains[] | .facts[] | select(.key | startswith("git_include_file:")) | .value' <<<"$cred" | head -n 1)"
+expect_eq "no fact key carries the include path text" "0" "$(jq '[.domains[].facts[].key | select(test("secret|token"; "i"))] | length' <<<"$cred")"
+expect_has "the include path is kept in the record" "secret-dir/gitconfig" "$cred"
+
 # 2. Store, then diff an unchanged fixture: an empty diff and no prompt.
 dry="$(run record --data-dir "$DATA" - <<<"$first")"
 expect_has "record without --confirm says nothing was written" "dry run, nothing written" "$dry"

From bf7e7965463fd18340da78c9dcf970958be25ab8 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 10:51:57 -0400
Subject: [PATCH 07/10] fix(claude-ops): bracket credential words in every
 machine-profile key discover derives

A declared binary such as secret-tool, git-credential-manager or
docker-credential-pass made discover build a binary.<tool> key that matched the
validator's credential-key refusal and aborted the whole run. The same defect
was fixed only for the include-path builder, with a hash.

rec now brackets the first letter of each credential word in a key (binary.[s]ecret-tool),
so every key discovery derives is handled at the one point it passes through, and the
per-builder hash is removed. The pattern is defined once and feeds both rec and the
validator. Every derived key is a fixed literal, binary.<tool> or
git_include_file:<path>, and none holds a secret value. The value-pattern refusal
still runs on every record, and a hand-supplied record keyed api_token is still refused.

Regression tests run discover, record, diff and explain over credential-named binaries
and include paths.

Refs: #4666

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../skills/machine-profile/SKILL.md           |  2 ++
 .../skills/machine-profile/scripts/profile.sh | 27 +++++++++++--------
 .../machine-profile/scripts/profile.test.sh   | 25 ++++++++++++++---
 3 files changed, 39 insertions(+), 15 deletions(-)

diff --git a/plugins/claude-ops/skills/machine-profile/SKILL.md b/plugins/claude-ops/skills/machine-profile/SKILL.md
index a144c8e3ae..595b6785a9 100644
--- a/plugins/claude-ops/skills/machine-profile/SKILL.md
+++ b/plugins/claude-ops/skills/machine-profile/SKILL.md
@@ -60,6 +60,8 @@ Discovery reads identity domains from the `includeIf "gitdir:..."` entries in `g
 
 Binary facts come only from the prerequisites table. Without `--prerequisites`, discovery records `binaries` as `default-unexamined` and adds no probe of its own, so a `diff` run without the table reports the per-tool rows as removed.
 
+The writer refuses a record whose key contains `token`, `secret`, `password` or `credential`. A key discovery derives from host text (a binary such as `secret-tool`, an include path under a `token` directory) gets the first letter of each such word bracketed, as `binary.[s]ecret-tool`, so the profile still records it. `explain` needs the bracketed key, and a hand-supplied record keyed `api_token` is still refused.
+
 `diff` compares facts and identity only. Option records are stored state that discovery does not observe, so a hand-edited or never-applied option does not show as drift.
 
 `record` replaces the whole document, so options recorded earlier survive a re-record only when they are merged into the document first.
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
index 9a357bbef2..31c37a3ab2 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
@@ -25,6 +25,10 @@ die() {
 
 command -v jq >/dev/null 2>&1 || die "jq is required"
 
+# Words a record key may not contain. The validator refuses them in a hand-supplied
+# key, and rec rewrites them in a key discovery derives, from this one pattern.
+CRED_RE='token|secret|password|credential'
+
 # Every record in a document is checked here. Prints one line per problem.
 # shellcheck disable=SC2016  # jq source, not shell expansion
 VALIDATE_JQ='
@@ -64,7 +68,7 @@ def rp:
         (if $r.verdict == "set" and ($r.supplied_by | nz | not) then "set requires supplied_by" else empty end),
         (if $r.verdict == "blocked" and ($r.guard | nz | not) then "blocked requires guard" else empty end)
       end),
-      (if ($r.key | type) == "string" and ($r.key | test("token|secret|password|credential"; "i")) then "key names a credential" else empty end),
+      (if ($r.key | type) == "string" and ($r.key | test($cred; "i")) then "key names a credential" else empty end),
       ($r | .. | strings | select(test("gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}")) | "holds what looks like a credential")
     ] | .[] | "\($w): \(.)" end;
 def dupkeys($w): map(select(type == "object") | .key) | group_by(.) | map(select(length > 1)) | .[] | "\($w): duplicate key \(.[0])";
@@ -108,9 +112,16 @@ def side($t): "  \($t)";
   else empty end
 '
 
