[stid]

Fixes #21, fixes #22.

#21 — edit-boundary hook

• NotebookEdit sends tool_input.notebook_path. The hook now reads it when file_path is absent, so notebook edits outside the boundary are denied.
• . and .. are resolved lexically before matching. src/x/../../docs/y is checked as docs/y, and a path that resolves outside the project stays unpoliced. The split doesn't use read, which would stop at a newline, and runs under set -f, so a * segment stays literal.
• Fail-open is unchanged (D-003): an empty or unparseable path still allows.
• Resolution is lexical, not physical (symlinks aren't followed). That's deliberate: the target may not exist yet, and this hook guards scope, not security.

#22 — AC convention auto-load

• Confirmed before fixing: in a plugin-only project, reading a docs/lcd/**/spec.md did not load the rule. A control project with the rule in .claude/rules/ did load it.
• Onboard: now always writes .claude/rules/ac-convention.md. It rewrites paths: for a custom root. If an existing copy doesn't cover the root (for example a vendored seed), onboard rewrites only that line and logs it.
• Doctor: checks the copy at every root. Missing or non-covering is a WARN on the default root (projects onboarded earlier: re-run /lcd:onboard) and a FAIL on a custom root, as before. Coverage is judged on the paths: globs, not a substring of the file.
• Docs: rules/lcd.md, the ac-convention.md header, README and doctor.md no longer claim the plugin copy auto-loads.

Also

• Boundary-hook tests: the fixture's branch switch-back used git checkout on an unborn branch, which failed silently. Every later case ran with no active work-item and passed without testing anything. It now uses symbolic-ref, asserted. The "placeholder-only" case really is placeholder-only now.

Verification

• Suite: 14/14. Every touched test also passes under macOS /bin/bash 3.2. claude plugin validate passes.
• Mutation checks: each fix was reverted in turn, and every revert fails its AC test. The cases: notebook fallback, dot resolution, newline split, set -f, default-root WARN, the regex grep, and substring coverage.
• Independent closeout evaluator: it challenged the work with a substring false-OK in the doctor coverage check, and a set -f regression no test would catch. Both are fixed in the last commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VCp4cMxLbQXy83ZZv9RDXp