From eebf281d4e7fc3d9d38ee6458c2e86ae91975892 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 27 Sep 2026 18:18:03 +0000
Subject: [PATCH 1/5] docs: close audit gaps for Node floor, command budget,
 SECURITY posture
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Document Node 24.2+ for pharn/floor CLIs (import.meta.main), contributor
command-hygiene budget, and 6.24.0 write-guard semantics in SECURITY.
Ship apply patch and helper script for worktrees.

Co-authored-by: Przemysław Galarowicz <pgalarowicz@gmail.com>
---
 CHANGELOG.md              |  4 ++
 CONTRIBUTING.md           | 12 ++++++
 README.md                 |  7 +++-
 SECURITY.md               |  4 +-
 apply_docs_audit_patch.py | 30 +++++++++++++++
 docs-audit-gaps-1-3.patch | 78 +++++++++++++++++++++++++++++++++++++++
 6 files changed, 131 insertions(+), 4 deletions(-)
 create mode 100755 apply_docs_audit_patch.py
 create mode 100644 docs-audit-gaps-1-3.patch

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f66d1685..194f925b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+### Changed
+
+- 2026-09-27: **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README now states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass. Repo meta only — no `SKILLS_VERSION` bump.
+
 <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
      this section carries exactly ONE heading per type. A new entry joins its existing group at that
      group's top — it does not open a second `### Added`.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7d2c91ed..f88095e8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -44,6 +44,18 @@ Three doc regions are **generated, never hand-edited**: `docs/capabilities/**`,
 
 What that buys is **byte-equality** — the committed output equals a fresh regeneration — never that the generated content is _right_: a wrong enumerator regenerates cleanly and stays GREEN. See [`CLAUDE.md`](./CLAUDE.md) ("Three doc regions are GENERATED") for the full rule, including the one case (`ENUM_ERROR` — a duplicate lesson id, an unsafe title) where regenerating cannot help and the canon file has to be fixed instead.
 
+### Editing product commands (`.claude/commands/pharn-*.md`)
+
+Since 6.28.2, [`.dev/floor/command-hygiene.test.mjs`](./.dev/floor/command-hygiene.test.mjs) enforces a **command budget** on every shipped `pharn-*` command (not `pharn-dev-*`):
+
+- **Size** — each command's bytes must stay at or below its row in the test's `COMMAND_BYTE_CEILINGS` table (closed over the product commands on disk, both ways).
+- **Frontmatter `description:`** — at most 250 bytes and must not match the test's claim-vocabulary regex.
+- **Claims block** — exactly one `## What you may claim` heading per command.
+
+The test checks presence and limits, not whether a claim is true. If an increment genuinely needs a larger command, **raise the ceiling in the same PR** by editing `COMMAND_BYTE_CEILINGS`: take the command's measured byte size, add 10%, round up to the next multiple of 512 — never a quiet edit to turn a red test green. Rationale and bounds live in [`CLAUDE.md`](./CLAUDE.md) ("A product command keeps what a run executes…").
+
+`AGENTS.md` at the repo root is **gitignored** (a local Codex copy). It does not ship; if you use Codex here, regenerate it from `CLAUDE.md` when the latter moves.
+
 ### CHANGELOG entries
 
 `pharn-cli` installs the tip of `main`, and `pharn update` points users at [`CHANGELOG.md`](./CHANGELOG.md). So every merge to `main` is a release, and the CHANGELOG is the only record a user reads of what reached them. Four rules:
diff --git a/README.md b/README.md
index 8264be45..7e817a96 100644
--- a/README.md
+++ b/README.md
@@ -109,8 +109,11 @@ them. The goal is not to make AI development look clean. The goal is to make it
 