-# rec KEY VALUE VERDICT [--arg FIELD VALUE ...] -> one compact JSON record.
+# rec KEY VALUE VERDICT [--arg FIELD VALUE ...] -> one compact JSON record. Every
+# key discovery derives from host text (a binary name, an include path) passes
+# through here, so a credential word in it is bracketed (secret-tool becomes
+# [s]ecret-tool) and no longer matches the validator's refusal. Hand-supplied
+# records never pass through here.
+# shellcheck disable=SC2016  # jq source, not shell expansion
 rec() {
-  jq -nc '$ARGS.named' --arg key "$1" --arg value "$2" --arg verdict "$3" "${@:4}"
+  jq -nc --arg cred "$CRED_RE" '$ARGS.named | del(.cred)
+    | .key |= gsub("(?=\($cred))(?<c>.)"; "[\(.c)]"; "i")' \
+    --arg key "$1" --arg value "$2" --arg verdict "$3" "${@:4}"
 }
 
 unexamined() { # KEY REASON
@@ -134,12 +145,6 @@ dir_fact() { # KEY DIR
   fi
 }
 
-# A stable key for a path: the key must not carry user-controlled text, which
-# the validator's credential-key refusal would otherwise match.
-path_key() { # PATH
-  printf '%s' "$1" | { sha256sum 2>/dev/null || shasum -a 256; } | cut -c1-12
-}
-
 file_fact() { # KEY FILE
   if [[ ! -e "$2" ]]; then
     rec "$1" absent default-verified --arg observed_by "test -e $2" --arg mode observed --arg observation "file not found"
@@ -231,7 +236,7 @@ discover() {
         --arg mode observed --arg supplied_by "git config includeIf gitdir")" \
       --argjson gh "$(gh_fact "$tree")" \
       --argjson f1 "$(dir_fact tree_present "$tree")" \
-      --argjson f2 "$(file_fact "git_include_file:$(path_key "$inc")" "$inc")" \
+      --argjson f2 "$(file_fact "git_include_file:$inc" "$inc")" \
       '{tree: $tree, git_include: $gi, gh: $gh, facts: [$f1, $f2]}')")
   done < <(cd / && env -u GIT_DIR -u GIT_WORK_TREE -u GIT_CONFIG git config --list --show-origin 2>/dev/null |
     jq -Rr 'capture("^(?<origin>[^\t]*)\t(?<key>includeif\\.gitdir(?:/i)?:(?<pat>.*)\\.path)=(?<inc>.*)$")? | [.origin, .pat, .inc] | @tsv')
@@ -255,7 +260,7 @@ discover() {
 validate() {
   local problems
   jq -e . >/dev/null 2>&1 <<<"$1" || { echo "profile.sh: refused: the document is not valid JSON" >&2; return 1; }
-  problems="$(jq -r "$VALIDATE_JQ" <<<"$1")" || return 1
+  problems="$(jq -r --arg cred "$CRED_RE" "$VALIDATE_JQ" <<<"$1")" || return 1
   [[ -z "$problems" ]] && return 0
   printf 'profile.sh: refused:\n  %s\n' "${problems//$'\n'/$'\n'  }" >&2
   return 1
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
index e874ea75da..4cf6ace11a 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
@@ -98,7 +98,8 @@ if [[ "$(id -u)" -ne 0 ]]; then
   expect_has "the blocked guard names the operator command" "chmod u+w" "$(jq -r --arg d "$HOME/work" '.domains[$d].facts[] | select(.verdict == "blocked") | .guard' <<<"$first")"
 fi
 
