feat: merge planning repo artifacts into production

Copy 158 files from ScriptHammer_planning: Docker reference docs,
interoffice memos/audits/RFCs, blog posts, security audits, RLS tests,
Supabase migrations, constitution template, and CONTRIBUTING.md.
Removed duplicate pages.yml workflow (deploy.yml already handles this).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Dev User

.claude/config/terminal-map.json

@@ -0,0 +1,61 @@
+{
+  "session": "scripthammer",
+  "terminals": {
+    "cto": 0,
+    "product-owner": 1,
+    "business-analyst": 2,
+    "architect": 3,
+    "ux-designer": 4,
+    "ui-designer": 5,
+    "planner": 6,
+    "generator-1": 7,
+    "generator-2": 8,
+    "generator-3": 9,
+    "preview-host": 10,
+    "wireframe-qa": 11,
+    "validator": 12,
+    "inspector": 13,
+    "developer": 14,
+    "toolsmith": 15,
+    "security": 16,
+    "test-engineer": 17,
+    "qa-lead": 18,
+    "auditor": 19,
+    "author": 20,
+    "tech-writer": 21,
+    "devops": 22,
+    "docker-captain": 23,
+    "release-manager": 24,
+    "coordinator": 25
+  },
+  "groups": {
+    "all-generators": ["generator-1", "generator-2", "generator-3"],
+    "qc": ["preview-host", "wireframe-qa", "validator", "inspector"],
+    "council": [
+      "cto",
+      "architect",
+      "security",
+      "toolsmith",
+      "devops",
+      "product-owner",
+      "ux-designer"
+    ],
+    "wireframe": [
+      "planner",
+      "generator-1",
+      "generator-2",
+      "generator-3",
+      "preview-host",
+      "wireframe-qa",
+      "validator",
+      "inspector"
+    ]
+  },
+  "aliases": {
+    "gen1": "generator-1",
+    "gen2": "generator-2",
+    "gen3": "generator-3",
+    "qa": "wireframe-qa",
+    "preview": "preview-host"
+  }
+}

.pre-commit-config.yaml

@@ -0,0 +1,66 @@
+# Pre-commit hooks for ScriptHammer
+# Install: pip install pre-commit && pre-commit install
+# For commit-msg hooks: pre-commit install --hook-type commit-msg
+# Run manually: pre-commit run --all-files
+
+repos:
+  # Basic file hygiene
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+        exclude: \.svg$
+      - id: end-of-file-fixer
+        exclude: \.svg$
+      - id: check-yaml
+        args: [--unsafe]  # Allow custom tags in GitHub Actions
+      - id: check-json
+      - id: check-added-large-files
+        args: ['--maxkb=1000']
+      - id: check-merge-conflict
+      - id: detect-private-key
+
+  # Python linting with Ruff (fast, modern)
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.3.0
+    hooks:
+      - id: ruff
+        args: [--fix, --exit-non-zero-on-fix]
+        files: ^docs/design/wireframes/.*\.py$
+      - id: ruff-format
+        files: ^docs/design/wireframes/.*\.py$
+
+  # Shell script linting
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.9.0.6
+    hooks:
+      - id: shellcheck
+        args: [-x]  # Follow sourced files
+
+  # Markdown linting
+  - repo: https://github.com/igorshubovych/markdownlint-cli
+    rev: v0.39.0
+    hooks:
+      - id: markdownlint
+        args: [--fix, --disable, MD013, MD033, MD041, --]
+        # MD013: Line length (too strict for specs)
+        # MD033: Inline HTML (needed for some docs)
+        # MD041: First line heading (not always applicable)
+
+# Local hooks for project-specific validation
+  - repo: local
+    hooks:
+      - id: validate-wireframes
+        name: Validate SVG wireframes
+        entry: python docs/design/wireframes/validate-wireframe.py
+        language: system
+        files: ^docs/design/wireframes/.*\.svg$
+        pass_filenames: true
+
+  # Conventional commits (install with: pre-commit install --hook-type commit-msg)
+  - repo: https://github.com/compilerla/conventional-pre-commit
+    rev: v3.1.0
+    hooks:
+      - id: conventional-pre-commit
+        stages: [commit-msg]
+        args: [feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert]

.secrets-allowlist

@@ -0,0 +1,15 @@
+# Secrets Scanner Allowlist
+# False positives and intentional exceptions
+# Format: file:path, line:path:num, pattern:substring
+
+# The secrets-scan.py script contains regex patterns (not actual secrets)
+file:scripts/secrets-scan.py
+
+# Test fixtures with fake credentials (not real secrets)
+pattern:tests/fixtures/test-users
+
+# Python virtualenv contains example code (not our code)
+pattern:.speckit/specify-cli/lib/python
+
+# Example .env file is intentionally committed as a template
+file:.env.example

