Second-pass audit fixes: option-5 typo, skill MCP rename, walkthrough

Three real issues caught by the second audit swarm:

1. step-6/step-6-install.sh:457 — `install_motion_calendar()` was
   printing "Heads up: Morgen (option 6) is the recommended
   default" during Motion's credential prompt. Morgen is
   option 5 after the 6-tool renumbering; Motion is 6. Fixed
   to "option 5".

2. rmini-skill/SKILL.md, templates/skills/rswarm/SKILL.md,
   templates/skills/rhive/SKILL.md, step-3/step-3-install.sh
   (skill heredocs) — all referenced `mcp__claude-flow__*`
   tool names. The repo's ground truth is ruflo (per step-3's
   actual MCP install at `claude mcp add ruflo -- npx -y
   ruflo@latest`), so the `mcp__claude-flow__*` namespace was
   stale and would fail at runtime if a user actually called
   those MCP tools. Renamed to `mcp__ruflo__*` everywhere and
   added a note that the MCP call is optional — the Agent-tool
   spawn is what actually does the work (the MCP call is
   metadata signaling).

   Fixed in both the top-level skill source (rmini-skill/,
   templates/skills/) AND the baked-in heredoc content inside
   step-3/step-3-install.sh, so fresh installs get the
   corrected skills too.

3. tests/install-flow-walkthrough.md — Step 4 walkthrough
   omitted Taste Skill entirely; Step 6 walkthrough still
   described the pre-overhaul 2-tool menu (Motion + Notion).
   Rewrote both sections to cover current reality: Step 4 has
   three tools including the Taste Skill 7-variant pack with
   notes on the full-URL install form; Step 6 has 6 tools in
   canonical order (Notion, Granola, n8n, GCal, Morgen,
   Motion) with per-tool credential storage notes and the
   Obsidian-lives-in-Step-7 pointer.

Deliberately NOT fixed in this pass (pre-existing, out of
scope for the 802a816 revert cleanup):
- Argv secret leak via `claude mcp add -e` (M1, class-wide)
- Taste Skill / Remotion unpinned `npx` installs (M2)
- Substring grep collision risk in MCP detection (class-wide)
- n8n URL regex tightening (validation nit)
- CLAUDE.md @claude-flow/cli references (gitignored, local
  maintainer config)

Co-Authored-By: claude-flow <ruv@ruv.net>

Author: fidgetcoding

rmini-skill/SKILL.md

@@ -12,7 +12,7 @@ When this skill is invoked, IMMEDIATELY launch a 5-agent swarm. Do NOT explain h
 1. Read the user's task (everything they typed after `/rmini`)
 2. **Signal status line**: Run `echo 5 > /tmp/ruflo-mini-active` via Bash to light up the 🍯 indicator
 3. Initialize the swarm in ONE message:
-   - Call `mcp__claude-flow__swarm_init` with topology `hierarchical-mesh`, maxAgents 5, strategy `specialized`
+   - Call `mcp__ruflo__swarm_init` with topology `hierarchical-mesh`, maxAgents 5, strategy `specialized` (skip if the Ruflo MCP tool isn't available — the Agent-tool spawn below is what actually does the work)
    - Spawn ALL 5 agents via the Agent tool with `run_in_background: true` — every agent in ONE message
 4. After spawning, STOP. Do not poll. Do not check status. Wait for agents to return.
 5. When results come back, synthesize and present the combined output.