-# 1b. An include path that contains a credential word does not reach a fact key.
+# 1b. A credential word in a key discovery derives (an include path, a binary
+# name) does not abort discover, and the document survives record, diff and explain.
 CRED="$OUT/credpath"
 mkdir -p "$CRED/home/secret-dir" "$CRED/home/Token_dir"
 printf '[includeIf "gitdir:~/sx/"]\n\tpath = ~/secret-dir/gitconfig\n[includeIf "gitdir:~/tx/"]\n\tpath = ~/Token_dir/gitconfig\n' >"$CRED/gitconfig"
@@ -107,9 +108,25 @@ cred="$(HOME="$CRED/home" GIT_CONFIG_GLOBAL="$CRED/gitconfig" run discover </dev
 rc=$?
 expect_eq "an include path naming secret or token still discovers" 0 "$rc"
 expect_eq "both include trees are recorded" 2 "$(jq '.domains | length' <<<"$cred")"
-expect_eq "an include path with a credential word records its fact under a path-free key" "writable" "$(jq -r '.domains[] | .facts[] | select(.key | startswith("git_include_file:")) | .value' <<<"$cred" | head -n 1)"
-expect_eq "no fact key carries the include path text" "0" "$(jq '[.domains[].facts[].key | select(test("secret|token"; "i"))] | length' <<<"$cred")"
-expect_has "the include path is kept in the record" "secret-dir/gitconfig" "$cred"
+expect_eq "an include path with a credential word keeps its fact" "writable" "$(jq -r '.domains[] | .facts[] | select(.key | startswith("git_include_file:")) | .value' <<<"$cred" | head -n 1)"
+expect_eq "no include-path fact key matches the credential pattern" "0" "$(jq '[.domains[].facts[].key | select(test("token|secret|password|credential"; "i"))] | length' <<<"$cred")"
+expect_has "the include path stays readable in its key" "/home/[s]ecret-dir/gitconfig" "$(jq -r '.domains[].facts[].key' <<<"$cred")"
+
+printf 'tool\tplugin\tstatus\tcheck\tinstall\nsecret-tool\tplug-a\tpresent\t/plug-a:check\tx\ngit-credential-manager\tplug-a\tmissing\t/plug-a:check\tx\ndocker-credential-pass\tplug-b\tpresent\t/plug-b:check\t\nsecretoken\tplug-b\tpresent\t/plug-b:check\t\n' >"$OUT/credbin.tsv"
+CREDDATA="$OUT/creddata"
+credbin="$(run discover --prerequisites "$OUT/credbin.tsv" </dev/null)"
+rc=$?
+expect_eq "a declared binary named for a credential tool still discovers" 0 "$rc"
+expect_eq "each credential word in a binary key is bracketed, overlaps included" "binary.[s]ecre[t]oken binary.[s]ecret-tool binary.docker-[c]redential-pass binary.git-[c]redential-manager" "$(jq -r '[.machine.facts[].key | select(startswith("binary."))] | sort | join(" ")' <<<"$credbin")"
+expect_eq "a credential-named binary keeps its observed value" "present" "$(jq -r '.machine.facts[] | select(.key == "binary.[s]ecret-tool") | .value' <<<"$credbin")"
+expect_eq "no discovered key matches the credential pattern" "0" "$(jq '[.machine.facts[].key | select(test("token|secret|password|credential"; "i"))] | length' <<<"$credbin")"
+run record --data-dir "$CREDDATA" --confirm - <<<"$credbin" >/dev/null 2>&1
+expect_eq "record accepts the discovered document" 0 "$?"
+out="$(run diff --data-dir "$CREDDATA" --prerequisites "$OUT/credbin.tsv" </dev/null 2>&1)"
+rc=$?
+expect_eq "diff of the stored credential-named keys exits 0" 0 "$rc"
+expect_eq "diff of the stored credential-named keys prints nothing" "" "$out"
+expect_has "explain resolves a bracketed key" '"verdict":"set"' "$(run explain --data-dir "$CREDDATA" 'binary.[s]ecret-tool' 2>&1)"
 