CHANGELOG.md

@@ -0,0 +1,87 @@
+# Changelog
+
+All notable changes to ScriptHammer are documented here.
+
+## [Unreleased] - 2026-01-16
+
+### Added
+
+- **SpecKit constitution check**: Analyze workflow now validates constitution compliance (2f85f07)
+- **QC-Operator role**: PNG batch quality control workflow for wireframe review (7d99622)
+- **Tmux QC flag**: `--qc` option for Quality Control session layout (37d1aa7)
+- **Inspector active state checks**: G-045/G-046 mobile navigation validation (2ff3628)
+- **Signature validation**: Inspector checks for signature alignment and format (9fe9f5e)
+- **Validator SIGNATURE checks**: SIGNATURE-003/004 rules for left-alignment and format (1509660, 92367fb)
+- **XML syntax rules**: G-040, G-041, G-042 documentation for SVG compliance (a0fb2a9)
+- **Auth feature contracts**: 003-auth quickstart and test plan documentation (4aaaef8)
+- **Auditor guidance report**: Gap analysis for validator rule coverage (e012272)
+- **Script caching system**: Token-efficient precompute for wireframe processing (ea0b41f)
+- **Role-based context system**: 21 specialized terminal roles with focused context files (`.claude/roles/`)
+- **Docker Captain role**: New terminal role with Brett Fisher's Docker knowledge base
+- **Central logging system**: Persistence rules ensuring terminal output survives sessions
+- **RFC-004**: CI wireframe validation enforcement workflow
+- **13 new feature wireframes**: 34+ SVGs added for features 003-015
+- **Product Owner role**: New council member with `/status` skill and audit oversight
+- **Tmux session launcher**: Script for multi-terminal workflow automation (`scripts/launch-session.sh`)
+- **Python automation scripts**: Token-efficient wireframe processing tools
+- **PNG collection script**: Automated overview screenshot gathering
+- **Validator output flags**: `--json` and `--summary` flags for CI integration (41d5c4d)
+- **P0 pre-implementation docs**: Documentation for priority-zero features (69f767a)
+- **Constitution v1.1.0**: Updated constitution via RFC-005 approval
+
+### Changed
+
+- **Role boundaries**: Explicit wireframe-pipeline role boundaries documented (ff04984)
+- **Operator rules**: Explicit instruction-only execution and tmux send-keys requirements (13f7720, e5741d7)
+- **Window references**: Documentation updated to use window names not numbers (be2ad62)
+- **Automation workflow**: Now requires `--dangerously-skip-permissions` flag for autonomous operation
+- **Terminal role hierarchy**: Restructured with CTO at top of reporting chain
+- **Wireframe title positions**: Corrected x=700→x=960 across 21 SVGs for consistency
+- **Docker viewer base image**: Upgraded to `node:22-bookworm-slim` for CVE reduction (63827d1)
+
+### Fixed
+
+- **G-047 Key Concepts position**: Corrected y=730→y=940 with Architect confirmation (ce349fd, 61787fa)
+- **Validator ANN-004**: Handle malformed SVG gracefully (965e7d3)
+- **Batch wireframe patches**: G-044, G-047, SIGNATURE-003 fixes applied (46eb178)
+- **Dispatch targeting**: Use window names instead of numbers (1963190)
+- **QC-Operator README**: Format consistency with other role documentation (f6182bc)
+- **Inspector title detection**: Rewritten to handle multiline SVG `<title>` elements
+- **Wireframe viewer navigation**: Fixed routing and screenshot size bugs
+- **Dark theme**: Corrected color scheme in wireframe viewer
+- **CI validator parsing**: Use `--json` output instead of grep parsing (37e387a)
+- **Docker health check**: Alpine compatibility fix for viewer container (d4a37aa)
+- **SVG position issues**: Patched Inspector-identified positioning problems (5410509)
+
+### Removed
+
+- **Stale issue files**: Cleaned up 11 obsolete wireframe issue files (4d40e54)
+- **Premature files**: Session cleanup removed files created before specs (2e1e664)
+
+### Decisions
+
+- **RFC-004 approved**: Unanimous 6-0 council vote for CI wireframe validation enforcement
+- **RFC-005 approved**: Unanimous council vote for constitution v1.1.0 amendments (696ef23)
+
+### Audits
+
+- **Validator full sweep**: 27/45 wireframes pass, 18 require fixes (43a6417)
+- **G-039 nav analysis**: Active state check classification (6447289)
+- **G-044 PATCH classification**: Line-number based issue tracking (2dcc818)
+- **Inspector verification**: Toolsmith task audit completed (8c6cea8)
+
+---
+
+## [0.1.0] - 2026-01-13
+
+### Added
+
+- Initial feature specifications (46 features)
+- Interactive SVG wireframe viewer
+- SpecKit workflow integration
+- Multi-terminal tmux architecture
+- Queue-based task management system
+
+---
+
+_Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)_