 ## Quick start
 
-PHARN runs on [Claude Code](https://claude.com/claude-code). The installer requires Node 20 or newer. In
-your project root:
+PHARN runs on [Claude Code](https://claude.com/claude-code). The `@pharn-dev/pharn` installer requires
+Node 20 or newer. The deterministic floor checkers this repo ships (`pharn/floor/*.mjs`, invoked by the
+`/pharn-*` stages) require **Node 24.2 or newer**: their CLI entry points gate on `import.meta.main`, which
+Node added in 22.18 / 24.2. On an older Node a guarded tool can exit `0` without running its checks — a
+silent false green for several gates. CI and local contributor gates use Node 24. In your project root:
 
 ```bash
 npx @pharn-dev/pharn@latest init
diff --git a/SECURITY.md b/SECURITY.md
index 36cd425f..f4b2514d 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -4,7 +4,7 @@ PHARN is an audit-grade methodology — taking security seriously is part of the
 
 ## What this repo is, and its security surface
 
-This repository **is PHARN-OSS** — the audit-grade methodology itself. It is ready to install and use with Claude Code today; active development continues, and functionality that has not shipped yet is explicitly labeled. Its security surface is small by design: four trusted markdown spec docs, the `pharn-dev-*` build and `pharn-*` product commands, the hooks under `.claude/hooks/` — the two `PreToolUse` write guards (`protect-trusted-paths.cjs`, the protected-path guard, and `enforce-writes-scope.cjs`, the writes-scope guard), the scope setter they read (`set-writes-scope.cjs`), and the `/pharn-loop` `Stop` guard (`require-loop-record.cjs`, which fails open by design) — and the deterministic floor (`pharn/floor/`). No transpile step, no bundled runtime dependencies, no network egress, no secrets — stdlib-only Node (`.cjs`/`.mjs`) plus markdown.
+This repository **is PHARN-OSS** — the audit-grade methodology itself. It is ready to install and use with Claude Code today; active development continues, and functionality that has not shipped yet is explicitly labeled. Its security surface is small by design: four trusted markdown spec docs, the `pharn-dev-*` build and `pharn-*` product commands, the hooks under `.claude/hooks/` — the two `PreToolUse` write guards (`protect-trusted-paths.cjs`, the protected-path guard, and `enforce-writes-scope.cjs`, the writes-scope guard), the scope setter they read (`set-writes-scope.cjs`), the run markers `/pharn-ship`, `/pharn-loop` and `/pharn-review` open and close via `pharn/floor/run-marker.mjs` (presence under `.pharn/pharn-{ship,loop,review}/<name>/active.json` — the guard reads only path and age, never contents), and the `/pharn-loop` `Stop` guard (`require-loop-record.cjs`, which fails open by design) — and the deterministic floor (`pharn/floor/`). No transpile step, no bundled runtime dependencies, no network egress, no secrets — stdlib-only Node (`.cjs`/`.mjs`) plus markdown.
 
 PHARN's security model (`THREAT-MODEL.md`, threat model B) starts from one axiom: **prompt injection is not solved.** An agent that must read hostile context — code under review, fetched docs, accumulated memory, another model's output — cannot be made to reliably ignore instructions embedded in that content. Defense therefore rests on the **deterministic floor** (hooks, content-hashes, enum/regex checks that do not depend on model judgment), not on "the model will notice the attack." The security-relevant surfaces of this repo follow from that shape.
 
@@ -48,7 +48,7 @@ We will keep you informed throughout, coordinate disclosure timing with you, and
 ### In scope
 
 - **Prompt injection** in the trusted spec docs, the `pharn-dev-*` / `pharn-*` commands, or a capability — content that bypasses the constitution, or launders untrusted data into a guaranteed decision (the trust-fence; `THREAT-MODEL.md §5`).
-- **Write-guard bypass** — any input that makes `protect-trusted-paths.cjs` _allow_ a Write/Edit it should deny to a path it protects — a trusted doc, `CODEOWNERS`, the guards' own settings files and hook scripts, `.pharn/writes-scope.json`, the project SPEC template (`pharn.spec-template.md`), git metadata, or memory-bank canon outside a promotion scope — or makes `enforce-writes-scope.cjs` allow a write outside the active scope (e.g. a path-normalization or path-traversal gap; fix #2 / fix #7, `THREAT-MODEL.md §4`). Writes through the Bash tool are outside both hooks by design (`LIMITS.md §6`), so a Bash write on its own is not a bypass.
+- **Write-guard bypass** — any input that makes `protect-trusted-paths.cjs` _allow_ a Write/Edit it should deny to a path it protects — a trusted doc, `CODEOWNERS`, the guards' own settings files and hook scripts, `.pharn/writes-scope.json`, the project SPEC template (`pharn.spec-template.md`), git metadata, or memory-bank canon outside a promotion scope — or makes `enforce-writes-scope.cjs` _allow_ a Write/Edit the guard would deny under the posture and scope that should apply (dev checkout, installed project with an open PHARN run, installed project outside a run, explicit `writes-scope.json`, etc.; fix #2 / fix #7, `THREAT-MODEL.md §4`, CHANGELOG [6.24.0]). **Not a bypass:** since 6.24.0, an installed project with no active scope and no open `/pharn-ship`, `/pharn-loop`, or `/pharn-review` run intentionally uses a permissive default that allows most in-project writes — that is documented product behavior, not a guard failure. A bypass is a normalization, traversal, symlink-resolution, or logic flaw that reaches a path the guard should still deny given the correct posture. Writes through the Bash tool are outside both hooks by design (`LIMITS.md §6`), so a Bash write on its own is not a bypass (fix #7 detects some Bash writes at verify time, but does not prevent them).
