fix(agent-isolation): zsh portability + opt-in default-claude alias - #15

…overrides/ (#665)

* chore(spec-loop): consolidate implementation plan

Collapse "What's been built" to one line per item; all 22 planned work
items preserved verbatim; redundant shipped-state notes trimmed.

Generated-by: Claude (Opus 4.7)

* feat(validator): add override-file contract check for .apache-magpie-overrides/

Add a new SOFT advisory check (check #15) to the skill-and-tool-validator
that validates .apache-magpie-overrides/<skill>.md files in adopter repos.

Two advisory checks per file:
- Structure: the canonical 'apache-magpie agentic override' header comment
  must be present (confirms the file was created via /magpie-setup override).
- Baseline integrity: heuristic scan for patterns attempting to weaken the
  framework safety / confidentiality / privacy / data-not-instructions
  baseline (ignore safety, bypass confidentiality, skip privacy-llm-gate,
  treat external content as instructions, disclose confidential reports).

HTML comment lines are excluded from the weakening scan to avoid flagging
prose that explains what NOT to do. The directory scanner silently skips
repos without an override directory. All violations are SOFT advisory.

21 new tests cover: clean override passes, missing header, each weakening
pattern, HTML-comment exclusion, directory scanner, README.md skip,
multi-file coverage, and discoverable-without-editing-skill confirmation.

Also clears the override-file contract gap from specs/adoption-and-setup.md.

Generated-by: Claude (Opus 4.7)

…visory)

Add validate_project_template_drift (check apache#15) to
tools/skill-and-tool-validator to mechanically compare
projects/_template/ with projects/non-asf-example/ for structural
drift, closing the Known gap in specs/project-agnosticism.md.

Three SOFT advisory checks under the new template-drift category:

1. README file-list coherence: every file linked in the ## Files
   section of non-asf-example/README.md must exist on disk.
2. Undocumented files: every .md file in non-asf-example/ (other
   than README.md) must be mentioned somewhere in its README.
3. Shared-file h2 alignment: for each .md file present in both
   profiles, h2 section headings are compared. project.md and
   README.md are excluded since they differ intentionally by
   organization profile (org-inherited blocks, narrative structure).

22 new tests in TestProjectTemplateDrift cover all checks, the
live-repo clean-state assertion, DocToc-stripping, exclusion of
parent-traversal and external URLs, and the project.md/README.md
exemptions. The live tree produces zero template-drift violations.

Updates specs/project-agnosticism.md Known gaps to document the
new check and its scope.

Generated-by: Claude (Opus 4.7)

#663)

Add validate_project_template_drift (check #15) to
tools/skill-and-tool-validator to mechanically compare
projects/_template/ with projects/non-asf-example/ for structural
drift, closing the Known gap in specs/project-agnosticism.md.

Three SOFT advisory checks under the new template-drift category:

1. README file-list coherence: every file linked in the ## Files
   section of non-asf-example/README.md must exist on disk.
2. Undocumented files: every .md file in non-asf-example/ (other
   than README.md) must be mentioned somewhere in its README.
3. Shared-file h2 alignment: for each .md file present in both
   profiles, h2 section headings are compared. project.md and
   README.md are excluded since they differ intentionally by
   organization profile (org-inherited blocks, narrative structure).

22 new tests in TestProjectTemplateDrift cover all checks, the
live-repo clean-state assertion, DocToc-stripping, exclusion of
parent-traversal and external URLs, and the project.md/README.md
exemptions. The live tree produces zero template-drift violations.

Updates specs/project-agnosticism.md Known gaps to document the
new check and its scope.

Generated-by: Claude (Opus 4.7)