fix: converge every gitignore recommendation on the recursive overlay line

.gitleaksignore

@@ -0,0 +1,10 @@
+# Gitleaks false-positive fingerprints (commit:file:rule:line).
+#
+# CLAUDE_TOKEN in resolve-convention-home.sh is the parser sense of "token"
+# (the pointer line lifted from a convention-home region), never a credential;
+# the generic-api-key rule keys on the identifier and reads the next line
+# (CLAUDE_SHIM=0) as the value. The current file carries a gitleaks:allow
+# annotation; these entries cover the pre-annotation commits, which the CI
+# scan reaches because it runs with --log-opts=--all over every fetched ref.
+f7aec1549dec60407a24a7d8ea720696b7b099af:plugins/claude-config/lib/resolve-convention-home.sh:generic-api-key:248
+708739fb2ba1b0196e93f9c07d3293bddfeed2f0:plugins/plugin-quality/lib/resolve-convention-home.sh:generic-api-key:249

docs/conventions/config-cascade/README.md

@@ -113,9 +113,8 @@ That is the whole convention — **one line, recursive form, for every surface**
 zero or more directories, so this single rule covers a flat `.claude/source-control.local.md`, a
 one-deep `.claude/ecosystems/python.local.yaml`, and a profiled
 `.claude/ai-briefing/<profile>/x.local.md` alike, while leaving team files tracked. The narrower
-`.claude/*.local.*` is what several surfaces currently recommend and it silently fails to ignore any
-folder-form overlay; recommend the recursive form instead, and never ask a consumer for two lines
-where one is exact.
+`.claude/*.local.*` silently fails to ignore any folder-form overlay; recommend the recursive form
+only, and never ask a consumer for two lines where one is exact.
 
 **No plugin writes the consumer's `.gitignore`.** A setup skill recommends the line and leaves the
 edit to the consumer; their ignore file is their artifact.
@@ -189,8 +188,8 @@ surface, or amend this contract) is a separate human-gated decision.
 
 **Undeclared** — divergence with no recorded rationale:
 
-- **`ai-briefing` advertises an overlay layer it does not implement.** Its setup recommends a
-  `.claude/ai-briefing/**/*.local.*` gitignore line, but no read path resolves a `.local.*` file and
+- **`ai-briefing` advertises an overlay layer it does not implement.** Its setup recommends the
+  recursive `.claude/**/*.local.*` gitignore line, but no read path resolves a `.local.*` file and
   no file defines what one would do. Its documented resolution covers profile *selection* only, never
   layer precedence. This is the only surface telling consumers to gitignore a layer that has no
   effect.
@@ -228,11 +227,14 @@ sweep — and each migration updates its own row in the same change.
 
 ### Overlay spelling drift
 
-The fleet currently ships four spellings — `.claude/*.local.*`, `.claude/ecosystems/*.local.*`,
-`.claude/autonomy/**/*.local.*`, and a bare `*.local.md` inside a setup-owned
-`<standards_dir>/.gitignore`. Each is narrowly correct for its own surface, and collectively they
-defeat the one-line promise: a consumer running three plugins is asked for three lines, and the two
-non-recursive spellings would silently miss a nested overlay if their surface ever grew a folder.
-The recursive line above subsumes all four. Converging each surface's recommendation on it is a
-per-surface change tracked by the rows above, not a rule this contract can retroactively impose on
-config already written into consumer repositories.
+Every setup surface now recommends (or, for `source-control` and `work-items`, appends) the
+recursive line above. The narrow spellings the fleet used to ship — `.claude/*.local.*`,
+`.claude/ecosystems/*.local.*`, `.claude/autonomy/**/*.local.*` — were each narrowly correct for
+their own surface but collectively defeated the one-line promise: a consumer running three plugins
+was asked for three lines, and the non-recursive spellings would silently miss a nested overlay if
+their surface ever grew a folder. Two deliberate exceptions remain: the bare `*.local.md` inside
+the setup-owned `<standards_dir>/.gitignore` (a dedicated ignore file scoped to the standards
+root, not the consumer's `.gitignore`), and `work-items`' repo-root
+`.work-item-tracker.local.json` line (ADR 0015; outside `.claude/` entirely). This contract does
+not retroactively rewrite narrow lines already written into consumer repositories — the recursive
+line simply supersedes them where both exist.

