feat(skills): add the §3 priced-catalog metadata to skill frontmatter

.claude/kit-manifest.sha256

@@ -0,0 +1,45 @@
+80b6185152e796cebc9956b30824d3dddf182224bec1963913139e60a0c91fa0  .claude/agents/codebase-onboarder.md
+ada89d3eb105fe29615340000dcf994216bd211cf3c0c64845eb14c43e6c19e8  .claude/agents/config-consistency-checker.md
+14e8407b8d77ed2ad613c64c006de744425071bab7e871f137efdaa4eee1883a  .claude/agents/dependency-auditor.md
+e1ec3ca1b03f6f3c740352f39196b2d7d43a4d74c0c75a80728d6ba6324410ba  .claude/agents/docs-updater.md
+4c5282cec9a47b15c964f7f25a66ade44d90a684a3d55dad570e852c6173c205  .claude/agents/observability-reviewer.md
+902400f9b722e36b682b3b71998ebec3f0652f72780b37b38595b1e66db3e3bb  .claude/agents/security-reviewer.md
+b99dbcbf44e97c5979fba07a4dc2968067c8e3afdcd3dcac66aacd1b38d24ef5  .claude/agents/spec-drift-checker.md
+7e07b72e781002e8c6803b191ca214ef6b11cf36a6ccd3514abc3e399eb4712e  .claude/agents/test-gap-analyzer.md
+6c98997058bfa2a3f75d551736590c5c88dc4fab380f1c3fd491c434d5f8b6b4  .claude/hooks/autoformat.sh
+03b740c471f680476e5a6ad0198acaaa8a850a8310ac3dd3c2d03815c4186ae1  .claude/hooks/post-merge-prune.sh
+43d42b2f1b729bf638fd565d24650baabf71ac09b9240c41f2b7f2e610c1d146  .claude/hooks/protect-credential-files.sh
+8cc36ce1bc518072ee1b77499ccbe94b8c27206b3c364816ca987ddd3ebe2ab4  .claude/hooks/prune-merged-worktrees.sh
+4011ecf15434e40cc520c898136ac2c21b6cd27c211213d02d59cad7207b1165  .claude/hooks/require-worktree.sh
+dee6e936adf425353e144c51ea3eb384507774ecf859180190245583031ba9e2  .claude/hooks/secret-scan-diff.sh
+9756f65ecf046d69218077f81fddc6712ecb2dfee7861a994f83b55e0a00edcd  .claude/settings.template.json
+a4632f926ee5c275e7b3745a73bda9e927ca1a1df9e52891ae9f2d65aa6e273e  .claude/skills/adopt-existing-project/SKILL.md
+76f46ddb3114ede75b5e21a52b0441c6dc1b0af4f9f4b2f92b95713f97d3b0fd  .claude/skills/adr/SKILL.md
+2d4323c85e2521c79f06cabd875d9aadb85ad8fc4f26ede252b5d05130c4db4e  .claude/skills/branch-conflict-check/SKILL.md
+4649d46cda61592e481e41d9e5b09a23a5cccf894f6e5f447825a97b2ff51618  .claude/skills/ci-watch/SKILL.md
+9305d90e9ca439dcffba91a36a5a32f408b5b55ba0c0ca150d41e12630d2a114  .claude/skills/compound-learnings/SKILL.md
+d05c26b70efcab220122f4c634a441735af374c51bfcb7d966fb65c18cb7839f  .claude/skills/config-audit/SKILL.md
+8750ef95e594e7046bb3dc6e854bfcc60322c87eb17862a28e61b01f15b2c39f  .claude/skills/cost-check/SKILL.md
