fix(linkedin-studio): S19 harden strategy — drop orphan WebFetch grant from allowed-tools

commands/strategy.md

@@ -13,7 +13,6 @@ allowed-tools:
   - Read
   - Glob
   - Grep
-  - WebFetch
   - AskUserQuestion
   - Task
 ---

docs/hardening/log.md

@@ -1403,3 +1403,51 @@ Left as-is (low, no-change).
 - Disposition: **FIXED** (1 edit, `commands/ab-test.md`) · 0 deferrals · P1–P3,P5–P8 PASS, P4 PASS post-fix.
 
 ---
+
+### /linkedin:strategy — phase-aware growth + authority-building plan (S19)
+
+**INTENT.** Grow-journey front-door (CLAUDE.md elevates `onboarding`/`strategy` as the Start/Grow
+front-doors) **and** atomic command. Prose-heavy, **no Bash** (`allowed-tools`: Read·Glob·Grep·
+WebFetch·AskUserQuestion·Task). Reads state (`follower_count` → phase auto-detect) + 8 local refs,
+delegates the growth recommendation to `strategy-advisor`, routes the profile audit to
+`/linkedin:profile`. Most composite non-CLI class: prose + state-read + agent-delegation + routing +
+axis-b′.
+
+**SIMULATE (ICP author, grounded prose-trace — no fixture; touches no real state/data).** "What should
+I focus on at my level?" → Step 0.5 auto-detects phase from `follower_count` (graceful: `:43` falls
+through to Step-1 questions if 0/missing) → AskUserQuestion → Step 3 delegates to
+`linkedin-studio:strategy-advisor` (`:154`) → phase strategy + Step 3.5 trajectory overlay (graceful:
+`:285` "Skip this step. Note: …" when no milestone data) → Step 3.6 authority-building (Phase 2+).
+Friction: none surfaced; phase bands consistent between Step 0.5 (`:38–42`) and the Step 2 headers
+(`:79/:93/:107/:122/:137`).
+
+**EVALUATE (4 axes; mechanical predicate per axis).**
+- **(a) intention: PASS** — body delivers exactly the description: phase-specific guidance 0–1K→10K+,
+  trajectory overlay, Phase 2+ signature-content compounding.
+- **(b) algorithm/format-bar (axis-b′): PASS** — topic-relevance is the SSOT signal (`:88/:175/:520`);
+  growth rates / timelines are roadmap-sourced (command loads `growth-roadmaps.md` +
+  `trajectory-strategy-adjustments.md`), not postulated in-command; saves-honesty intact (`:300/:408`
+  "read from native LinkedIn analytics — not auto-tracked by this tool").
+- **(c) quality rules: PASS** — no buzzwords, no body-links; prose-only command (no post emission).
+- **(d) agent-wiring + graceful degradation: 1 FINDING** — P-checks: agent `linkedin-studio:strategy-advisor`
+  (`:154`, namespaced) → `agents/strategy-advisor.md` **resolves**; routing `/linkedin:profile`
+  (`:293/:361`) → `commands/profile.md` **resolves**; 8/8 referenced files exist; graceful degradation
+  present (`:43/:285/:408`). **allowed-tools over-grant:** `:16` `WebFetch` is the ONLY occurrence in
+  the file (`grep -n WebFetch` = `:16` only) — never used in the body (no URL fetch anywhere; body reads
+  local refs + state, delegates, AskUserQuestion); delegate `strategy-advisor` is Read+Glob only, so it
+  doesn't need it either. Exact S17 pattern (`62b7081`). Borderline Grep/Glob left as-is (local,
+  low-risk, plausibly used for state/analytics reads) — only the external-network WebFetch trimmed.
+
+**HARDEN (1 surgical edit, `commands/strategy.md`).**
+1. [REWORK · axis-d] `:16` removed `- WebFetch` from `allowed-tools` — orphan grant (external-network
+   capability, zero usage). allowed-tools now Read·Glob·Grep·AskUserQuestion·Task.
+
+**VERIFY.**
+- Re-grepped final file: `grep -n WebFetch commands/strategy.md` → **NONE**; allowed-tools block =
+  Read/Glob/Grep/AskUserQuestion/Task.
+- `git diff --stat` = 1 file, **−1**.
+- `bash scripts/test-runner.sh` → `Passed: 81 · Failed: 0 · Warnings: 0`, **exit 0**; counts **29/19**
+  unchanged (.md-only edit).
+- Disposition: **FIXED** (1 edit, `commands/strategy.md`) · 0 deferrals · axes a/b/c PASS, axis-d PASS post-fix.
+
+---