step-3/step-3-install.sh

@@ -313,7 +313,7 @@ When this skill is invoked, IMMEDIATELY launch a 15-agent swarm. Do NOT explain
 1. Read the user's task (everything they typed after `/rswarm`)
 2. **Signal status line**: Run `echo 15 > /tmp/ruflo-swarm-active` via Bash to light up the swarm indicator
 3. Initialize the swarm in ONE message:
-   - Call `mcp__claude-flow__swarm_init` with topology `hierarchical-mesh`, maxAgents 15, strategy `specialized`
+   - Call `mcp__ruflo__swarm_init` with topology `hierarchical-mesh`, maxAgents 15, strategy `specialized` (skip if the Ruflo MCP tool isn't available — the Agent-tool spawn below is what actually does the work)
    - Spawn ALL 15 agents via the Agent tool with `run_in_background: true` — every agent in ONE message
 4. After spawning, STOP. Do not poll. Do not check status. Wait for agents to return.
 5. When results come back, synthesize and present the combined output.
@@ -377,14 +377,14 @@ The queen decides how many workers to spawn, what roles they need, how to coordi
 1. Read the user's goal (everything they typed after `/rhive`)
 2. **Signal status line**: Run `touch /tmp/ruflo-hive-active` via Bash to light up the hive indicator
 3. Initialize the hive-mind in ONE message:
-   - Call `mcp__claude-flow__hive-mind_init` with consensus `raft`
+   - Call `mcp__ruflo__hive-mind_init` with consensus `raft` (skip if the Ruflo MCP tool isn't available — the Agent-tool spawn below is what actually does the work)
    - Spawn a queen agent (hierarchical-coordinator type) via the Agent tool with `run_in_background: true`
    - The queen's prompt MUST include:
      a. The user's full goal
-     b. Instructions to use `mcp__claude-flow__hive-mind_spawn` to create workers as needed
-     c. Instructions to use `mcp__claude-flow__hive-mind_broadcast` for coordination
-     d. Instructions to use `mcp__claude-flow__hive-mind_consensus` for decisions
-     e. Instructions to use `mcp__claude-flow__hive-mind_memory` for shared state
+     b. Instructions to use `mcp__ruflo__hive-mind_spawn` to create workers as needed
+     c. Instructions to use `mcp__ruflo__hive-mind_broadcast` for coordination
+     d. Instructions to use `mcp__ruflo__hive-mind_consensus` for decisions
+     e. Instructions to use `mcp__ruflo__hive-mind_memory` for shared state
      f. Instructions to present final synthesized output when complete
 4. After spawning the queen, STOP. Do not poll. Do not check status. The queen runs the show.
 5. When the queen returns results, present them to the user.
@@ -431,7 +431,7 @@ When this skill is invoked, IMMEDIATELY launch a 5-agent swarm. Do NOT explain h
 1. Read the user's task (everything they typed after `/rmini`)
 2. **Signal status line**: Run `echo 5 > /tmp/ruflo-mini-active` via Bash to light up the 🍯 indicator
 3. Initialize the swarm in ONE message:
-   - Call `mcp__claude-flow__swarm_init` with topology `hierarchical-mesh`, maxAgents 5, strategy `specialized`
+   - Call `mcp__ruflo__swarm_init` with topology `hierarchical-mesh`, maxAgents 5, strategy `specialized` (skip if the Ruflo MCP tool isn't available — the Agent-tool spawn below is what actually does the work)
    - Spawn ALL 5 agents via the Agent tool with `run_in_background: true` — every agent in ONE message
 4. After spawning, STOP. Do not poll. Do not check status. Wait for agents to return.
 5. When results come back, synthesize and present the combined output.

step-6/step-6-install.sh

@@ -454,7 +454,7 @@ install_motion_calendar() {
     fi
 
     echo ""
-    echo -e "${YELLOW}  Heads up: Morgen (option 6) is the recommended default${NC}"
+    echo -e "${YELLOW}  Heads up: Morgen (option 5) is the recommended default${NC}"
     echo -e "${YELLOW}  calendar tool. Motion Calendar is only needed for a few${NC}"
     echo -e "${YELLOW}  Motion-specific features (teammate events, full-text${NC}"
     echo -e "${YELLOW}  search across events, custom calendar management).${NC}"

templates/skills/rhive/SKILL.md

@@ -20,14 +20,14 @@ The queen decides how many workers to spawn, what roles they need, how to coordi
 1. Read the user's goal (everything they typed after `/rhive`)
 2. **Signal status line**: Run `touch /tmp/ruflo-hive-active` via Bash to light up the 👑 indicator
 3. Initialize the hive-mind in ONE message:
-   - Call `mcp__claude-flow__hive-mind_init` with consensus `raft`
+   - Call `mcp__ruflo__hive-mind_init` with consensus `raft` (skip if the Ruflo MCP tool isn't available — the Agent-tool spawn below is what actually does the work)
    - Spawn a queen agent (hierarchical-coordinator type) via the Agent tool with `run_in_background: true`
    - The queen's prompt MUST include:
      a. The user's full goal
-     b. Instructions to use `mcp__claude-flow__hive-mind_spawn` to create workers as needed
-     c. Instructions to use `mcp__claude-flow__hive-mind_broadcast` for coordination
-     d. Instructions to use `mcp__claude-flow__hive-mind_consensus` for decisions
-     e. Instructions to use `mcp__claude-flow__hive-mind_memory` for shared state
+     b. Instructions to use `mcp__ruflo__hive-mind_spawn` to create workers as needed
+     c. Instructions to use `mcp__ruflo__hive-mind_broadcast` for coordination
+     d. Instructions to use `mcp__ruflo__hive-mind_consensus` for decisions
+     e. Instructions to use `mcp__ruflo__hive-mind_memory` for shared state
      f. Instructions to present final synthesized output when complete
 4. After spawning the queen, STOP. Do not poll. Do not check status. The queen runs the show.
 5. When the queen returns results, present them to the user.