 - **Floor false-negative** — a logic flaw in `pharn/floor/validate.mjs` (or any `pharn/floor/*.mjs` checker) that reports GREEN for input violating an invariant it claims to enforce (a false guarantee — the exact P0 failure mode).
 - Any other defect in the executable floor (a `.claude/hooks/*.cjs` hook or a `pharn/floor/*.mjs` checker) that undermines a guarantee the docs claim.
 
diff --git a/apply_docs_audit_patch.py b/apply_docs_audit_patch.py
new file mode 100755
index 00000000..4fe849fc
--- /dev/null
+++ b/apply_docs_audit_patch.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+"""Apply docs-audit-gaps-1-3.patch in a PHARN-OSS worktree."""
+import subprocess
+import sys
+from pathlib import Path
+
+def main():
+    repo = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else Path.cwd().resolve()
+    patch = repo / "docs-audit-gaps-1-3.patch"
+    if not (repo / "SKILLS_VERSION").is_file():
+        sys.stderr.write(f"Not PHARN-OSS root: {repo}\n")
+        return 2
+    if not patch.is_file():
+        sys.stderr.write(f"Missing {patch}\n")
+        return 2
+    for cmd in (
+        ["git", "-C", str(repo), "apply", "--check", str(patch)],
+        ["git", "-C", str(repo), "apply", str(patch)],
+    ):
+        r = subprocess.run(cmd, capture_output=True, text=True)
+        if r.returncode:
+            sys.stderr.write(r.stderr or r.stdout)
+            return r.returncode
+    print(f"Applied {patch.name}")
+    print("Run: npm run check:changelog && npm run check:changelog-entry")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(main())
+
diff --git a/docs-audit-gaps-1-3.patch b/docs-audit-gaps-1-3.patch
new file mode 100644
index 00000000..33af687a
--- /dev/null
+++ b/docs-audit-gaps-1-3.patch
@@ -0,0 +1,78 @@
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index f66d168..194f925 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+ 
+ ## [Unreleased]
+ 
++### Changed
++
++- 2026-09-27: **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README now states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass. Repo meta only — no `SKILLS_VERSION` bump.
++
+ <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
+      this section carries exactly ONE heading per type. A new entry joins its existing group at that
+      group's top — it does not open a second `### Added`.
+diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
+index 7d2c91e..f88095e 100644
+--- a/CONTRIBUTING.md
++++ b/CONTRIBUTING.md
+@@ -44,6 +44,18 @@ Three doc regions are **generated, never hand-edited**: `docs/capabilities/**`,
+ 
+ What that buys is **byte-equality** — the committed output equals a fresh regeneration — never that the generated content is _right_: a wrong enumerator regenerates cleanly and stays GREEN. See [`CLAUDE.md`](./CLAUDE.md) ("Three doc regions are GENERATED") for the full rule, including the one case (`ENUM_ERROR` — a duplicate lesson id, an unsafe title) where regenerating cannot help and the canon file has to be fixed instead.
+ 
++### Editing product commands (`.claude/commands/pharn-*.md`)
++
++Since 6.28.2, [`.dev/floor/command-hygiene.test.mjs`](./.dev/floor/command-hygiene.test.mjs) enforces a **command budget** on every shipped `pharn-*` command (not `pharn-dev-*`):
++
++- **Size** — each command's bytes must stay at or below its row in the test's `COMMAND_BYTE_CEILINGS` table (closed over the product commands on disk, both ways).
++- **Frontmatter `description:`** — at most 250 bytes and must not match the test's claim-vocabulary regex.
++- **Claims block** — exactly one `## What you may claim` heading per command.
++
++The test checks presence and limits, not whether a claim is true. If an increment genuinely needs a larger command, **raise the ceiling in the same PR** by editing `COMMAND_BYTE_CEILINGS`: take the command's measured byte size, add 10%, round up to the next multiple of 512 — never a quiet edit to turn a red test green. Rationale and bounds live in [`CLAUDE.md`](./CLAUDE.md) ("A product command keeps what a run executes…").
++
++`AGENTS.md` at the repo root is **gitignored** (a local Codex copy). It does not ship; if you use Codex here, regenerate it from `CLAUDE.md` when the latter moves.
++
+ ### CHANGELOG entries
+ 
+ `pharn-cli` installs the tip of `main`, and `pharn update` points users at [`CHANGELOG.md`](./CHANGELOG.md). So every merge to `main` is a release, and the CHANGELOG is the only record a user reads of what reached them. Four rules:
+diff --git a/README.md b/README.md
+index 8264be4..7e817a9 100644
+--- a/README.md
++++ b/README.md
+@@ -109,8 +109,11 @@ them. The goal is not to make AI development look clean. The goal is to make it
+ 
+ ## Quick start
+ 
+-PHARN runs on [Claude Code](https://claude.com/claude-code). The installer requires Node 20 or newer. In
+-your project root:
++PHARN runs on [Claude Code](https://claude.com/claude-code). The `@pharn-dev/pharn` installer requires
++Node 20 or newer. The deterministic floor checkers this repo ships (`pharn/floor/*.mjs`, invoked by the
++`/pharn-*` stages) require **Node 24.2 or newer**: their CLI entry points gate on `import.meta.main`, which
++Node added in 22.18 / 24.2. On an older Node a guarded tool can exit `0` without running its checks — a
++silent false green for several gates. CI and local contributor gates use Node 24. In your project root:
