feat: domain knowledge layer — Role, domain rules, progressive learning

- Add ## Role and ## Domain sections to CLAUDE.md template
- Add question 4 (domain + role) to /forge init
- Add Paso 6b (domain scaffolding) to /forge bootstrap
- Create domain-extract skill (/forge domain extract|list|sync-vault)
- Create domain-learning.md rule (progressive knowledge accumulation)
- Add domain/ no-touch protection to /forge sync
- Add domain knowledge section to /forge audit report
- Add domain routing + preconditions to forge.md
- Update session-report hook to track domain knowledge changes
- Add domain: trading + last_verified to trading stack frontmatter
- Extract 6 domain rules for claude-kit (.claude/rules/domain/)
- Add Role to claude-kit CLAUDE.md
- Fix overly broad globs in context-window-optimization and prompting-patterns

52 domain rules created across 9 projects. Each project now has a Role
directive and contextual domain knowledge that auto-loads via globs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: luiseiman

.claude/agent-memory/implementer/MEMORY.md

@@ -3,3 +3,8 @@
 - [hooks-settings-schema](feedback_hooks_schema.md) — Claude Code settings.json hooks require object format {type, command}, not strings
 - [forge-sync-pattern](project_sync_pattern.md) — Pattern for /forge sync: manifest files dict is informational, only update version/date; preserve any rule not in manifest
 - [practices-write-tool](feedback_practices_write.md) — Write tool requires prior Read; use bash cat heredoc for new files in practices/
+- [soma2-domain-extract](project_soma2_domain_extract.md) — Sources read, 8 domain rule files created, Role section added to CLAUDE.md
+- [soma-domain-extract](project_soma_domain_extract.md) — SOMA (luiseiman/SOMA): 7 domain rule files created, Role section added. Auto-memory at ~/.claude/projects/-Users-luiseiman-Documents-GitHub-SOMA/memory/ is the richest source (arquitectura.md)
+- [derup-domain-extract](project_derup_domain_extract.md) — derup ER modeler: 5 domain rule files created, Role section added. CLAUDE_ERRORS.md was richest source. Custom SVG canvas (not React Flow). lint has known violations — use build.
+- [openclaw-domain-extract](project_openclaw_domain_extract.md) — openclaw/openclaw: 6 domain rule files created, Role section added. CLAUDE.md (260+ lines) was the only real source; no auto-memory existed. Key: Oxlint+Oxfmt, Bun for TS, 4-point bug-fix merge gate, GHSA PATCH footgun.
+- [glob-specificity-fix](feedback_glob_specificity.md) — Wildcard `**/*.md` in domain rule globs defeats purpose; always verify real paths with ls before writing globs.

.claude/agent-memory/implementer/feedback_glob_specificity.md

@@ -0,0 +1,19 @@
+---
+name: glob-specificity-fix
+description: Domain rule globs must never use broad wildcards like **/*.md — always verify real paths and use specific patterns
+type: feedback
+---
+
+Using `**/*.md` as a glob in domain rules defeats the purpose: the rule loads on every markdown edit regardless of relevance, inflating context.
+
+**Why:** Domain rules exist to inject focused context only when editing the relevant subsystem. A broad wildcard makes them always-on, no better than putting content in CLAUDE.md.
+
+**How to apply:** When writing or fixing globs in `.claude/rules/domain/` files:
+- Always run `ls` on relevant directories first to confirm real paths exist
+- Use the narrowest match possible: specific filenames > directory globs > extension globs
+- If a glob includes `**/*.md` alongside more specific patterns, the specific patterns are redundant — remove the broad one
+- Prefer listing specific files (`core/pipeline.py,core/data_bus.py`) over directory wildcards (`core/**`) when only a subset of files is relevant
+
+## 2026-03-25 — claude-kit + TRADINGBOT glob audit
+- **Learned:** `**/*.md` appeared in two claude-kit domain rules, making them load on every markdown file. The TRADINGBOT data-flow rule covered `strategies/**` even though strategies don't participate in the data pipeline.
+- **Avoid:** Mixing broad extension globs with specific path globs — the broad one makes the specific ones meaningless.

