fix(linkedin-studio): S20 harden competitive — drop orphan WebFetch grant from allowed-tools

commands/competitive.md

@@ -8,7 +8,6 @@ description: |
 allowed-tools:
   - Read
   - Glob
-  - WebFetch
   - WebSearch
   - AskUserQuestion
 ---

docs/hardening/log.md

@@ -1451,3 +1451,49 @@ Friction: none surfaced; phase bands consistent between Step 0.5 (`:38–42`) an
 - Disposition: **FIXED** (1 edit, `commands/strategy.md`) · 0 deferrals · axes a/b/c PASS, axis-d PASS post-fix.
 
 ---
+
+### /linkedin:competitive — niche thought-leader analysis → landscape map · gap matrix · differentiation plan (S20)
+
+**INTENT.** Grow-journey atomic command (with `monetize`/`outreach`/`profile`). Prose-heavy guided
+analysis — **not** post-emitting, **not** routing (no `/linkedin:Y` emitted), **not** own-data
+analytics. Six-step flow (Step 0–6) producing prose output (no persisted artifact: no `Write`/`Task`).
+User names 3–5 competitor profiles (or asks for help finding them) → competitive map + gap analysis +
+differentiation plan. Ethics Note (`:155-157`) steers toward inspiration, not copying.
+
+**SIMULATE (ICP author, grounded prose-trace — no fixture; touches no real state/data).** Two branches
+proved against Step 0–6 (`:19-153`): **A** (names 3 profiles, choice 1 `:30`) → reads SKILL.md+state
+(`:21-23`) → per-competitor template Step 2 (`:46-76`, all fields are `[placeholders]` the user/observation
+fills — no fabricated data) → landscape map Step 3 → gap matrix Step 4 → differentiation plan Step 5 →
+takeaways Step 6 → Ethics Note. **B** (choice 2 "help me find", `:31`) → triggers WebSearch (`:34`) →
+same analysis loop. **No branch invokes WebFetch.**
+
+**EVALUATE (relevant axes; mechanical predicate each).**
+- **(a) intention: PASS** — body delivers exactly the description: posting frequency, content types,
+  hooks, engagement strategy, gaps → differentiation.
+- **(b) algorithm/format-bar (axis-b′): PASS** — `grep -nE "[0-9]+ ?(%|x|times)"` = **NONE**; format fields
+  (`:54` `text X%/carousel Y%/video Z%`) are letter-placeholders, not postulated stats; folklore grep hit
+  only `:8`/`:116` (false positives). No unsourced algorithm claim.
+- **(c) quality rules: PASS** — prose-only command (no post emission), Ethics Note present.
+- **(d) agent-wiring + graceful degradation: 1 FINDING** — no agent delegation (selbständig prose,
+  correct for class); 5/5 referenced files resolve (`:21,:161-163` + state PRESENT); graceful degradation
+  present (Step 1 AskUserQuestion 3 branches + WebSearch fallback `:34`). **allowed-tools over-grant:**
+  `:11` `WebFetch` was the ONLY occurrence (`grep -n WebFetch` = `:11` only) — never used in the body;
+  WebSearch (`:12` grant + `:34` real use) covers the entire legitimate external need (finding thought
+  leaders), and WebFetch against LinkedIn profile URLs cannot deliver the public feed content the grant
+  implies (login/anti-bot). Exact S17/S19 pattern. Borderline Glob (`:10` grant, no body use) left as-is
+  (local, low-risk read tool) — only external-network WebFetch trimmed.
+
+**HARDEN (1 surgical edit, `commands/competitive.md`).**
+1. [REWORK · axis-d] `:11` removed `- WebFetch` from `allowed-tools` — orphan grant (external-network
+   capability, zero usage, not realizable for LinkedIn profiles). allowed-tools now
+   Read·Glob·WebSearch·AskUserQuestion.
+
+**VERIFY.**
+- Re-grepped final file: `grep -n WebFetch commands/competitive.md` → **NONE**; allowed-tools block =
+  Read/Glob/WebSearch/AskUserQuestion.
+- `git diff --stat` = 1 file, **−1**.
+- `bash scripts/test-runner.sh` → `Passed: 81 · Failed: 0 · Warnings: 0`, **exit 0**; counts **29/19**
+  unchanged (.md-only edit).
+- Disposition: **FIXED** (1 edit, `commands/competitive.md`) · 0 deferrals · axes a/b/c PASS, axis-d PASS post-fix.
+
+---