+ 
+ ```bash
+ npx @pharn-dev/pharn@latest init
+diff --git a/SECURITY.md b/SECURITY.md
+index 36cd425..f4b2514 100644
+--- a/SECURITY.md
++++ b/SECURITY.md
+@@ -4,7 +4,7 @@ PHARN is an audit-grade methodology — taking security seriously is part of the
+ 
+ ## What this repo is, and its security surface
+ 
+-This repository **is PHARN-OSS** — the audit-grade methodology itself. It is ready to install and use with Claude Code today; active development continues, and functionality that has not shipped yet is explicitly labeled. Its security surface is small by design: four trusted markdown spec docs, the `pharn-dev-*` build and `pharn-*` product commands, the hooks under `.claude/hooks/` — the two `PreToolUse` write guards (`protect-trusted-paths.cjs`, the protected-path guard, and `enforce-writes-scope.cjs`, the writes-scope guard), the scope setter they read (`set-writes-scope.cjs`), and the `/pharn-loop` `Stop` guard (`require-loop-record.cjs`, which fails open by design) — and the deterministic floor (`pharn/floor/`). No transpile step, no bundled runtime dependencies, no network egress, no secrets — stdlib-only Node (`.cjs`/`.mjs`) plus markdown.
++This repository **is PHARN-OSS** — the audit-grade methodology itself. It is ready to install and use with Claude Code today; active development continues, and functionality that has not shipped yet is explicitly labeled. Its security surface is small by design: four trusted markdown spec docs, the `pharn-dev-*` build and `pharn-*` product commands, the hooks under `.claude/hooks/` — the two `PreToolUse` write guards (`protect-trusted-paths.cjs`, the protected-path guard, and `enforce-writes-scope.cjs`, the writes-scope guard), the scope setter they read (`set-writes-scope.cjs`), the run markers `/pharn-ship`, `/pharn-loop` and `/pharn-review` open and close via `pharn/floor/run-marker.mjs` (presence under `.pharn/pharn-{ship,loop,review}/<name>/active.json` — the guard reads only path and age, never contents), and the `/pharn-loop` `Stop` guard (`require-loop-record.cjs`, which fails open by design) — and the deterministic floor (`pharn/floor/`). No transpile step, no bundled runtime dependencies, no network egress, no secrets — stdlib-only Node (`.cjs`/`.mjs`) plus markdown.
+ 
+ PHARN's security model (`THREAT-MODEL.md`, threat model B) starts from one axiom: **prompt injection is not solved.** An agent that must read hostile context — code under review, fetched docs, accumulated memory, another model's output — cannot be made to reliably ignore instructions embedded in that content. Defense therefore rests on the **deterministic floor** (hooks, content-hashes, enum/regex checks that do not depend on model judgment), not on "the model will notice the attack." The security-relevant surfaces of this repo follow from that shape.
+ 
+@@ -48,7 +48,7 @@ We will keep you informed throughout, coordinate disclosure timing with you, and
+ ### In scope
+ 
+ - **Prompt injection** in the trusted spec docs, the `pharn-dev-*` / `pharn-*` commands, or a capability — content that bypasses the constitution, or launders untrusted data into a guaranteed decision (the trust-fence; `THREAT-MODEL.md §5`).
+-- **Write-guard bypass** — any input that makes `protect-trusted-paths.cjs` _allow_ a Write/Edit it should deny to a path it protects — a trusted doc, `CODEOWNERS`, the guards' own settings files and hook scripts, `.pharn/writes-scope.json`, the project SPEC template (`pharn.spec-template.md`), git metadata, or memory-bank canon outside a promotion scope — or makes `enforce-writes-scope.cjs` allow a write outside the active scope (e.g. a path-normalization or path-traversal gap; fix #2 / fix #7, `THREAT-MODEL.md §4`). Writes through the Bash tool are outside both hooks by design (`LIMITS.md §6`), so a Bash write on its own is not a bypass.
++- **Write-guard bypass** — any input that makes `protect-trusted-paths.cjs` _allow_ a Write/Edit it should deny to a path it protects — a trusted doc, `CODEOWNERS`, the guards' own settings files and hook scripts, `.pharn/writes-scope.json`, the project SPEC template (`pharn.spec-template.md`), git metadata, or memory-bank canon outside a promotion scope — or makes `enforce-writes-scope.cjs` _allow_ a Write/Edit the guard would deny under the posture and scope that should apply (dev checkout, installed project with an open PHARN run, installed project outside a run, explicit `writes-scope.json`, etc.; fix #2 / fix #7, `THREAT-MODEL.md §4`, CHANGELOG [6.24.0]). **Not a bypass:** since 6.24.0, an installed project with no active scope and no open `/pharn-ship`, `/pharn-loop`, or `/pharn-review` run intentionally uses a permissive default that allows most in-project writes — that is documented product behavior, not a guard failure. A bypass is a normalization, traversal, symlink-resolution, or logic flaw that reaches a path the guard should still deny given the correct posture. Writes through the Bash tool are outside both hooks by design (`LIMITS.md §6`), so a Bash write on its own is not a bypass (fix #7 detects some Bash writes at verify time, but does not prevent them).
+ - **Floor false-negative** — a logic flaw in `pharn/floor/validate.mjs` (or any `pharn/floor/*.mjs` checker) that reports GREEN for input violating an invariant it claims to enforce (a false guarantee — the exact P0 failure mode).
+ - Any other defect in the executable floor (a `.claude/hooks/*.cjs` hook or a `pharn/floor/*.mjs` checker) that undermines a guarantee the docs claim.
+ 