.claude/agent-memory/implementer/project_derup_domain_extract.md

@@ -0,0 +1,26 @@
+---
+name: derup-domain-extract
+description: Domain extraction for derup ER modeler — sources read, files created, patterns learned
+type: project
+---
+
+## 2026-03-25 — /forge domain extract on derup
+
+Sources read: CLAUDE.md, CLAUDE_ERRORS.md (16 entries), agent-memory/implementer.md, auto-memory MEMORY.md, existing rules (frontend.md, _common.md), git log, er.ts, aiCommands.ts, chatParser.ts, Canvas.tsx (connection validation section), App.tsx (AI providers, WebSocket).
+
+5 domain rule files created in `.claude/rules/domain/`:
+- `er-modeling.md` — node types, valid connection pairs, self-relationships, aggregations, DiagramSnapshot
+- `ai-command-protocol.md` — Zod discriminated union schema, all command types, parsing functions, App.tsx helper rules
+- `chat-parser.md` — fuzzy match algorithm (startsWith before Levenshtein), attribute extraction quirks, clear-diagram boolean condition
+- `ai-providers.md` — Gemini/Grok/Ollama/OpenClaw enum, connectivity states, VPS gateway reload pattern
+- `canvas-rendering.md` — SVG connectors, self-relationships, isValidConnection actual pairs, export history
+- `websocket-collaboration.md` — room lifecycle, sync message shape, TS strict state trap
+
+Role section added to CLAUDE.md with 5 bullet points covering core concerns + 3 operational rules.
+
+**Key learnings:**
+- CLAUDE_ERRORS.md was the richest source — 16 real errors with root causes, directly translatable to domain rules
+- derup uses custom SVG canvas, NOT React Flow despite similar concepts
+- AI provider enum is `'gemini' | 'grok' | 'ollama' | 'openclaw'` (not OpenAI/Anthropic directly)
+- `npm run lint` has known pre-existing violations — `npm run build` is the authoritative check
+- chatParser has 7 pre-existing failing tests — do not attempt to fix unless explicitly asked

.claude/agent-memory/implementer/project_openclaw_domain_extract.md

@@ -0,0 +1,17 @@
+---
+name: openclaw-domain-extract
+description: openclaw/openclaw: domain rule files created, Role section added to CLAUDE.md
+type: project
+---
+
+OpenClaw domain extract completed 2026-03-25.
+
+- CLAUDE.md is very large (260+ lines); read in chunks using offset/limit.
+- Git log was shallow (only 2 commits) — CLAUDE.md was the richest source by far.
+- No auto-memory existed for openclaw at ~/.claude/projects/-Users-luiseiman-Documents-GitHub-openclaw/memory/.
+- 6 domain rule files created under `.claude/rules/domain/`: architecture, github-automation, typescript-conventions, testing, docs-i18n, security-trust, ops-devenv.
+- Role section added to CLAUDE.md after `<!-- forge:custom -->` marker and before `# Repository Guidelines`.
+- Key OpenClaw-specific patterns to remember: auto-close labels via `.github/workflows/auto-response.yml`, bug-fix 4-point merge gate, Oxlint+Oxfmt (not ESLint/Prettier), Bun preferred for TS execution, no prototype mutation, GHSA PATCH footgun (severity + cvss_vector_string cannot be set in same call).
+
+**Why:** Domain rules were missing; CLAUDE.md content was not surfaced as structured rules for auto-loading by globs.
+**How to apply:** For future openclaw sessions, domain rules in `.claude/rules/domain/` auto-load on matching file globs.

