Manager

Manager mode has TWO independent layers. Keep them straight:

1. SOFT codewords (++m / ++mp / ++rr / ++r) — autonomous, hook-driven, ALWAYS fire. A UserPromptSubmit hook (hooks/manager-prompt.mjs) watches every prompt; when it sees a codeword it injects the matching block as additionalContext for that one turn. This is NOT enabled/disabled by this skill — it works regardless of skill state. The skill only explains it (status) and customizes its TEXT (mode/edit/reset). Detection order (longest-prefix first):
   • ++mp → Manager + Plan Mode (planmode) — writes the task graph, uses the tasks tool; tested first (prefix collision with ++m).
   • ++m → Manager mode (full) — delegate-everything prompt.
   • ++rr → Regression Review discipline (review-regression) — after each significant phase: no regression + project standard + correctness; two-phase review→double-check→fix; final cross-review at task end. Tested after ++m, before ++r.
   • ++r → Review discipline (review-double) — two-phase multi-agent review→double-check→fix after each significant change; codeword-only (no ambient/wall injection).
   • When the HARD wall is ON, the Manager (full) block is ALSO auto-injected on EVERY turn — no codeword needed. Codewords and wall injection are independent.
2. HARD wall — opt-in, this skill only, PER-PROJECT, INSTALLED-INTO-THE-PROJECT, persistent. The wall is NOT a plugin hook. on does two things: it installs a self-contained PreToolUse guard into THIS project (copies the guard file + idempotently registers it in <cwd>/.claude/settings.local.json) and arms it by flipping state.hard=true. The registered guard then physically denies mutating tools (Write/Edit/Bash/WebFetch/...) in the main session, leaving only delegate/read/track. Subagents stay fully free (agent_id linchpin). off only flips state.hard=false (disarm) — registration stays, the guard no-ops. uninstall removes the registration. The wall lives in project state + project settings, defaults OFF, persists until off/uninstall. There is no codeword for the wall.

The two layers are orthogonal: the wall enforces delegation by removing hands; the codewords/prompt-text shape the Manager mindset. Either can be used alone.

INSTALL-ONCE + STATE-GATE (the safety crux): the guard is registered once in settings.local.json (a personal, gitignored file) but is gated at runtime by project state.json {hard}. Registration is the persistent plumbing; state.hard is the live kill-switch. This split exists because while the wall is armed it DENIES Edit/Bash on arbitrary files — so off must NOT touch settings.local.json (that edit would be blocked). Instead off flips state.json, and the guard is self-exempt for the writeState node command (path anchor), so the state flip always succeeds even at level strict. Conclusion: state.json is the runtime on/off; registration is harmless inert plumbing left in place.