+23196d8932489afddba8b72f426176ab6afcfbd8141cc3842149773141cbcd47  .claude/skills/coverage-ratchet/SKILL.md
+5c565dd2ce1d3ec1f335a10923547645432c913e62247d7f50be57f4c395c5d5  .claude/skills/doc-sync/SKILL.md
+038b9626f315878830fbb090f4c198a48b8e7680e345b028c1a7c2f052ed16f3  .claude/skills/eval-harness/SKILL.md
+49a8069fcd90dde102f30f15be28ec6e61ef2863acfd60372d6b377756796ada  .claude/skills/flaky-triage/SKILL.md
+40f248357ebda29809bbd6eb82da094c0919f9b206af7a71d669cc267a066683  .claude/skills/followup-tracking/SKILL.md
+c8e38f1303fefece34d834f3e1f2c93c610aa691f69f63da4347b7d775bd236a  .claude/skills/incident-capture/SKILL.md
+c55d265f147dc95550a84b8570e0a4b1495b7a38b95a734d66e6fbff3b885d18  .claude/skills/kit-doctor/SKILL.md
+6bb358976b12b28479c2cdaa037d53b1f38c02e862c180d273562791fbc901b9  .claude/skills/kit-update/SKILL.md
+3051307ae10051aa86a8c80f120da670145b7bc7de9ff7b78cb4046e5f693f16  .claude/skills/logging-init/SKILL.md
+0989102bf03735b4632c9312a7a1dadbf3157dc0a07783740cb7cdac7b626c20  .claude/skills/migration-check/SKILL.md
+283c28dea6d1cafe8f7a0283684b9621e903892350f54974503554ee94921d9a  .claude/skills/new-project-bootstrap/SKILL.md
+55889d9fcc7caa8d36c8fca66b870796e2af68bde845595abde501d9de2a43e1  .claude/skills/nightly-audit/SKILL.md
+acc4d05e9fd79370151df093dfb9a1a62fc1061b6b0c8fba701ea0d574220936  .claude/skills/observability-check/SKILL.md
+7027cf5ad86693439ebed8cdcfe9f0cd02bb40cf7d5090cc9faa550bad28ee1d  .claude/skills/parallel-work/SKILL.md
+8afa61a8ab0f5373ef20b9ec7bcfae8fa05a5389944e90a04db4778fd65bf154  .claude/skills/perf-budget/SKILL.md
+15c00de2e87a851ac0c8fe633b98d8bb73955e6457e346cb74700d9f713160ab  .claude/skills/pr-babysitter/SKILL.md
+4f6c747b618f5a0c95f049741436ee6db01e20c2d80fa2c5ffe8a1441d2a4ae4  .claude/skills/pre-pr/SKILL.md
+14c9142d7b391eabbad7088b7af3205aaccf3e19a1c71cd050a3d4e46d979f33  .claude/skills/prompt-regression/SKILL.md
+1488030c69a9cc044113f20a682fc1ece6b4725c3ad244831a8498cfef35b997  .claude/skills/release/SKILL.md
+a551286870434467287d9928e5b9401e6610cb1c1ad229ed12788d872c4285c6  .claude/skills/session-handoff/SKILL.md
+3d11efd1cb089beb94ad8e966f69407bc89710c91aa667c64c4281b6ee4cea7e  .claude/skills/sync-health/SKILL.md
+443939504bfd48e77be345412bdc6bd746f0db3ab760f05768c89705ddeb703b  .claude/skills/using-the-kit/SKILL.md
+28d46efe27a5f97961c1c3b25d5e9a9d529685c54e8e4234ff39c69ae8a45213  .claude/skills/writing-kit-skills/SKILL.md