.claude/agent-memory/implementer/project_soma2_domain_extract.md

@@ -0,0 +1,26 @@
+---
+name: soma2_domain_extract_pattern
+description: Pattern for /forge domain extract on SOMA2 — sources to read, files created, CLAUDE.md Role section
+type: project
+---
+
+When running `/forge domain extract` on SOMA2:
+
+**Sources that exist and are useful:**
+- `CLAUDE.md` — comprehensive, covers stack, architecture, layer boundaries, LLM providers, Redis keys, conventions
+- `CLAUDE_ERRORS.md` — exists but was empty on 2026-03-25
+- `.claude/agent-memory/implementer/` — has 3 feedback memories (claude_cli_system_prompt, property_vs_method, ruff_import_order)
+- `.claude/rules/` — 14 existing rule files (backend, security, redis, agents, memory, model-routing, tui, infrastructure, etc.)
+- No auto-memory existed at `/Users/luiseiman/.claude/projects/-Users-luiseiman-Documents-GitHub-SOMA2/memory/`
+
+**Files created** in `.claude/rules/domain/`:
+- `llm-providers.md` — provider chain priority, Claude CLI --system-prompt gotcha, circuit breaker
+- `redis-streams.md` — soma.* stream names, soma: key schema, IDs format, XACK rules
+- `otar-loop.md` — Observe-Think-Act-Reflect, tool call parsing regex, security gate, agent registry
+- `security-policy.md` — L0-L4 risk levels, danger patterns, allowlist source
+- `classifier.md` — 4 routes (CHAT/INTERNAL_OPS/HYBRID/EXTERNAL_TASK), deterministic, no LLM
+- `channels.md` — TUI (Textual+SSE), Telegram polling, Web React+Vite, SSE event flow
+- `error-journal.md` — ErrorJournal top-10 auto-injected, ThreadMemory 40 msgs 7d TTL
+- `vps-deploy.md` — Oracle ARM64, Tailscale, Docker Compose, env vars
+
+**Why:** `## Role` section was missing in CLAUDE.md — added 6-line summary covering what SOMA2 is and its key properties.

.claude/agent-memory/implementer/project_soma_domain_extract.md

@@ -0,0 +1,25 @@
+---
+name: soma_domain_extract_pattern
+description: Pattern for /forge domain extract on SOMA (luiseiman/SOMA) — sources read, files created, CLAUDE.md Role section
+type: project
+---
+
+When running `/forge domain extract` on SOMA (at `/Users/luiseiman/Documents/GitHub/SOMA`):
+
+**Sources that exist and are useful:**
+- `CLAUDE.md` — covers stack, pipeline, services table, security policy, key files
+- `CLAUDE_ERRORS.md` — exists but was empty on 2026-03-25
+- Auto-memory at `~/.claude/projects/-Users-luiseiman-Documents-GitHub-SOMA/memory/` — rich, 9 files (arquitectura.md is the most detailed; lecciones.md has 36 lessons; errores_produccion.md has top 10 prod errors)
+- `.claude/rules/` — 9 existing rule files (backend, planner, deploy, frontend, ios, api-parity, agents, tests, _common)
+- `.claude/agent-memory/implementer.md` — minimal (only scaffold placeholder)
+
+**Files created** in `.claude/rules/domain/`:
+- `llm-routing.md` — provider chain priority, task→provider classification, OpenClaw JSON format, SYSTEM_CONTEXT injection
+- `redis-streams.md` — soma.* stream names, soma: key schema, TTLs, asyncio constraint, network mode impact
+- `pipeline-classification.md` — 4 routes, intent resolver states, special sub-categories, deep_research branch, agent routing, memory_ctx propagation
+- `security-policy.md` — L0-L4 risk levels, allowlist enforcement, danger patterns, planner_gate, web access policy, auth modes
+- `vps-deployment.md` — Oracle ARM64, Tailscale setup, soma update command, depends_on cascade issue, verification checklist
+- `agent-skill-system.md` — 5 built-in agents, hot-reload, inter-agent delegation, skill evolution (Sprint 5), feedback loops
+- `channel-adapters.md` — canonical input format, adapter table (Telegram/Slack/GitHub/Web), SSE reconnection pattern, deep_research SSE events
+
+**CLAUDE.md Role section:** Added after first heading. Covers: multi-LLM orchestration, Redis Streams, Python async, security policy (L0-L4), and pointer to `.claude/rules/domain/`.