docs/conventions/ecosystem-commands/README.md

@@ -55,7 +55,7 @@ Resolution per ecosystem, additive per key: **user-global → team file → loca
 layer overrides earlier layers key-by-key and never replaces the base file wholesale (the same
 resolution the extensibility contract specifies for tracked rich config, and the same
 vendor-defaults-plus-drop-in-overrides shape the UAPI configuration-files specification
-standardizes). Recommended consumer `.gitignore` line: `.claude/ecosystems/*.local.*`.
+standardizes). Recommended consumer `.gitignore` line: the recursive `.claude/**/*.local.*`.
 
 The drop-in folder form is deliberate: each ecosystem is an independent slice with its own lifecycle
 — adding one is a new file, retiring one is a deletion, and a toolchain change is a single-file diff.

plugins/ai-briefing/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "ai-briefing",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "Build source-backed AI-industry briefings from official vendor publications, configured RSS/Atom feeds, GitHub releases, reputable secondary reporting, and user-supplied URLs. Deduplicate, rank, and present results as markdown or optional HTML/PPTX decks, with repository-owned profile, audience, and brand configuration. Automated X/Twitter collection is disabled; Playwright is used only for deterministic local rendering.",
   "author": {
     "name": "Melodic Software",

plugins/ai-briefing/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `ai-briefing` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.7.9]
+
+### Changed
+
+- `setup` (and the README/reference docs) now recommend config-cascade's mandated recursive `.claude/**/*.local.*` gitignore line for personal overlays instead of a narrow or bespoke spelling (#3582, customization-consistency Phase 1a).
+
 ## [0.7.8]
 
 ### Changed

plugins/ai-briefing/skills/setup/SKILL.md

@@ -103,9 +103,9 @@ nothing and reports "already configured".
    install an X API provider. Note the current X access restriction and link the
    authoritative terms: <https://x.com/en/tos>.
 2. **Offer optional overlays.** Offer `audience.md` and declarative `brand.json`, creating only
-   the files the consumer requests. Keep local logo assets beside `brand.json`. Recommend a
-   project ignore convention such as `.claude/ai-briefing/**/*.local.*` for personal overlays
-   while keeping shared profile files tracked.
+   the files the consumer requests. Keep local logo assets beside `brand.json`. Recommend the
+   recursive `.claude/**/*.local.*` ignore line for personal overlays while keeping shared
+   profile files tracked.
 3. **`apply install-build-deps` installs the optional build toolchain.** Parse the subaction
    before invoking a shell and never interpolate raw arguments into a command. Without it,
    skip this step and change no existing runtime. With it, build and validate a temporary

plugins/autonomy/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.22.8",
+  "version": "0.22.9",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",

plugins/autonomy/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `autonomy` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.22.9]
+
+### Changed
+
+- `setup` (and the README/reference docs) now recommend config-cascade's mandated recursive `.claude/**/*.local.*` gitignore line for personal overlays instead of a narrow or bespoke spelling (#3582, customization-consistency Phase 1a).
+
 ## [0.22.8]
 
 ### Changed

plugins/autonomy/README.md

@@ -182,7 +182,7 @@ The payload is a fixed vocabulary, never the sentinel token, marker path, cwd, o
 
 Setup writes tracked config to `.claude/autonomy/` in the consuming repo (concern-named. The
 config outlives any plugin restructure). Personal overlays follow the marketplace overlay
-convention: `.claude/autonomy/**/*.local.*` stays gitignored; layers resolve per the
+convention: the recursive `.claude/**/*.local.*` line keeps them gitignored; layers resolve per the
 binding-seam ladder: user-global → org binding (when pointed) → project → local overlay, additively.
 
