fix: address review-council findings and boostrap uf

.cursorrules

@@ -0,0 +1,25 @@
+# Unbound Force — managed by uf init
+
+This project follows coding conventions defined in
+AGENTS.md and enforced through convention packs. Before
+writing or reviewing code, read the applicable convention
+pack(s) from .opencode/uf/packs/ and apply all rules
+marked [MUST].
+
+Available packs:
+- .opencode/uf/packs/default.md
+- .opencode/uf/packs/default-custom.md
+- .opencode/uf/packs/severity.md
+- .opencode/uf/packs/content.md
+- .opencode/uf/packs/content-custom.md
+
+For engineering philosophy and coding principles, read
+.opencode/agents/cobalt-crush-dev.md.
+
+When reviewing code, consult the applicable reviewer
+checklist from .opencode/agents/:
+- divisor-guard.md — intent drift, constitution
+- divisor-architect.md — structure, patterns, DRY
+- divisor-adversary.md — security, error handling
+- divisor-testing.md — test quality, assertions
+- divisor-sre.md — operations, performance

.github/workflows/ci.yml

@@ -26,8 +26,8 @@ jobs:
       - name: Install Task
         uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
         with:
-          version: 3.x
+          version: "3.50.0"
       - name: Run vet
         run: task vet-examples
       - name: Run test
-        run: task test
+        run: task test

.github/workflows/publish-cue.yml

@@ -20,6 +20,14 @@ jobs:
         uses: cue-lang/setup-cue@a93fa358375740cd8b0078f76355512b9208acb1 # v1.0.1
         with:
           version: "v0.17.0"
+      - name: Install Task
+        uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+        with:
+          version: "3.50.0"
+      - name: Validate schema before publish
+        run: |
+          task vet-examples
+          task test
       - name: Login to CUE Central Registry
         uses: cue-labs/registry-login-action@66d40052b0206031343e17173425fa10508968d0 # v1.0.3
       - name: Publish module

.gitignore

@@ -24,3 +24,29 @@ node_modules/
 
 # Working artifacts (never committed)
 docs/superpowers/
+openspec/
+
+# Unbound Force — managed by uf init
+# Runtime data under .uf/ (databases, caches, locks, logs)
+.uf/workflows/
+.uf/artifacts/
+.uf/dewey/graph.db
+.uf/dewey/graph.db-shm
+.uf/dewey/graph.db-wal
+.uf/dewey/*.lock
+.uf/dewey/cache/
+.uf/dewey/dewey.log
+.uf/replicator/*.db
+.uf/replicator/*.db-shm
+.uf/replicator/*.db-wal
+.uf/replicator/*.lock
+.uf/muti-mind/artifacts/
+.uf/mx-f/data/
+# Devcontainer — OS-specific, generated by uf sandbox init
+.devcontainer/
+# Legacy tool directories (renamed to .uf/ in Spec 025)
+.dewey/
+.hive/
+.unbound-force/
+.muti-mind/
+.mx-f/

.lola-eval/provision.sh

@@ -37,6 +37,14 @@ for starter in "$TESTS_DIR"/*/starter; do
   [[ -d "$starter" ]] || continue
   case_name="$(basename "$(dirname "$starter")")"
 
+  # On failure partway through a case, remove its partial provisioning
+  # rather than leaving a half-written starter that a retry would trust.
+  # $clean isn't assigned yet at this point in the iteration, so this arm
+  # only covers $starter — it is re-armed below to add $clean once that
+  # path exists, so an early failure never rm -rf's the previous
+  # (unrelated, already-finished) case's starter-clean/.
+  trap 'rm -rf "$starter/.lola" "$starter/.claude" "$starter/.opencode" "$starter/.gitconfig"' ERR
+
   # Clean prior provisioning (module files + CLI integration dirs)
   rm -rf "$starter/.lola" "$starter/.claude" "$starter/.opencode"
 
@@ -102,15 +110,19 @@ GIT
   # Create starter-clean/ — same source, no module artifacts. Used by
   # pack_id=none baseline runs for genuine bare-model comparison.
   clean="$TESTS_DIR/$case_name/starter-clean"
+  trap 'rm -rf "$starter/.lola" "$starter/.claude" "$starter/.opencode" "$starter/.gitconfig" "$clean"' ERR
   rm -rf "$clean"
   cp -a "$starter" "$clean"
   rm -rf "$clean/.lola" "$clean/.claude" "$clean/.opencode"
   for f in AGENTS.md CLAUDE.md; do
     if [[ -f "$clean/$f" ]]; then
-      sed -i '/<!-- lola:module:.*:start -->/,/<!-- lola:module:.*:end -->/d' "$clean/$f"
-      sed -i '/<!-- lola:skills:start -->/,/<!-- lola:skills:end -->/d' "$clean/$f"
-      sed -i '/<!-- lola:instructions:start -->/d; /<!-- lola:instructions:end -->/d' "$clean/$f"
-      sed -i '/^## Lola Skills$/,/^<!-- lola:skills:start -->/d' "$clean/$f" 2>/dev/null || true
+      # -i.bak + rm (not bare -i) for BSD/macOS sed portability — GNU sed's
+      # -i takes an optional inline suffix, BSD sed's -i requires one.
+      sed -i.bak '/<!-- lola:module:.*:start -->/,/<!-- lola:module:.*:end -->/d' "$clean/$f"
+      sed -i.bak '/<!-- lola:skills:start -->/,/<!-- lola:skills:end -->/d' "$clean/$f"
+      sed -i.bak '/<!-- lola:instructions:start -->/d; /<!-- lola:instructions:end -->/d' "$clean/$f"
+      sed -i.bak '/^## Lola Skills$/,/^<!-- lola:skills:start -->/d' "$clean/$f" 2>/dev/null || true
+      rm -f "$clean/$f.bak"
       if [[ ! -s "$clean/$f" ]] || ! grep -q '[^[:space:]]' "$clean/$f" 2>/dev/null; then
         rm -f "$clean/$f"
       fi
@@ -120,6 +132,10 @@ GIT
   provisioned=$((provisioned + 1))
   echo "provision.sh: provisioned $case_name (+ starter-clean)"
 done
+# Clear the per-iteration trap — otherwise a failure after the loop (e.g.
+# the provisioned-count check below) would fire it with the last
+# iteration's $starter/$clean and delete an already-finished case.
+trap - ERR
 
 if [[ $provisioned -eq 0 ]]; then
   echo "provision.sh: no starter dirs found under $TESTS_DIR" >&2