.claude/kit.yaml

@@ -8,7 +8,7 @@
 # is false, the migration-check step is skipped and reported N/A. This is how one
 # kit serves a Python LLM service and a Go CLI without editing every skill.
 
-kit_version: "1.3.1"        # stamp; `kit-update` compares this against the source kit
+kit_version: "2.0.0-alpha"  # stamp; `kit-update` compares this against the source kit
 preset: "llm-app"           # library | service | llm-app | frontend | data-pipeline | custom
 
 # --- Gates: how strictly the quality gates enforce (scale-adaptive) ---

.claude/skills/adopt-existing-project/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: adopt-existing-project
 description: Non-destructively bring the foundation kit into an existing repo — audit what's already there, report gaps ranked by leverage, merge (never overwrite) kit artifacts, and recommend a phased rollout the team can approve incrementally
+cost: cheap
+protects: "The kit's guardrails get added to a repo already in flight without overwriting anything you wrote, and every change is shown as a diff you approve before it's applied."
+requires: nothing
+gate_key: none
+ci_job: none
 ---
 
 # Adopt Existing Project
@@ -281,6 +286,17 @@ else
 fi
 ```
 
+#### Record the kit manifest
+After the approved hooks/skills/agents/settings land, copy the source kit's
+`.claude/kit-manifest.sha256` into the project's `.claude/`. It stamps the kit
+version adopted here so `kit-update` can later distinguish a locally-modified
+kit file from an untouched one instead of guessing (SPEC §12.1). Files the team
+chose to keep their own version of will hash-mismatch this baseline and
+correctly surface as NEEDS REVIEW on the next update — that is intended.
+```bash
+cp "$KIT/.claude/kit-manifest.sha256" .claude/kit-manifest.sha256
+```
+
 #### Docs and follow-ups — add, never clobber
 - `docs/DOCS_STANDARD.md`: copy if absent.
 - `docs/followups.md`: copy if absent; if present, append a `## Kit Adoption` section with the gap items as open follow-ups.
@@ -394,6 +410,7 @@ correct command. Installing the wrong formatter silently reformats code.
 ### Proposed Changes (dry-run — nothing written yet)
 - .claude/settings.json: <merge N hook entries — diff shown above>
 - .claude/hooks/: <copy: require-worktree.sh, secret-scan-diff.sh | skip: already present>
+- .claude/kit-manifest.sha256: <record — baseline for kit-update classification>
 - .github/workflows/ci.yml: <add jobs: typecheck, migration-heads — diff shown above>
 - CLAUDE.md: <absent — will write from template | present — proposed diff shown above>
 - .claude/kit.yaml: <absent — will write | present — candidate profile shown for review>

.claude/skills/adr/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: adr
 description: Create an Architecture Decision Record when a non-obvious design choice is made — captures context, options, rationale, and tradeoffs in a durable doc
+cost: free
+protects: "The reasoning behind a hard design choice gets written down, including the alternatives you rejected, so no one has to guess or re-argue it later."
+requires: nothing
+gate_key: none
+ci_job: none
 ---
 
 # ADR

.claude/skills/branch-conflict-check/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: branch-conflict-check
 description: Detect file-level overlap between the current branch and every other open PR so merge order gets decided deliberately, not discovered at conflict time
+cost: cheap
+protects: "You find out which other open pull requests touch the same files as yours before you merge, instead of hitting the conflict by surprise afterward."
+requires: "GitHub CLI (gh) authenticated"
+gate_key: branch_conflict
+ci_job: none
 ---
 
 # Branch Conflict Check

.claude/skills/ci-watch/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: ci-watch
 description: After opening or pushing a PR, watch its CI run to completion and fix any failure — lint, types, tests, build — then re-push until green, instead of leaving a red PR
+cost: cheap
+protects: "A pull request's CI run gets watched until it finishes, and any failure gets diagnosed and fixed automatically instead of being left red."
+requires: "GitHub CLI (gh) authenticated"
+gate_key: none
+ci_job: none
 ---
 
 # CI Watch-and-Fix

.claude/skills/compound-learnings/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: compound-learnings
 description: After solving a non-obvious problem — a gnarly bug, a tricky integration, a surprising workaround — write the solution pattern to docs/solutions/ so future planning and debugging start from it instead of re-deriving it. Each unit of work should make the next one easier.
+cost: free
+protects: "A hard-won fix to a tricky bug gets written down once, so the next person starts from the answer instead of repeating the same investigation."
+requires: "capabilities.docs.enabled"