From 49c420231f47901e494893813d6b1936387bbfc7 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 27 Sep 2026 18:22:14 +0000
Subject: [PATCH 2/5] chore: remove one-shot patch and apply script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Przemysław Galarowicz <pgalarowicz@gmail.com>
---
 CHANGELOG.md              |  1 +
 apply_docs_audit_patch.py | 30 ---------------
 docs-audit-gaps-1-3.patch | 78 ---------------------------------------
 3 files changed, 1 insertion(+), 108 deletions(-)
 delete mode 100755 apply_docs_audit_patch.py
 delete mode 100644 docs-audit-gaps-1-3.patch

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 194f925b..ab86c686 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 ### Changed
 
 - 2026-09-27: **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README now states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass. Repo meta only — no `SKILLS_VERSION` bump.
+- 2026-09-27: **Remove one-shot `docs-audit-gaps-1-3.patch` and `apply_docs_audit_patch.py`** after the doc edits landed — repo meta only.
 
 <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
      this section carries exactly ONE heading per type. A new entry joins its existing group at that
diff --git a/apply_docs_audit_patch.py b/apply_docs_audit_patch.py
deleted file mode 100755
index 4fe849fc..00000000
--- a/apply_docs_audit_patch.py
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env python3
-"""Apply docs-audit-gaps-1-3.patch in a PHARN-OSS worktree."""
-import subprocess
-import sys
-from pathlib import Path
-
-def main():
-    repo = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else Path.cwd().resolve()
-    patch = repo / "docs-audit-gaps-1-3.patch"
-    if not (repo / "SKILLS_VERSION").is_file():
-        sys.stderr.write(f"Not PHARN-OSS root: {repo}\n")
-        return 2
-    if not patch.is_file():
-        sys.stderr.write(f"Missing {patch}\n")
-        return 2
-    for cmd in (
-        ["git", "-C", str(repo), "apply", "--check", str(patch)],
-        ["git", "-C", str(repo), "apply", str(patch)],
-    ):
-        r = subprocess.run(cmd, capture_output=True, text=True)
-        if r.returncode:
-            sys.stderr.write(r.stderr or r.stdout)
-            return r.returncode
-    print(f"Applied {patch.name}")
-    print("Run: npm run check:changelog && npm run check:changelog-entry")
-    return 0
-
-if __name__ == "__main__":
-    raise SystemExit(main())
-
diff --git a/docs-audit-gaps-1-3.patch b/docs-audit-gaps-1-3.patch
deleted file mode 100644
index 33af687a..00000000
--- a/docs-audit-gaps-1-3.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-diff --git a/CHANGELOG.md b/CHANGELOG.md
-index f66d168..194f925 100644
---- a/CHANGELOG.md
-+++ b/CHANGELOG.md
-@@ -8,6 +8,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
- 
- ## [Unreleased]
- 
-+### Changed
-+
-+- 2026-09-27: **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README now states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass. Repo meta only — no `SKILLS_VERSION` bump.
-+
- <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
-      this section carries exactly ONE heading per type. A new entry joins its existing group at that
-      group's top — it does not open a second `### Added`.
-diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
-index 7d2c91e..f88095e 100644
---- a/CONTRIBUTING.md
-+++ b/CONTRIBUTING.md
-@@ -44,6 +44,18 @@ Three doc regions are **generated, never hand-edited**: `docs/capabilities/**`,
- 
- What that buys is **byte-equality** — the committed output equals a fresh regeneration — never that the generated content is _right_: a wrong enumerator regenerates cleanly and stays GREEN. See [`CLAUDE.md`](./CLAUDE.md) ("Three doc regions are GENERATED") for the full rule, including the one case (`ENUM_ERROR` — a duplicate lesson id, an unsafe title) where regenerating cannot help and the canon file has to be fixed instead.
- 
-+### Editing product commands (`.claude/commands/pharn-*.md`)
-+
-+Since 6.28.2, [`.dev/floor/command-hygiene.test.mjs`](./.dev/floor/command-hygiene.test.mjs) enforces a **command budget** on every shipped `pharn-*` command (not `pharn-dev-*`):
-+
-+- **Size** — each command's bytes must stay at or below its row in the test's `COMMAND_BYTE_CEILINGS` table (closed over the product commands on disk, both ways).
-+- **Frontmatter `description:`** — at most 250 bytes and must not match the test's claim-vocabulary regex.
-+- **Claims block** — exactly one `## What you may claim` heading per command.
-+
-+The test checks presence and limits, not whether a claim is true. If an increment genuinely needs a larger command, **raise the ceiling in the same PR** by editing `COMMAND_BYTE_CEILINGS`: take the command's measured byte size, add 10%, round up to the next multiple of 512 — never a quiet edit to turn a red test green. Rationale and bounds live in [`CLAUDE.md`](./CLAUDE.md) ("A product command keeps what a run executes…").