CODE-REVIEW-ISSUES.md

@@ -0,0 +1,128 @@
+# Code Review Issues
+
+**Date:** 2026-01-13
+**Reviewer:** Claude Opus 4.5
+**Repository:** ScriptHammer (Planning Template)
+
+## Repository Context
+
+This is a **planning template repository** containing:
+
+- 46 feature specifications (markdown)
+- SVG wireframe viewer (`docs/design/wireframes/`)
+- 2 Python scripts: `validate-wireframe.py` (1999 lines), `screenshot-wireframes.py` (391 lines)
+- 1 HTML viewer with embedded JavaScript
+
+**No application source code exists** - this is spec-first planning.
+
+---
+
+## Phase 1: Security Audit
+
+### Fixed Issues
+
+| Issue                       | File            | Severity | Status    |
+| --------------------------- | --------------- | -------- | --------- |
+| DOM-based XSS via innerHTML | index.html:1276 | CRITICAL | **FIXED** |
+| Path traversal in SVG refs  | index.html:1240 | HIGH     | **FIXED** |
+| XSS in error message path   | index.html:1281 | MEDIUM   | **FIXED** |
+
+### Remediation Applied
+
+1. **SVG Sanitization** (index.html:1280-1303)
+   - Added `sanitizeSVG()` function that removes:
+     - `<script>` elements
+     - Event handlers (`onclick`, `onload`, etc.)
+     - `javascript:` hrefs
+     - Dangerous elements (`foreignObject`, `set`, animated hrefs)
+
+2. **Path Traversal Protection** (index.html:1241-1252)
+   - Added `isValidSvgPath()` validator that blocks:
+     - `..` sequences
+     - Absolute paths (`/`)
+     - Double slashes (`//`)
+   - Only allows `.svg` files from `includes/` or same directory
+
+3. **Safe Error Rendering** (index.html:1315-1321)
+   - Changed from template literal in innerHTML to createElement + textContent
+
+4. **Content Security Policy** (index.html:7)
+   - Added CSP meta tag with:
+     - `default-src 'self'` - blocks unauthorized resources
+     - `script-src` - allows self, inline, and Google Analytics domains
+     - `style-src` - allows self and inline styles
+     - `img-src` - allows self, data URIs, and GA tracking pixels
+     - `connect-src` - allows fetch to self and GA
+     - `frame-ancestors 'self'` - prevents clickjacking
+
+### Remaining (Accepted Risk)
+
+| Issue                       | Severity | Decision                                                 |
+| --------------------------- | -------- | -------------------------------------------------------- |
+| No SRI for Google Analytics | MEDIUM   | GA script changes frequently; SRI would break on updates |
+
+**Note:** SRI is not practical for GA because Google updates the script without notice. CSP already restricts which domains can serve scripts.
+
+### Python Scripts - No Issues Found
+
+Both `validate-wireframe.py` and `screenshot-wireframes.py` are **secure**:
+
+- No command injection (subprocess uses list form)
+- No path traversal (paths bounded to wireframes directory)
+- No hardcoded secrets
+- XXE not possible (Python 3.7+ default protects against it)
+
+---
+
+## Phase 2: Performance Analysis
+
+### No Issues Found
+
+This is a planning template with minimal code:
+
+- No application code to optimize
+- Python scripts are already O(n) with binary search optimizations
+- HTML viewer uses vanilla JS (no framework overhead)
+
+---
+
+## Phase 3: Code Quality
+
+### Fixed Issues
+
+| Issue                 | File                  | Line | Status    |
+| --------------------- | --------------------- | ---- | --------- |
+| Unused import `field` | validate-wireframe.py | 28   | **FIXED** |
+
+### No Other Issues Found
+
+- No TODO/FIXME comments in executable code
+- No linter disables
+- No unimplemented stubs
+- No duplicate files
+
+---
+
+## Phase 4: Test Coverage
+
+### Current State
+
+| Metric        | Value |
+| ------------- | ----- |
+| Test files    | 0     |
+| Test coverage | 0%    |
+
+**Note:** This is expected for a planning template. Tests are specified in `features/testing/` but not implemented yet.
+
+---
+
+## Summary
+
+| Category      | Found | Fixed | Remaining         |
+| ------------- | ----- | ----- | ----------------- |
+| Security      | 6     | 5     | 1 (accepted risk) |
+| Performance   | 0     | 0     | 0                 |
+| Code Quality  | 1     | 1     | 0                 |
+| Test Coverage | N/A   | N/A   | N/A               |
+
+**All actionable issues have been fixed.** The remaining item (SRI for Google Analytics) is an accepted risk because GA scripts change frequently and SRI would cause breakage.