templates/skills/rswarm/SKILL.md

@@ -13,7 +13,7 @@ When this skill is invoked, IMMEDIATELY launch a 15-agent swarm. Do NOT explain
 1. Read the user's task (everything they typed after `/rswarm`)
 2. **Signal status line**: Run `echo 15 > /tmp/ruflo-swarm-active` via Bash to light up the 🐝 indicator
 3. Initialize the swarm in ONE message:
-   - Call `mcp__claude-flow__swarm_init` with topology `hierarchical-mesh`, maxAgents 15, strategy `specialized`
+   - Call `mcp__ruflo__swarm_init` with topology `hierarchical-mesh`, maxAgents 15, strategy `specialized` (skip if the Ruflo MCP tool isn't available — the Agent-tool spawn below is what actually does the work)
    - Spawn ALL 15 agents via the Agent tool with `run_in_background: true` — every agent in ONE message
 4. After spawning, STOP. Do not poll. Do not check status. Wait for agents to return.
 5. When results come back, synthesize and present the combined output.

tests/install-flow-walkthrough.md

@@ -107,10 +107,13 @@ The `OBSIDIAN/` prefix requirement has been removed. The pattern now matches any
 | Section | Expected Behavior | Result |
 |---------|-------------------|--------|
 | UI/UX Pro Max skill | Downloads to `~/.claude/skills/ui-ux-pro-max/SKILL.md` | PASS |
+| Taste Skill pack (Leonxlnx/taste-skill) | `npx skills add https://github.com/Leonxlnx/taste-skill --yes --global` expands 7 variants (taste, redesign, soft, output, minimalist, brutalist, stitch) under `~/.claude/skills/` | PASS (soft fail ok if skills CLI rejects the URL) |
 | 21st.dev Magic MCP | `claude mcp add magic` | PASS (may need manual setup) |
 
 **Bugs found:** None.
 
+**Notes:** Taste Skill install uses the full GitHub URL form (not the owner/repo shorthand) because the taste-skill README documents the URL form as the authoritative install command. Each variant becomes its own skill folder. The main `taste-skill` variant has three tunable knobs at the top of its SKILL.md: DESIGN_VARIANCE, MOTION_INTENSITY, VISUAL_DENSITY (1-10 each).
+
 ---
 
 ## Step 5 -- Visual Media
@@ -135,14 +138,23 @@ The `OBSIDIAN/` prefix requirement has been removed. The pattern now matches any
 
 **File:** `step-6/step-6-install.sh`
 
+Installs 6 optional productivity MCPs. Obsidian MCP lives in Step 7d (alongside the vault setup), NOT here.
+
 | Section | Expected Behavior | Result |
 |---------|-------------------|--------|
-| Non-interactive mode | Detects pipe (`[ ! -t 0 ]`), prints instructions, exits cleanly | PASS |
-| Interactive mode | Menu for Motion/Notion | PASS |
-| Motion Calendar | Prompts for credentials | PASS |
-| Notion | Prompts for integration token | PASS |
-
-**Notes:** When run via `update.sh` (pipe), correctly exits with instructions telling user to run directly. First-time users must run directly in terminal for credential input.
+| Non-interactive mode | Detects pipe (`[ ! -t 0 ]`), auto-detects already-installed MCPs, re-enters only the `"already installed"` guards; if nothing found, prints "run directly" instructions and exits cleanly | PASS |
+| Interactive menu | Numbered 1-6: Notion, Granola, n8n, GCal, Morgen, Motion. Morgen (5) flagged as recommended default | PASS |
+| (1) Notion | Prompts for integration token, registers via `-e NOTION_TOKEN=...` | PASS |
+| (2) Granola | Registers HTTP transport to `https://mcp.granola.ai/mcp` (no credentials — Granola app handles auth) | PASS |
+| (3) n8n | Prompts for user's own n8n instance URL + optional Bearer token, registers via `--transport http` with `-H "Authorization: Bearer …"` if provided | PASS |
+| (4) Google Calendar | Prompts for OAuth Client ID + Secret, writes `~/.google-calendar-mcp/.env` (chmod 700 dir / 600 file), registers with `-e GOOGLE_CLIENT_ID=... -e GOOGLE_CLIENT_SECRET=...` | PASS |
+| (5) Morgen *(recommended)* | Prompts for API key + optional IANA timezone, registers via `-e MORGEN_API_KEY=... -e MORGEN_TIMEZONE=...`. No local `.env` — credentials live in Claude Code's MCP config | PASS |
+| (6) Motion Calendar | Prompts for Motion API key, Firebase API key, Firebase refresh token, Motion user ID. Writes `~/.motion-calendar-mcp/.env` (chmod 700/600). Registers via `claude mcp add motion-calendar` | PASS |
+| Obsidian | NOT in Step 6 — points user to Step 7d | N/A |
+| Self-test | `check_registered` covers all 6 tools, verifies Motion + GCal `.env` files exist for their respective installs | PASS |
+| Summary | Prints tool-count + "what you can do now" hints per installed tool | PASS |
+
+**Notes:** When run via `update.sh` (pipe), correctly auto-detects already-registered MCPs and exits after verification without prompting. First-time users must run directly in terminal for credential input. Morgen is promoted as the default calendar+task tool; Motion and Google Calendar are documented as secondary (install only for specific features the primary tool doesn't cover).
 
 ---