feat(game): renew moonlit beacon for 3.0.0

.agents/skills/grow/SKILL.md

@@ -45,3 +45,6 @@ If a repository move removes the operating files, find preserved local sources,
 record their provenance and rebuild in an isolated local branch. Do not merge
 private history into a public-release branch or assume repository visibility from
 its name. Confirm the actual tracker and visibility before updating it.
+
+A growth action that has to change the repository (tooling, docs, the game) is written by the implementer through a
+brief (`/muse`, skill `muse-director`); this skill measures, decides and records, and does not implement.

.agents/skills/moonlit-workflows/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: moonlit-workflows
-description: Use when a MoonlitBeacon repo request for commit/push/PR, a full check, Android device confirmation, all-direction E2E visual review of characters/monsters/items/graphics, course-clip capture, or starting a new lesson arrives in natural language without a slash command. Holds the rules, terminology (Lesson N), capture pipeline, and device-verification procedure for this monorepo of a Godot 4.7 game plus a Docusaurus course site.
+description: Use when a MoonlitBeacon repo request for commit/push/PR, a full check, Android device confirmation, all-direction E2E visual review of characters/monsters/items/graphics, course-clip capture, or starting a new lesson arrives in natural language without a slash command. Holds the rules, terminology (Lesson N), capture pipeline, and device-verification procedure for this monorepo of a Godot 4.7 game plus a Docusaurus course site. Any request to build, change, fix or write something here goes to the director/implementer workflow (the muse-director skill) first.
 ---
 
 # Moonlit Beacon workflows
@@ -10,6 +10,7 @@ request, read the matching file and follow it.
 
 | Request | Command |
 | --- | --- |
+| Build / change / fix / write anything (code, docs, notes, store text) | `.claude/commands/muse.md` (skill: `muse-director`) |
 | Commit / push / open a PR | `.claude/commands/commit.md` |
 | Check / anything wrong / does it build | `.claude/commands/verify.md` |
 | Put it on the phone / device check / APK | `.claude/commands/device.md` |
@@ -23,6 +24,12 @@ request, read the matching file and follow it.
 Whole-repo rules are in [`AGENTS.md`](../../../AGENTS.md). Below is the
 summary.
 
+## Who writes the files
+
+The agent you are is the **director**. It does not write the game, the docs or the notes: it briefs the implementer,
+judges the result and accepts it ([`/muse`](../../../.claude/commands/muse.md)). Commit, verify, device, record and release are
+operations the director runs. Which model implements is set only in `scripts/muse.config.json`.
+
 ---
 
 ## What this repo is
@@ -75,7 +82,9 @@ passing.
 
 ### git
 
-**Do not push without user confirmation.** Commits are fine.
+**Do not push without user confirmation.** Commits are fine. **Never open a pull request
+on your own**: only when the user asks for one in their own message (a guard in
+`scripts/guard-pull-request.mjs` blocks it).
 
 Never commit `.godot/`. It contains `export_credentials.cfg`, which holds
 the Android signing keystore password.

.agents/skills/moonlit-workflows/references/visual-e2e.md

@@ -141,7 +141,8 @@ partially unconfirmed".
 - Regular spirits: exhaustive-zoom the current 7 kinds × 4 directions × 4
   frames = 112 cells, and on device watch real combat with kinds, directions,
   and barrages mixed.
-- Guardians: exhaustive-zoom the current 3 kinds' 11 sheets and 50 frames.
+- Guardians: exhaustive-zoom all 12 forms across 44 sheets and 200 frames
+  (six terrains, each with its younger and promoted form).
   Front-locked presentation with `facings = 1` is an intended contract; do
   not write that you confirmed 4 directions.
 - Items, projectiles, VFX: confirm empty frames, edge contact, clipping, and