 <!-- ai-slop-ignore-start: generated options block; source is plugin.json + scripts/sync-plugin-options-docs.py -->

plugins/autonomy/skills/setup/SKILL.md

@@ -76,7 +76,7 @@ ask and offer to persist; otherwise → safe free-tier default).
 The same file name is the shape at EVERY layer: the user-global layer is
 `~/.claude/autonomy/binding.json`, the project layer `.claude/autonomy/binding.json`, and
 each layer's personal overlay `binding.local.json` beside it. The project file is tracked
-(team-shared); recommend the consumer `.gitignore` line: `.claude/autonomy/**/*.local.*`.
+(team-shared); recommend the recursive consumer `.gitignore` line: `.claude/**/*.local.*`.
 Layers resolve per the binding-seam ladder. User-global → org binding (when pointed) →
 project → local overlay. Additively. Capability slices (like telemetry below) add their
 sections ADDITIVELY under their slice name: a binding without a slice's section is valid

plugins/codebase-health/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "codebase-health",
-  "version": "0.8.3",
+  "version": "0.8.4",
   "description": "Repo-wide drift audit between docs, config, code, and architecture: verifies every factual claim against reality via parallel subagent fan-out, severity-rates findings, and reports read-only, delegating remediation to the implementation/verification lanes. Audit dimensions are configurable through a tracked .claude/codebase-health.md config file written by the setup skill.",
   "author": {
     "name": "Melodic Software",

plugins/codebase-health/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `codebase-health` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.8.4]
+
+### Changed
+
+- `setup` (and the README/reference docs) now recommend config-cascade's mandated recursive `.claude/**/*.local.*` gitignore line for personal overlays instead of a narrow or bespoke spelling (#3582, customization-consistency Phase 1a).
+
 ## [0.8.3]
 