-+
-+`AGENTS.md` at the repo root is **gitignored** (a local Codex copy). It does not ship; if you use Codex here, regenerate it from `CLAUDE.md` when the latter moves.
-+
- ### CHANGELOG entries
- 
- `pharn-cli` installs the tip of `main`, and `pharn update` points users at [`CHANGELOG.md`](./CHANGELOG.md). So every merge to `main` is a release, and the CHANGELOG is the only record a user reads of what reached them. Four rules:
-diff --git a/README.md b/README.md
-index 8264be4..7e817a9 100644
---- a/README.md
-+++ b/README.md
-@@ -109,8 +109,11 @@ them. The goal is not to make AI development look clean. The goal is to make it
- 
- ## Quick start
- 
--PHARN runs on [Claude Code](https://claude.com/claude-code). The installer requires Node 20 or newer. In
--your project root:
-+PHARN runs on [Claude Code](https://claude.com/claude-code). The `@pharn-dev/pharn` installer requires
-+Node 20 or newer. The deterministic floor checkers this repo ships (`pharn/floor/*.mjs`, invoked by the
-+`/pharn-*` stages) require **Node 24.2 or newer**: their CLI entry points gate on `import.meta.main`, which
-+Node added in 22.18 / 24.2. On an older Node a guarded tool can exit `0` without running its checks — a
-+silent false green for several gates. CI and local contributor gates use Node 24. In your project root:
- 
- ```bash
- npx @pharn-dev/pharn@latest init
-diff --git a/SECURITY.md b/SECURITY.md
-index 36cd425..f4b2514 100644
---- a/SECURITY.md
-+++ b/SECURITY.md
-@@ -4,7 +4,7 @@ PHARN is an audit-grade methodology — taking security seriously is part of the
- 
- ## What this repo is, and its security surface
- 
--This repository **is PHARN-OSS** — the audit-grade methodology itself. It is ready to install and use with Claude Code today; active development continues, and functionality that has not shipped yet is explicitly labeled. Its security surface is small by design: four trusted markdown spec docs, the `pharn-dev-*` build and `pharn-*` product commands, the hooks under `.claude/hooks/` — the two `PreToolUse` write guards (`protect-trusted-paths.cjs`, the protected-path guard, and `enforce-writes-scope.cjs`, the writes-scope guard), the scope setter they read (`set-writes-scope.cjs`), and the `/pharn-loop` `Stop` guard (`require-loop-record.cjs`, which fails open by design) — and the deterministic floor (`pharn/floor/`). No transpile step, no bundled runtime dependencies, no network egress, no secrets — stdlib-only Node (`.cjs`/`.mjs`) plus markdown.
-+This repository **is PHARN-OSS** — the audit-grade methodology itself. It is ready to install and use with Claude Code today; active development continues, and functionality that has not shipped yet is explicitly labeled. Its security surface is small by design: four trusted markdown spec docs, the `pharn-dev-*` build and `pharn-*` product commands, the hooks under `.claude/hooks/` — the two `PreToolUse` write guards (`protect-trusted-paths.cjs`, the protected-path guard, and `enforce-writes-scope.cjs`, the writes-scope guard), the scope setter they read (`set-writes-scope.cjs`), the run markers `/pharn-ship`, `/pharn-loop` and `/pharn-review` open and close via `pharn/floor/run-marker.mjs` (presence under `.pharn/pharn-{ship,loop,review}/<name>/active.json` — the guard reads only path and age, never contents), and the `/pharn-loop` `Stop` guard (`require-loop-record.cjs`, which fails open by design) — and the deterministic floor (`pharn/floor/`). No transpile step, no bundled runtime dependencies, no network egress, no secrets — stdlib-only Node (`.cjs`/`.mjs`) plus markdown.
- 
- PHARN's security model (`THREAT-MODEL.md`, threat model B) starts from one axiom: **prompt injection is not solved.** An agent that must read hostile context — code under review, fetched docs, accumulated memory, another model's output — cannot be made to reliably ignore instructions embedded in that content. Defense therefore rests on the **deterministic floor** (hooks, content-hashes, enum/regex checks that do not depend on model judgment), not on "the model will notice the attack." The security-relevant surfaces of this repo follow from that shape.
- 
-@@ -48,7 +48,7 @@ We will keep you informed throughout, coordinate disclosure timing with you, and
- ### In scope
- 
- - **Prompt injection** in the trusted spec docs, the `pharn-dev-*` / `pharn-*` commands, or a capability — content that bypasses the constitution, or launders untrusted data into a guaranteed decision (the trust-fence; `THREAT-MODEL.md §5`).