+gate_key: capture
+ci_job: none
 ---
 
 # Compound Learnings

.claude/skills/config-audit/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: config-audit
 description: Security audit of the agent-facing config surface — settings.json permissions, hook scripts, CLAUDE.md, skills, and MCP configs — for injection-shaped instructions, over-broad permissions, and leaked secrets. Read-only sibling of kit-doctor; run before committing changes to .claude/ or CLAUDE.md.
+cost: free
+protects: "The files that steer the agent — settings, hooks, CLAUDE.md, skills, MCP configs — get checked for leaked secrets and hidden instructions before you commit them."
+requires: nothing
+gate_key: none
+ci_job: none
 ---
 
 # Config Audit

.claude/skills/cost-check/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: cost-check
 description: Query the invocation/spend log for current API spend vs daily and monthly budget thresholds and report a projected month-end total
+cost: cheap
+protects: "You see today's and this month's API spend against budget, with a projected month-end total, before you kick off expensive work."
+requires: "invocation_log spend table (SUBSTRATE.md §1); capabilities.llm.enabled"
+gate_key: none
+ci_job: none
 ---
 
 # Cost Check

.claude/skills/coverage-ratchet/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: coverage-ratchet
 description: Prevent test coverage from silently eroding — compare the current run against a stored baseline, fail if it dropped, and offer to lock in a higher baseline when it rose
+cost: cheap
+protects: "Test coverage can only hold steady or improve — a drop below the recorded baseline is caught and blocked instead of quietly eroding over time."
+requires: "capabilities.coverage.ratchet_enabled; a recorded coverage baseline"
+gate_key: coverage_ratchet
+ci_job: none
 ---
 
 # Coverage Ratchet

.claude/skills/doc-sync/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: doc-sync
 description: Keep docs, spec, and code in lockstep in the same PR — update affected narrative docs, cite/update the canonical spec, and log any accepted drift as a follow-up
+cost: subagents
+protects: "Docs and the canonical spec stay in step with the code change in the same pull request, instead of drifting silently over time."
+requires: "capabilities.docs.enabled"
+gate_key: docs_sync
+ci_job: none
 ---
 
 # Doc Sync

.claude/skills/eval-harness/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: eval-harness
 description: Set up and run tiered, version-controlled evaluation fixtures for non-deterministic behavior (LLM calls, classifiers, extractors) — score against pass-gates and catch regressions in CI
+cost: subagents
+protects: "Changes to a prompt, model, or classifier get scored against version-controlled test cases before they ship, so a quality regression is caught instead of shipping on a vibe."
+requires: "eval fixtures + a runner (SUBSTRATE.md §2); capabilities.llm.enabled"
+gate_key: none
+ci_job: none
 ---
 
 # Eval Harness

.claude/skills/flaky-triage/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: flaky-triage
 description: When a test goes red then green with no intervening code change, confirm it's flaky, record it in the registry, and optionally quarantine it so it stops blocking PRs but stays visible — instead of silently blocking the queue or being silently ignored
+cost: cheap
+protects: "A test that turns red then green gets confirmed as flaky, logged, and optionally quarantined instead of silently blocking or being ignored."
+requires: nothing
+gate_key: flaky_triage
+ci_job: none
 ---
 
 # Flaky Test Triage

.claude/skills/followup-tracking/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: followup-tracking
 description: Capture deferred decisions, accepted drift, and cross-cutting TODOs in a durable follow-ups log instead of letting them rot in code comments — with a stable-ID entry format and a close/archive lifecycle
+cost: free
+protects: "Decisions you deferred and gaps you accepted get written down in one durable place instead of disappearing in a merged pull request."
+requires: "capabilities.docs.enabled"
+gate_key: capture
+ci_job: none
 ---
 
 # Follow-up Tracking

.claude/skills/incident-capture/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: incident-capture
 description: When a component fires fallback_activated (or crashes) repeatedly in a window, auto-open a pre-filled incident note so the 2am page starts with context instead of a blank page.
+cost: cheap
+protects: "A repeating failure automatically opens an incident note with the timeline already filled in, so whoever responds starts with context instead of a blank page."
+requires: "invocation_log (SUBSTRATE.md §1); alert transport (SUBSTRATE.md §3)"
+gate_key: none
+ci_job: none
 ---
 
 # Incident Capture