 # 2. Store, then diff an unchanged fixture: an empty diff and no prompt.
 dry="$(run record --data-dir "$DATA" - <<<"$first")"

From b51d82891002444621043dc56f1d93622e79431f Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 11:10:35 -0400
Subject: [PATCH 08/10] fix(claude-ops): widen the machine-profile credential
 refusal and close review findings

The validator refused only GitHub token values and four key words. It now also
refuses AWS, Slack and sk- tokens, JWTs, private-key blocks, URLs with an
embedded password, and api_key or private_key words in a key, from one pattern
per side that rec also reads. Option arrays now get the duplicate-key check,
a drive-letter git config origin resolves relative includes against its own
file, and a tree reached through two origins keeps every observed_by. The
bracketed-key literals no longer trip the spell check or the machine-path
check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../skills/machine-profile/SKILL.md           |  2 +-
 .../skills/machine-profile/scripts/profile.sh | 28 +++++++++-----
 .../machine-profile/scripts/profile.test.sh   | 38 +++++++++++++++++--
 3 files changed, 54 insertions(+), 14 deletions(-)

diff --git a/plugins/claude-ops/skills/machine-profile/SKILL.md b/plugins/claude-ops/skills/machine-profile/SKILL.md
index 595b6785a9..80b3152e7e 100644
--- a/plugins/claude-ops/skills/machine-profile/SKILL.md
+++ b/plugins/claude-ops/skills/machine-profile/SKILL.md
@@ -60,7 +60,7 @@ Discovery reads identity domains from the `includeIf "gitdir:..."` entries in `g
 
 Binary facts come only from the prerequisites table. Without `--prerequisites`, discovery records `binaries` as `default-unexamined` and adds no probe of its own, so a `diff` run without the table reports the per-tool rows as removed.
 
-The writer refuses a record whose key contains `token`, `secret`, `password` or `credential`. A key discovery derives from host text (a binary such as `secret-tool`, an include path under a `token` directory) gets the first letter of each such word bracketed, as `binary.[s]ecret-tool`, so the profile still records it. `explain` needs the bracketed key, and a hand-supplied record keyed `api_token` is still refused.
+The writer refuses a record whose key contains `token`, `secret`, `password`, `credential`, `api_key` or `private_key`, and a record whose value looks like a credential: a GitHub, AWS, Slack or `sk-` token, a JWT, a private-key block, or a URL with an embedded password. A key discovery derives from host text (a binary such as `docker-credential-pass`, an include path under a `token` directory) gets the first letter of each such word bracketed, as `binary.docker-[c]redential-pass`, so the profile still records it. `explain` needs the bracketed key, and a hand-supplied record keyed `api_token` is still refused.
 
 `diff` compares facts and identity only. Option records are stored state that discovery does not observe, so a hand-edited or never-applied option does not show as drift.
 
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
index 31c37a3ab2..26de0bedee 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
@@ -27,7 +27,10 @@ command -v jq >/dev/null 2>&1 || die "jq is required"
 
 # Words a record key may not contain. The validator refuses them in a hand-supplied
 # key, and rec rewrites them in a key discovery derives, from this one pattern.
-CRED_RE='token|secret|password|credential'
+CRED_RE='token|secret|passw(?:or)?d|credential|api.?key|private.?key'
+# Value shapes the validator refuses in any string of a record: GitHub, AWS, Slack and
+# sk- API tokens, JWTs, private-key blocks, and a password embedded in a URL.
+VAL_RE='gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|\b(AKIA|ASIA)[0-9A-Z]{16}\b|\bxox[abprs]-[A-Za-z0-9-]{10,}|\bsk-[A-Za-z0-9_-]{20,}|\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|://[^/[:space:]:@]+:[^/[:space:]@]+@'
 