 ### Changed

plugins/codebase-health/README.md

@@ -62,7 +62,7 @@ hardcodes a repo's layout.
 /codebase-health:setup apply   # interview + write .claude/codebase-health.md (re-runnable)
 ```
 
-Add `.claude/*.local.*` to your `.gitignore` so personal overlays stay out of version control while
+Add the recursive `.claude/**/*.local.*` line to your `.gitignore` so personal overlays stay out of version control while
 team config stays tracked.
 
 ## Consumer conventions

plugins/codebase-health/skills/setup/SKILL.md

@@ -91,8 +91,8 @@ the repo make the values unambiguous; ask only where a dimension's targets genui
    parse and name real paths, and `git check-ignore -v .claude/codebase-health.md` confirms it is
    tracked, not ignored (surface the matching pattern and offer to fix `.gitignore` before reporting
    success). Then **offer the overlay convention**: personal overrides go in
-   `.claude/codebase-health.local.md`; recommend the consumer add `.claude/*.local.*` to `.gitignore`
-   if not already covered. A user-global base at `~/.claude/codebase-health.md` is also honored. Layers
+   `.claude/codebase-health.local.md`; recommend the consumer add the recursive `.claude/**/*.local.*`
+   line to `.gitignore` if not already covered. A user-global base at `~/.claude/codebase-health.md` is also honored. Layers
    resolve user-global → team → local overlay, additively.
 
 Re-running `apply` after everything passes changes nothing and reports "already configured".

plugins/codebase-health/skills/setup/evals/evals.json

@@ -29,11 +29,11 @@
       "id": 3,
       "name": "writes-tracked-config-not-plugin-dir",
       "prompt": "/codebase-health:setup apply\n\nJust write a sensible default config for this repo.",
-      "expected_output": "Materializes the config at the consumer's tracked .claude/codebase-health.md, confirms it is tracked (not gitignored), and offers the .claude/*.local.* overlay/gitignore convention. It never writes configuration into the plugin directory or a plugin data directory.",
+      "expected_output": "Materializes the config at the consumer's tracked .claude/codebase-health.md, confirms it is tracked (not gitignored), and offers the recursive .claude/**/*.local.* overlay/gitignore convention. It never writes configuration into the plugin directory or a plugin data directory.",
       "files": [],
       "expectations": [
         "Writes the config to the consumer's tracked .claude/codebase-health.md",
-        "Offers the .claude/*.local.* personal-overlay and gitignore convention",
+        "Offers the recursive .claude/**/*.local.* personal-overlay and gitignore convention",
         "Does not write configuration into the plugin directory or plugin data directory"
       ]
     }

plugins/mutation-testing/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "mutation-testing",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Measures whether a test suite can actually detect faults, not merely execute code: `/mutation-testing:principles` answers operator, mutant-state, and metric questions from the primary literature; `/mutation-testing:setup` verifies the ecosystem's mutation tool and writes the tracked config; `/mutation-testing:audit` runs diff-scoped mutation analysis and reports surviving mutants, verifying that tracked source was restored and failing the run when it cannot, delegating the productive-versus-arid judgment to a fresh-context reviewer and test authoring to the test lane, and optionally persisting survivors as a findings file the review fix pass consumes.",
   "author": {
     "name": "Melodic Software",

plugins/mutation-testing/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `mutation-testing` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.3.7]
+
+### Changed
+
+- `setup` (and the README/reference docs) now recommend config-cascade's mandated recursive `.claude/**/*.local.*` gitignore line for personal overlays instead of a narrow or bespoke spelling (#3582, customization-consistency Phase 1a).
+
 ## [0.3.6]
 
 ### Changed

plugins/mutation-testing/skills/setup/SKILL.md

@@ -130,8 +130,8 @@ unambiguous; ask only where the answer is genuinely the user's.
    `git add`; never commit on the user's behalf.
 10. **Verify after remediation.** Re-run the `check` probes on what was written, including both
     halves of probe 9, tracked *and* not-ignored, then offer the overlay convention: personal
-    config overrides in `.claude/mutation-testing.local.md`, and recommend `.claude/*.local.*` in
-    `.gitignore` if not already covered. State plainly that the same overlay pattern does **not**
+    config overrides in `.claude/mutation-testing.local.md`, and recommend the recursive
+    `.claude/**/*.local.*` line in `.gitignore` if not already covered. State plainly that the same overlay pattern does **not**
     give personal suppressions effect: an arid entry in a `.local.md` is a draft until promoted to
     the team layer.
 

plugins/source-control/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "source-control",
-  "version": "0.55.13",
+  "version": "0.55.14",
   "description": "Git and GitHub delivery workflow: /commit (Conventional Commits + Co-authored-by trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop — safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and standing merge-rung raises binding from the team-tracked layer only — with one named exception, where an invocation line explicitly typing both the autopilot tier keyword and the dedicated raise argument --merge c3-this-run widens that single invocation's merge authority up to C3 behind a fresh independent frontier-tier resolver, while C4-structural and C5-untrusted-provenance stay unconditionally human-merge), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply — interview the repo and write the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep — never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.",
   "author": {
     "name": "Melodic Software",

plugins/source-control/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `source-control` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.55.14]
+
+### Changed
+
+- `setup` (and the README/reference docs) now recommend config-cascade's mandated recursive `.claude/**/*.local.*` gitignore line for personal overlays instead of a narrow or bespoke spelling (#3582, customization-consistency Phase 1a).
+
 ## [0.55.13]
 
 ### Changed

plugins/source-control/README.md

@@ -259,7 +259,7 @@ repo's owner.
 The commit-subject / PR-title convention is separate: run
 **`/source-control:setup`** to interview your repo and write the
 `source-control.md` config. Idempotent and safe to re-run. Add
-`.claude/*.local.*` to your `.gitignore` so the personal overlay layer stays
+the recursive `.claude/**/*.local.*` line to your `.gitignore` so the personal overlay layer stays
 out of version control (no skill here edits your `.gitignore`).
 Remaining optional environment variables:
 

plugins/source-control/reference/config-resolution.md

@@ -312,7 +312,7 @@ normalization, and the resolver (`lib/resolve-convention-pattern.sh`) live in th
 The overlay convention needs one line in the consuming repo:
 
 ```gitignore
-.claude/*.local.*
+.claude/**/*.local.*
 ```
 
 No skill in this plugin writes the consumer's root `.gitignore` — `/source-control:setup` recommends