.claude/rules/domain/agent-orchestration.md

@@ -0,0 +1,19 @@
+---
+globs: "**/agents/*.md,**/rules/agents.md"
+description: "Agent delegation patterns and team coordination"
+domain: claude-code-engineering
+last_verified: 2026-03-25
+---
+
+# Agent Orchestration
+
+- Decision tree: 1-file fix → direct. Research-heavy → researcher. Code+tests → implementer
+- Multi-component (>3 files, >2 concerns, >15 min estimated) → Agent Team
+- Agent Team: Lead (coordinates, does NOT implement) + max 3-4 teammates
+- Each teammate MUST use isolation: "worktree" for independent copy of repo
+- Sequential chaining: researcher → architect → implementer → test-runner → code-reviewer
+- NEVER spawn new agent for follow-ups — use SendMessage({to: agentId}) to continue
+- Memory agents: architect, implementer, code-reviewer, security-auditor (accumulate learnings)
+- Transactional agents: researcher, test-runner (execute and report, no memory)
+- Subagent output must not exceed 30% of main context — always structured summaries
+- Always verify subagent output (run tests/lint) before declaring task done

.claude/rules/domain/context-window-optimization.md

@@ -0,0 +1,19 @@
+---
+globs: "template/**/*.md,docs/memory-strategy.md,**/CLAUDE.md,**/rules/memory.md,**/MEMORY.md"
+description: "Context window management and token optimization patterns"
+domain: claude-code-engineering
+last_verified: 2026-03-25
+---
+
+# Context Window Optimization
+
+- MEMORY.md index: only first 200 lines injected at session start — anything beyond is invisible
+- If MEMORY.md approaches 150 lines, archive low-relevance entries or consolidate
+- Memory files themselves have no line limit — only the index is capped
+- CLAUDE.md must be <100 lines; if larger, modularize into .claude/rules/
+- Every line in CLAUDE.md must change Claude's behavior — if removed, Claude should fail
+- Use globs in rules to prevent loading unnecessary context into the window
+- Delegate research-heavy work to subagents to protect main thread context
+- Subagent summaries must not exceed 30% of main context — prefer structured summaries
+- Compact format: imperative mood, one instruction per line, no hedging, no filler
+- Rules auto-load by glob matching — only relevant context enters the window

.claude/rules/domain/hook-architecture.md

@@ -0,0 +1,20 @@
+---
+globs: "**/*.sh,**/settings.json,**/settings.json.partial"
+description: "Hook system design patterns and safety requirements"
+domain: claude-code-engineering
+last_verified: 2026-03-25
+---
+
+# Hook Architecture
+
+- Hook events: SessionStart, PreToolUse, PostToolUse, UserPromptSubmit, Stop, SubagentStop
+- Exit codes: 0 = allow, 1 = warn/error (non-blocking), 2 = block (stops the operation)
+- In settings.json, hooks MUST be objects: {"type": "command", "command": "path/to/script.sh"}
+- NEVER use plain strings for hooks — Claude Code rejects them silently
+- Matchers: Bash, Read, Write, Edit, Grep, Glob — determine which tool triggers the hook
+- block-destructive.sh is mandatory; supports profiles: minimal, standard, strict
+- lint-on-save.sh is recommended; matcher = Write|Edit for post-save linting
+- session-report.sh runs on Stop; generates JSON metrics to ~/.claude/metrics/
+- All hooks must be executable: chmod +x (permissions -rwxr-xr-x)
+- Validate hooks with bash -n before deploying; shellcheck if available
+- Counter files for metrics use md5 hash of PWD for cross-invocation persistence

.claude/rules/domain/permission-model.md

@@ -0,0 +1,19 @@
+---
+globs: "**/settings.json,**/settings.local.json,**/settings.json.partial"
+description: "Dual-list permission model and deny list requirements"
+domain: claude-code-engineering
+last_verified: 2026-03-25
+---
+
+# Permission Model
+
+- Dual-list security: allow (explicit permissions) + deny (forbidden patterns)
+- Never use Bash(*) — use specific wildcards: Bash(git *), Bash(docker *), Bash(npm *)
+- Mandatory deny entries: **/.env, **/*.key, **/*.pem, **/*credentials*
+- Mandatory deny commands: rm -rf *, git push*--force*, DROP TABLE, DROP DATABASE, chmod -R 777
+- settings.json (committed, shared) vs settings.local.json (personal, gitignored)
+- Sync merge strategy: deny list = union of sets (add missing, never remove); allow list = preserve as-is
+- NEVER touch skipDangerousModePermissionPrompt — user decision only
+- Permission sprawl: exact commands accumulate instead of wildcards (e.g., 40 ssh entries → 3 patterns)
+- Audit: if settings.json OR block-destructive hook missing → security cap, max score 6.0
+- mcpServers config goes in settings.json alongside permissions