 # Every record in a document is checked here. Prints one line per problem.
 # shellcheck disable=SC2016  # jq source, not shell expansion
@@ -69,7 +72,7 @@ def rp:
         (if $r.verdict == "blocked" and ($r.guard | nz | not) then "blocked requires guard" else empty end)
       end),
       (if ($r.key | type) == "string" and ($r.key | test($cred; "i")) then "key names a credential" else empty end),
-      ($r | .. | strings | select(test("gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}")) | "holds what looks like a credential")
+      ($r | .. | strings | select(test($val)) | "holds what looks like a credential")
     ] | .[] | "\($w): \(.)" end;
 def dupkeys($w): map(select(type == "object") | .key) | group_by(.) | map(select(length > 1)) | .[] | "\($w): duplicate key \(.[0])";
 if type != "object" then "document must be an object"
@@ -77,7 +80,10 @@ else ([shape] as $s
   | if ($s | length) > 0 then $s[]
     else (locs | rp),
          ((.machine.facts // []) | dupkeys("machine.facts")),
-         ((.domains // {}) | to_entries[] | .key as $d | (.value.facts // []) | dupkeys("domains[\($d)].facts"))
+         ((.machine.options // []) | dupkeys("machine.options")),
+         ((.domains // {}) | to_entries[] | .key as $d
+           | ((.value.facts // []) | dupkeys("domains[\($d)].facts")),
+             ((.value.options // []) | dupkeys("domains[\($d)].options")))
     end) end
 '
 
@@ -114,9 +120,9 @@ def side($t): "  \($t)";
 
 # rec KEY VALUE VERDICT [--arg FIELD VALUE ...] -> one compact JSON record. Every
 # key discovery derives from host text (a binary name, an include path) passes
-# through here, so a credential word in it is bracketed (secret-tool becomes
-# [s]ecret-tool) and no longer matches the validator's refusal. Hand-supplied
-# records never pass through here.
+# through here, so the first letter of a credential word in it is bracketed and the
+# key no longer matches the validator's refusal. Hand-supplied records never pass
+# through here.
 # shellcheck disable=SC2016  # jq source, not shell expansion
 rec() {
   jq -nc --arg cred "$CRED_RE" '$ARGS.named | del(.cred)
@@ -230,7 +236,9 @@ discover() {
     [[ -n "$pat" && -n "$inc" ]] || continue
     tree="$(expand_home "$pat")"; tree="${tree%/}"; tree="${tree%/\*\*}"; tree="${tree%/}"
     inc="$(expand_home "$inc")"
-    if [[ "$inc" != /* && "$origin" == file:/* ]]; then inc="$(dirname "${origin#file:}")/$inc"; fi
+    if [[ "$inc" != /* && ! "$inc" =~ ^[A-Za-z]:/ && ("$origin" == file:/* || "$origin" =~ ^file:[A-Za-z]:/) ]]; then
+      inc="$(dirname "${origin#file:}")/$inc"
+    fi
     pairs+=("$(jq -nc --arg tree "$tree" \
       --argjson gi "$(rec git_include "$inc" set --arg observed_by "git config --list --show-origin ($origin)" \
         --arg mode observed --arg supplied_by "git config includeIf gitdir")" \
@@ -249,7 +257,9 @@ discover() {
      domains: ($d | group_by(.tree) | map(. as $g | {key: $g[0].tree, value: {
         tree: $g[0].tree,
         identity: {
-          git_include: ($g[0].git_include | .value = ($g | map(.git_include.value) | unique | join(", "))),
+          git_include: ($g[0].git_include
+            | .value = ($g | map(.git_include.value) | unique | join(", "))
+            | .observed_by = ($g | map(.git_include.observed_by) | unique | join("; "))),
           gh_config_dir: $g[0].gh},
         facts: ($g | map(.facts[]) | unique_by(.key) | sort_by(.key)),
         options: []}}) | from_entries)}')"
@@ -260,7 +270,7 @@ discover() {
 validate() {
   local problems
   jq -e . >/dev/null 2>&1 <<<"$1" || { echo "profile.sh: refused: the document is not valid JSON" >&2; return 1; }
-  problems="$(jq -r --arg cred "$CRED_RE" "$VALIDATE_JQ" <<<"$1")" || return 1
+  problems="$(jq -r --arg cred "$CRED_RE" --arg val "$VAL_RE" "$VALIDATE_JQ" <<<"$1")" || return 1
   [[ -z "$problems" ]] && return 0
   printf 'profile.sh: refused:\n  %s\n' "${problems//$'\n'/$'\n'  }" >&2
   return 1
diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
index 4cf6ace11a..0ac84a6690 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.test.sh
@@ -110,15 +110,15 @@ expect_eq "an include path naming secret or token still discovers" 0 "$rc"
 expect_eq "both include trees are recorded" 2 "$(jq '.domains | length' <<<"$cred")"
 expect_eq "an include path with a credential word keeps its fact" "writable" "$(jq -r '.domains[] | .facts[] | select(.key | startswith("git_include_file:")) | .value' <<<"$cred" | head -n 1)"
 expect_eq "no include-path fact key matches the credential pattern" "0" "$(jq '[.domains[].facts[].key | select(test("token|secret|password|credential"; "i"))] | length' <<<"$cred")"
-expect_has "the include path stays readable in its key" "/home/[s]ecret-dir/gitconfig" "$(jq -r '.domains[].facts[].key' <<<"$cred")"
+expect_has "the include path stays readable in its key" "[T]oken_dir/gitconfig" "$(jq -r '.domains[].facts[].key' <<<"$cred")"
 