.agents/skills/muse-director/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: muse-director
+description: Use for any request to build, change, fix, tune, add or write something in the MoonlitBeacon repo (game code, scenes, tests, docs, lesson prose, notes, store text) and for finishing a release. In this repo the agent talking to the user is the director and does not write those files; the implementer does. Covers writing a brief, starting `pnpm muse run`, judging the diff, sending corrections, accepting the change and reporting.
+---
+
+# Director of the implementer
+
+The user's rule: **you are the director, not the builder.** You understand the request, write a brief, start the
+implementer, judge what comes back and report. The implementer writes every deliverable. Read
+[`AGENTS.md`](../../../AGENTS.md#director-and-implementer) for the split and
+[`.claude/commands/muse.md`](../../../.claude/commands/muse.md) for the full loop; this page is the short form.
+
+Who the implementer is, and with which model and effort, is set in `scripts/muse.config.json`. It is the only place
+that names a model; say "the implementer" everywhere else. `pnpm muse who` prints it, `pnpm muse models` lists what
+the CLI offers, `pnpm muse doctor` checks the setup. To switch models edit that one file and run the doctor.
+
+## The loop
+
+1. **Measure first.** Take the numbers the task will be judged by (tests, play bot, budgets, screenshots).
+2. **Brief.** `notes/workflow/muse/briefs/NNN-slug.md` from `notes/workflow/muse/brief-template.md`: the user's words,
+   where things stand, do and do not, acceptance a command or a number can settle, deliverables by name. One task per
+   brief. No secrets, no private paths, no model name.
+3. **Run.** `pnpm muse run <brief>` (in the background; a round can take hours). The implementer works in a copy with
+   no secrets and no git remote. If starting it is refused, stop and tell the user; do not start it another way.
+4. **Judge.** The report is a claim. `pnpm muse diff <tag>`; read the code; `pnpm muse judge <tag>` runs the checks and
+   repeats the measurements in `builds/muse/<tag>/work`; `pnpm muse log <tag>` shows a round in progress; break one guarded line to see its test fail; look at the pictures.
+5. **Decide.** `pnpm muse accept <tag> --check` then `accept`; or a short correction brief with
+   `pnpm muse run <brief> --continue <tag>`; or `discard`. Never patch its work by hand. After three rounds on one
+   defect, tell the user.
+6. **Verify and report.** `/verify` on the real tree. Tell the user, in player terms first, what changed, then the
+   commands and numbers, what the implementer got wrong, what is left and what needs them. Credit the implementer
+   (`pnpm muse who --line`); add it to the commit as an `Implemented-by:` trailer.
+
+## What you may edit yourself
+
+Briefs, `notes/workflow/muse/`, `AGENTS.md`, `.claude/`, `.agents/`, `scripts/muse*`, memory, and git operations under
+the repo's rules. Everything else goes through the implementer, one line included, unless the user asks you for a
+specific edit in their own message. Builds, test runs, measurements, captures and `/verify` are operations and stay
+with you, under the usual confirmations: no push, no pull request, no upload and no store screenshot recapture
+without the user's explicit instruction.
+
+## Never
+
+- Present the implementer's work as your own, or say a check passed that you did not run.
+- Put a secret, token, private path or personal detail in a brief; some implementer models may use what they receive
+  to improve the provider's products.
+- Start the implementer with the approval or sandbox settings changed; `scripts/muse.mjs` refuses to, and so do you.
+- Create `.claude/allow-pr` or edit the pull-request guard; the implementer has no remote and cannot open one.

.agents/skills/review-self/SKILL.md

@@ -22,6 +22,13 @@ evidence.**
 - If a fix needs a product call, is irreversible, or grows scope a lot,
   **stop and ask**.
 
+## When the implementer wrote the work
+
+In this repo the director does not edit the game (`AGENTS.md`, "Director and implementer"). A round then reads the
+implementer's diff (`pnpm muse diff <tag>`), runs the checks in its copy and repeats its measurements. "Fix only the
+verified set" still holds, but the fix is a correction brief (`pnpm muse run <brief> --continue <tag>`), never a hand
+edit. A clean round is one where the implementer's answer to the last correction needed no further one.
+
 ## Decide what to look at
 
 1. From the conversation and the repo, restore "what were we trying to do"

.agents/skills/ship-release/SKILL.md

@@ -21,6 +21,7 @@ there. Fix and run again.
 3. e2e            device/emu purchase e2e + pnpm verify
    └ on failure go back to 1. Until it passes.
 4. /commit --pr   branch → commit → push → PR (labels required)
+   └ only when the user asks for the PR. Never open one on your own.
 5. PR review      take review-bot findings on the PR plus CI results
 6. e2e again      after review landings, run 3 again
    └ on failure go back to 1.
@@ -31,6 +32,9 @@ there. Fix and run again.
 4–7 follow the rules in [`.claude/commands/commit.md`](../../../.claude/commands/commit.md).
 The repo rule **do not push without user confirmation** still applies here.
 
+Step 1 goes through the implementer (`/muse`, skill `muse-director`): the director briefs, judges and accepts, and
+never implements. Steps 2 to 8 are the director's operations.
+
 :::note There is no dedicated slash command for step 5
 This repo has no `/review-pr`. PR review is given by bots on the PR and by
 CI. Looking again yourself when there is no human reviewer is

.claude/commands/chapter.md

@@ -14,6 +14,13 @@ is in the table below.
 