--- **Write-guard bypass** — any input that makes `protect-trusted-paths.cjs` _allow_ a Write/Edit it should deny to a path it protects — a trusted doc, `CODEOWNERS`, the guards' own settings files and hook scripts, `.pharn/writes-scope.json`, the project SPEC template (`pharn.spec-template.md`), git metadata, or memory-bank canon outside a promotion scope — or makes `enforce-writes-scope.cjs` allow a write outside the active scope (e.g. a path-normalization or path-traversal gap; fix #2 / fix #7, `THREAT-MODEL.md §4`). Writes through the Bash tool are outside both hooks by design (`LIMITS.md §6`), so a Bash write on its own is not a bypass.
-+- **Write-guard bypass** — any input that makes `protect-trusted-paths.cjs` _allow_ a Write/Edit it should deny to a path it protects — a trusted doc, `CODEOWNERS`, the guards' own settings files and hook scripts, `.pharn/writes-scope.json`, the project SPEC template (`pharn.spec-template.md`), git metadata, or memory-bank canon outside a promotion scope — or makes `enforce-writes-scope.cjs` _allow_ a Write/Edit the guard would deny under the posture and scope that should apply (dev checkout, installed project with an open PHARN run, installed project outside a run, explicit `writes-scope.json`, etc.; fix #2 / fix #7, `THREAT-MODEL.md §4`, CHANGELOG [6.24.0]). **Not a bypass:** since 6.24.0, an installed project with no active scope and no open `/pharn-ship`, `/pharn-loop`, or `/pharn-review` run intentionally uses a permissive default that allows most in-project writes — that is documented product behavior, not a guard failure. A bypass is a normalization, traversal, symlink-resolution, or logic flaw that reaches a path the guard should still deny given the correct posture. Writes through the Bash tool are outside both hooks by design (`LIMITS.md §6`), so a Bash write on its own is not a bypass (fix #7 detects some Bash writes at verify time, but does not prevent them).
- - **Floor false-negative** — a logic flaw in `pharn/floor/validate.mjs` (or any `pharn/floor/*.mjs` checker) that reports GREEN for input violating an invariant it claims to enforce (a false guarantee — the exact P0 failure mode).
- - Any other defect in the executable floor (a `.claude/hooks/*.cjs` hook or a `pharn/floor/*.mjs` checker) that undermines a guarantee the docs claim.
- 

From f54ed092116c8e3d5245099fbc4c32c526f6fcd8 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 27 Sep 2026 18:22:51 +0000
Subject: [PATCH 3/5] =?UTF-8?q?chore(release):=20CHANGELOG=20[6.28.4]=20?=
 =?UTF-8?q?=E2=80=94=20doc=20audit;=20clear=20[Unreleased]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bump SKILLS_VERSION 6.28.3 → 6.28.4 (PATCH, root docs only).
Move unreleased entries into the release section; update README badge.

Co-authored-by: Przemysław Galarowicz <pgalarowicz@gmail.com>
---
 CHANGELOG.md   | 8 +++++---
 README.md      | 2 +-
 SKILLS_VERSION | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab86c686..aae3eff4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,12 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 **There is one version number here that means anything.** The entries below are keyed to [`SKILLS_VERSION`](./SKILLS_VERSION) — the version of PHARN's **product surface**: the bytes an install receives (the `pharn/` tree, the product-floor checkers, the four trusted docs, and the `pharn-*` commands). It moves whenever those bytes change, including for prose-only corrections, and it is what the `pharn` badge at the top of the README shows. `package.json`'s `version` is **deliberately inert** (`0.0.0`) and is not a second version to read: this package is `private: true` and never published, so npm's field addresses nothing. It previously read `1.0.0` as a "foundation tag", which made a third identity to keep in sync with `SKILLS_VERSION` and the README badge while nothing stopped a well-meaning bump of it — so a `0.0.0` beside a `2.x` entry is not a contradiction, it is the point.
 
-## [Unreleased]
+## [6.28.4] - 2026-09-27
 
 ### Changed
 
-- 2026-09-27: **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README now states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass. Repo meta only — no `SKILLS_VERSION` bump.
-- 2026-09-27: **Remove one-shot `docs-audit-gaps-1-3.patch` and `apply_docs_audit_patch.py`** after the doc edits landed — repo meta only.
+- **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass.
+- **Release housekeeping:** remove one-shot patch/apply helpers after merge; align CHANGELOG with `main` (this section). `SKILLS_VERSION` 6.28.3 → 6.28.4 (PATCH: root documentation only — README, CONTRIBUTING, SECURITY — not the installable `pharn/` product surface). `MIN_CLI` stays 0.5.0.
+
+## [Unreleased]
 
 <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
      this section carries exactly ONE heading per type. A new entry joins its existing group at that
diff --git a/README.md b/README.md
index 7e817a96..b0daf057 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ model or human judgment remains advisory.
 npx @pharn-dev/pharn@latest init
 ```
 