 printf 'tool\tplugin\tstatus\tcheck\tinstall\nsecret-tool\tplug-a\tpresent\t/plug-a:check\tx\ngit-credential-manager\tplug-a\tmissing\t/plug-a:check\tx\ndocker-credential-pass\tplug-b\tpresent\t/plug-b:check\t\nsecretoken\tplug-b\tpresent\t/plug-b:check\t\n' >"$OUT/credbin.tsv"
 CREDDATA="$OUT/creddata"
 credbin="$(run discover --prerequisites "$OUT/credbin.tsv" </dev/null)"
 rc=$?
 expect_eq "a declared binary named for a credential tool still discovers" 0 "$rc"
-expect_eq "each credential word in a binary key is bracketed, overlaps included" "binary.[s]ecre[t]oken binary.[s]ecret-tool binary.docker-[c]redential-pass binary.git-[c]redential-manager" "$(jq -r '[.machine.facts[].key | select(startswith("binary."))] | sort | join(" ")' <<<"$credbin")"
-expect_eq "a credential-named binary keeps its observed value" "present" "$(jq -r '.machine.facts[] | select(.key == "binary.[s]ecret-tool") | .value' <<<"$credbin")"
+expect_eq "each credential word in a binary key is bracketed, overlaps included" "binary.[s]ecre[t]oken binary.[s]ecret-tool binary.docker-[c]redential-pass binary.git-[c]redential-manager" "$(jq -r '[.machine.facts[].key | select(startswith("binary."))] | sort | join(" ")' <<<"$credbin")" # spellchecker:disable-line
+expect_eq "a credential-named binary keeps its observed value" "present" "$(jq -r '.machine.facts[] | select(.key == "binary.[s]ecret-tool") | .value' <<<"$credbin")" # spellchecker:disable-line
 expect_eq "no discovered key matches the credential pattern" "0" "$(jq '[.machine.facts[].key | select(test("token|secret|password|credential"; "i"))] | length' <<<"$credbin")"
 run record --data-dir "$CREDDATA" --confirm - <<<"$credbin" >/dev/null 2>&1
 expect_eq "record accepts the discovered document" 0 "$?"
@@ -126,7 +126,27 @@ out="$(run diff --data-dir "$CREDDATA" --prerequisites "$OUT/credbin.tsv" </dev/
 rc=$?
 expect_eq "diff of the stored credential-named keys exits 0" 0 "$rc"
 expect_eq "diff of the stored credential-named keys prints nothing" "" "$out"
-expect_has "explain resolves a bracketed key" '"verdict":"set"' "$(run explain --data-dir "$CREDDATA" 'binary.[s]ecret-tool' 2>&1)"
+expect_has "explain resolves a bracketed key" '"verdict":"set"' "$(run explain --data-dir "$CREDDATA" 'binary.[s]ecret-tool' 2>&1)" # spellchecker:disable-line
+
+# 1c. A drive-letter origin resolves a relative include against the including file,
+# and a tree reached through two origins keeps both observations.
+REAL_GIT="$(command -v git)"
+STUB="$OUT/stub"
+mkdir -p "$STUB"
+cat >"$STUB/git" <<EOF
+#!/usr/bin/env bash
+if [[ "\$1 \$2 \$3" == "config --list --show-origin" ]]; then
+  printf 'file:C:/cfg/.gitconfig\tincludeif.gitdir:~/w/.path=.gitconfig-work\n'
+  printf 'file:/etc/gitconfig\tincludeif.gitdir:~/w/.path=/etc/gitconfig-corp\n'
+  exit 0
+fi
+exec "$REAL_GIT" "\$@"
+EOF
+chmod +x "$STUB/git"
+multi="$(PATH="$STUB:$PATH" run discover </dev/null)"
+expect_has "a drive-letter origin resolves a relative include against its file" 'git_include_file:C:/cfg/.gitconfig-work' "$(jq -r '.domains[].facts[].key' <<<"$multi")"
+expect_eq "a drive-letter include is not resolved against the repository" "0" "$(jq '[.domains[].facts[].key | select(contains("repo/"))] | length' <<<"$multi")"
+expect_eq "a tree reached through two origins names both in observed_by" "2" "$(jq '.domains[].identity.git_include.observed_by | split("; ") | length' <<<"$multi")"
 