 ---
 
+## Who writes it
+
+The director does not write these documents. Brief the implementer with this file as the spec
+([`/muse`](./muse.md)): the file list, the lesson list, the four requirements and the prose skeleton below are what
+the brief points at. Everything under **Wrap-up** that edits a file (the table of contents link, the two `README.md`
+rows) is part of that brief; the steps that only run something (verify, device, commit, tag) are the director's.
+
 ## What to create
 
 | File | Audience |
@@ -161,7 +168,7 @@ aloud.
    - That row in the lesson-list table: `⬜` → `✅`
    - `Current version | 0.0.1 (through Lesson N)`
 
-5. PR with [`/commit`](./commit.md)
+5. Commit with [`/commit`](./commit.md) (a PR only if the user asks for one)
 6. Run [`/review-self`](../skills/review-self/SKILL.md) until two consecutive
    rounds are clean
 7. Squash-merge, return to `main`, `git pull`

.claude/commands/commit.md

@@ -1,6 +1,6 @@
 # Commit
 
-Branch → commit → (after confirmation) push → PR.
+Branch → commit → (after confirmation) push. **A PR only when the user asks for one.**
 
 ## Usage
 
@@ -11,7 +11,7 @@ Branch → commit → (after confirmation) push → PR.
 **Options**
 
 - `--push` / `-p` : push to remote after commit (**user confirmation required**)
-- `--pr` : create a PR after push
+- `--pr` : open a PR after push (**only when the user typed `--pr` or asked for a PR in words; never inferred**)
 - `--all` / `-a` : commit everything in one go
 - `<path>` : commit only that path (e.g. `apps/game`)
 
@@ -34,6 +34,19 @@ undoing a push is painful.
 
 Commits without confirmation are fine. A commit is local and can be undone.
 
+## PR guard (absolute rule for this repo)
+
+**Never open a pull request on your own.** A finished feature, a green
+`pnpm verify` or a checklist that lists a PR step is not a request. Commit,
+push (after confirmation), then stop and ask whether they want a PR.
+
+`scripts/guard-pull-request.mjs` enforces it: `.claude/settings.json` runs it before
+every shell command and GitHub MCP call, and it refuses `gh pr create`, the
+`gh api` / `curl` routes to the same endpoint and the MCP tools. When it blocks you,
+stop and tell the user which PR you would open (base, head, title, files). They allow
+**one** by running `touch .claude/allow-pr` themselves; the guard spends the file on
+the next PR. Never create that file, and never edit the guard to get past it.
+
 ## Internal-docs guard
 
 A commit that only changes `notes/` and `.claude/` does not get a PR. End it
@@ -116,11 +129,19 @@ git commit -m "$(cat <<'EOF'
 
 <what changed and why>
 
-Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+<attribution trailers, see below>
 EOF
 )"
 ```
 
+**Attribution.** End the message with the attribution line your agent tool prescribes (Claude Code's session
+reminder gives the exact line; do not copy a model name from this page). When the implementer wrote the change,
+add one more trailer after it:
+
+```text
+Implemented-by: <the line `pnpm muse who --line` prints>
+```
+
 **type**
 
 | type | Contents |
@@ -179,7 +200,10 @@ To undo, delete the ref with `git update-ref -d HEAD` (first commit, so
 there is no `HEAD~1`).
 :::
 
-## 7. PR
+## 7. PR (only when the user asked for one)
+
+Skip this whole section unless they did. The guard above blocks the command
+until they allow it.
 
 ```bash
 gh pr create --base main --title "<type>(<scope>): <summary>" --body "$(cat <<'EOF'
@@ -310,7 +334,7 @@ Lesson 3 places three instances of it.
 - PointLight2D energy is an export so intensity can be tuned
 - The three particle systems stay as children (they must move as one)
 
-Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+<attribution trailers, see below>
 ```
 
 **Adding a clip**
@@ -321,7 +345,7 @@ media(course): add Lesson 2 node-tree assembly clip
 Silent 38s, 1212x736, 612KB. Inside the repo clip budget.
 The 1920x1080 master with narration is in builds/footage/ (not in git).
 
-Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+<attribution trailers, see below>
 ```
 
 **Docs**
@@ -333,5 +357,5 @@ docs(course): write Lesson 2 prose
 - Add the scene-save location rule in section 3-2
 - Seven done criteria
 
-Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+<attribution trailers, see below>
 ```

.claude/commands/device.md

@@ -3,6 +3,8 @@
 Bake an APK, put it on a Pixel 10, and confirm the screen that actually runs.
 A commit that changes the game screen is not done until this.
 
+An operation: the director runs it. A file that has to change first goes through a brief ([`/muse`](./muse.md)).
+
 ## Usage
 
 ```text