-[![pharn](https://img.shields.io/badge/pharn-6.28.3-blue)](./CHANGELOG.md)
+[![pharn](https://img.shields.io/badge/pharn-6.28.4-blue)](./CHANGELOG.md)
 [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-green)](./LICENSE)
 [![CI](https://github.com/pharn-dev/pharn-oss/actions/workflows/ci.yml/badge.svg)](https://github.com/pharn-dev/pharn-oss/actions/workflows/ci.yml)
 [![CodeQL](https://github.com/pharn-dev/pharn-oss/actions/workflows/codeql.yml/badge.svg)](https://github.com/pharn-dev/pharn-oss/actions/workflows/codeql.yml)
diff --git a/SKILLS_VERSION b/SKILLS_VERSION
index 3b4b6fd2..3290bcf4 100644
--- a/SKILLS_VERSION
+++ b/SKILLS_VERSION
@@ -1 +1 @@
-6.28.3
+6.28.4

From efd98d03508c3c666f73225a9e490a9d65084de9 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 27 Sep 2026 18:28:02 +0000
Subject: [PATCH 4/5] fix(changelog): put [Unreleased] first for Keep a
 Changelog order
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI check-skills-version-recorded RED on UNRELEASED_NOT_FIRST after 6.28.4 release section.

Co-authored-by: Przemysław Galarowicz <pgalarowicz@gmail.com>
---
 CHANGELOG.md | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aae3eff4..b0b3016e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,15 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 **There is one version number here that means anything.** The entries below are keyed to [`SKILLS_VERSION`](./SKILLS_VERSION) — the version of PHARN's **product surface**: the bytes an install receives (the `pharn/` tree, the product-floor checkers, the four trusted docs, and the `pharn-*` commands). It moves whenever those bytes change, including for prose-only corrections, and it is what the `pharn` badge at the top of the README shows. `package.json`'s `version` is **deliberately inert** (`0.0.0`) and is not a second version to read: this package is `private: true` and never published, so npm's field addresses nothing. It previously read `1.0.0` as a "foundation tag", which made a third identity to keep in sync with `SKILLS_VERSION` and the README badge while nothing stopped a well-meaning bump of it — so a `0.0.0` beside a `2.x` entry is not a contradiction, it is the point.
 
-## [6.28.4] - 2026-09-27
-
-### Changed
-
-- **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass.
-- **Release housekeeping:** remove one-shot patch/apply helpers after merge; align CHANGELOG with `main` (this section). `SKILLS_VERSION` 6.28.3 → 6.28.4 (PATCH: root documentation only — README, CONTRIBUTING, SECURITY — not the installable `pharn/` product surface). `MIN_CLI` stays 0.5.0.
-
 ## [Unreleased]
 
+- 2026-09-27: **CHANGELOG section order** — move `[Unreleased]` above released version sections (Keep a Changelog) so `check-skills-version-recorded` passes in CI.
+
 <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
      this section carries exactly ONE heading per type. A new entry joins its existing group at that
      group's top — it does not open a second `### Added`.
@@ -30,6 +25,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
      `npm run check:changelog` holds this file's shape; the CI step "CHANGELOG per-PR entry check" holds
      each PR's diff. Details and known costs: CONTRIBUTING.md, "CHANGELOG entries". -->
 
+## [6.28.4] - 2026-09-27
+
+### Changed
+
+- **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass.
+- **Release housekeeping:** remove one-shot patch/apply helpers after merge; align CHANGELOG with `main` (this section). `SKILLS_VERSION` 6.28.3 → 6.28.4 (PATCH: root documentation only — README, CONTRIBUTING, SECURITY — not the installable `pharn/` product surface). `MIN_CLI` stays 0.5.0.
+
+
 ## [6.28.3] - 2026-09-27
 
 ### Fixed

From e463e442e1339887b6a0495666ae293c30087951 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 27 Sep 2026 18:32:38 +0000
Subject: [PATCH 5/5] fix(changelog): empty [Unreleased] for bump PR; fix MD012
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Przemysław Galarowicz <pgalarowicz@gmail.com>
---
 CHANGELOG.md | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b0b3016e..f6429d85 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,8 +8,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-- 2026-09-27: **CHANGELOG section order** — move `[Unreleased]` above released version sections (Keep a Changelog) so `check-skills-version-recorded` passes in CI.
-
 <!-- Keep a Changelog groups by TYPE within a release, and markdownlint MD024 is `siblings_only`, so
      this section carries exactly ONE heading per type. A new entry joins its existing group at that
      group's top — it does not open a second `### Added`.
@@ -31,7 +29,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - **Document the floor's Node 24.2 requirement, the 6.28.2 product-command budget for contributors, and the 6.24.0 write-guard posture in user-facing docs.** README states that `@pharn-dev/pharn` still requires Node 20+ while `pharn/floor/*.mjs` needs Node 24.2+ (`import.meta.main`). CONTRIBUTING adds the `command-hygiene.test.mjs` ceilings and the rule for raising them. SECURITY names `run-marker.mjs` and clarifies that an installed project's permissive default outside an open run is intentional, not a write-guard bypass.
 - **Release housekeeping:** remove one-shot patch/apply helpers after merge; align CHANGELOG with `main` (this section). `SKILLS_VERSION` 6.28.3 → 6.28.4 (PATCH: root documentation only — README, CONTRIBUTING, SECURITY — not the installable `pharn/` product surface). `MIN_CLI` stays 0.5.0.
-
+- **CHANGELOG section order:** put `[Unreleased]` above released version sections (Keep a Changelog) so `check-skills-version-recorded` and CI pass.
 
 ## [6.28.3] - 2026-09-27