 # 2. Store, then diff an unchanged fixture: an empty diff and no prompt.
 dry="$(run record --data-dir "$DATA" - <<<"$first")"
@@ -196,6 +216,16 @@ refuse "blocked without a guard is refused" '{"key":"k","value":"v","verdict":"b
 refuse "set without supplied_by is refused" '{"key":"k","value":"v","verdict":"set","observed_by":"ls","mode":"observed"}'
 refuse "a credential value is refused" '{"key":"k","value":"ghp_abcdefghijklmnopqrstuvwxyz0123","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
 refuse "a credential key is refused" '{"key":"api_token","value":"x","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+refuse "a sensitive userConfig key is refused" '{"key":"dometrain-mcp.dometrain_api_key","value":"x","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+refuse "an AWS access key value is refused" '{"key":"k","value":"AKIA'"IOSFODNN7EXAMPLE"'","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+refuse "a Slack token value is refused" '{"key":"k","value":"xoxb-123456789012-abcdefghij","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+refuse "a URL with an embedded password is refused" '{"key":"k","value":"postgres://admin:Sup3rPassw0rd@host/db","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+refuse "a private key block is refused" '{"key":"k","value":"-----BEGIN RSA PRIVATE KEY-----","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+accept "a path with sk- inside a word is accepted" '{"key":"k","value":"/work/task-management-system-notes-dir","verdict":"set","observed_by":"ls","mode":"observed","supplied_by":"host"}'
+dup_opts="$(jq -c '{machine: {facts: [], options: [{key:"o",value:"a",verdict:"set",observed_by:"ls",mode:"observed",supplied_by:"host"},{key:"o",value:"b",verdict:"set",observed_by:"ls",mode:"observed",supplied_by:"host"}]}, domains: {}}' <<<'{}')"
+msg="$(run record --data-dir "$DATA" --confirm - <<<"$dup_opts" 2>&1)"
+expect_eq "duplicate option keys are refused: exit 1" 1 "$?"
+expect_has "the refusal names the duplicate option key" "machine.options: duplicate key o" "$msg"
 accept "default-unexamined with skipped_because is accepted" '{"key":"k","verdict":"default-unexamined","skipped_because":"no discovery source is defined for it"}'
 accept "default-verified with an observation is accepted" '{"key":"k","value":"","verdict":"default-verified","observed_by":"ls /x","mode":"observed","observation":"directory not found"}'
 

From d1cf41d5d850592d8af8b960eb1105ab1f3104dd Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 11:38:48 -0400
Subject: [PATCH 09/10] fix(claude-ops): use lookarounds instead of \b in the
 machine-profile value pattern

The shell-portability lint reads \b in a shell script as a GNU-only grep
construct. The pattern runs in jq, so lookarounds express the same boundary.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugins/claude-ops/skills/machine-profile/scripts/profile.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
index 26de0bedee..ee3bf383f9 100755
--- a/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
+++ b/plugins/claude-ops/skills/machine-profile/scripts/profile.sh
@@ -30,7 +30,7 @@ command -v jq >/dev/null 2>&1 || die "jq is required"
 CRED_RE='token|secret|passw(?:or)?d|credential|api.?key|private.?key'
 # Value shapes the validator refuses in any string of a record: GitHub, AWS, Slack and
 # sk- API tokens, JWTs, private-key blocks, and a password embedded in a URL.
-VAL_RE='gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|\b(AKIA|ASIA)[0-9A-Z]{16}\b|\bxox[abprs]-[A-Za-z0-9-]{10,}|\bsk-[A-Za-z0-9_-]{20,}|\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|://[^/[:space:]:@]+:[^/[:space:]@]+@'
+VAL_RE='gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|(?<![A-Za-z0-9])(AKIA|ASIA)[0-9A-Z]{16}(?![A-Za-z0-9])|(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{10,}|(?<![A-Za-z0-9])sk-[A-Za-z0-9_-]{20,}|(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|://[^/[:space:]:@]+:[^/[:space:]@]+@'
 
 # Every record in a document is checked here. Prints one line per problem.
 # shellcheck disable=SC2016  # jq source, not shell expansion

From aad7263098b49bb5956a709dbcf55dc4df982335 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 1 Oct 2026 12:40:45 -0400
Subject: [PATCH 10/10] docs(claude-ops): state what the machine-profile writer
 actually refuses

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugins/claude-ops/skills/machine-profile/SKILL.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/claude-ops/skills/machine-profile/SKILL.md b/plugins/claude-ops/skills/machine-profile/SKILL.md
index 80b3152e7e..67d7b6139a 100644
--- a/plugins/claude-ops/skills/machine-profile/SKILL.md
+++ b/plugins/claude-ops/skills/machine-profile/SKILL.md
@@ -28,7 +28,7 @@ Exit codes: 0 ok, 1 refused, 2 usage or missing tool (`jq`), 3 no profile stored
 
 ## Where the profile lives
 
-`${CLAUDE_PLUGIN_DATA}/machine-profile/profile.json`. The machine section is not project-keyed (it describes the host, the same for every project), which the design ratifies as a deviation from `docs/conventions/plugin-data-report-keying` rule 1; each domain is keyed by its tree root. A missing document reads as "no profile for this machine" and offers to produce one; there is no fallback path. The document is regenerable from the host, so uninstalling the plugin from its last scope costs a re-run, not data. It holds names, paths and observation commands, never a credential or a sensitive `userConfig` value, and the writer refuses a record that looks like one.
+`${CLAUDE_PLUGIN_DATA}/machine-profile/profile.json`. The machine section is not project-keyed (it describes the host, the same for every project), which the design ratifies as a deviation from `docs/conventions/plugin-data-report-keying` rule 1; each domain is keyed by its tree root. A missing document reads as "no profile for this machine" and offers to produce one; there is no fallback path. The document is regenerable from the host, so uninstalling the plugin from its last scope costs a re-run, not data. It holds names, paths and observation commands, and discovery never reads a credential or a sensitive `userConfig` value. The writer is a backstop for hand-supplied records, not a secret detector: it refuses the key words and value shapes listed under Gotchas, so do not supply a secret that matches neither.
 
 **Claim:** `${CLAUDE_PLUGIN_DATA}` resolves to `~/.claude/plugins/data/{id}/` and is deleted on uninstall from the last scope unless `--keep-data` is passed. **Basis:** [plugins reference](https://code.claude.com/docs/en/plugins-reference), Persistent data directory, as quoted in the keying convention (fetched 2026-08-12). **As of:** 2026-10-01. **Recheck:** the plugins reference changes the data directory formula or its uninstall behavior.