measure is the Measure-journey routing front-door (v4.1): guided "how am I
doing?" -> routes to the analytics command that owns the work; delegates only,
never crunches numbers. Routing axis is clean — all 5 emitted targets
(import/report/analyze/audit/ab-test) resolve to commands/Y.md. Delegates-only
holds: the 3 crunch/analysis mentions (:7/:20/:40) are all no-do promises, no
leak.
Grant-hygiene was the one finding, and it differs from S24 create. There Glob
was a pure orphan (no filesystem check at all). Here measure HAS an optional
Step 0 ("if .../analytics/ holds imported data, note last import") that gives
Glob a real home — but the grant<->use link was implicit (body named no tool),
and Read hung on the same vague Step 0. Operator chose: make Glob explicit,
drop Read as redundant (the import-date need is met by a Glob listing).
2 edits, commands/measure.md only:
- allowed-tools :11: drop Read; net = {Glob, AskUserQuestion}.
- Step 0 :23: "You may Glob .../analytics/; if it holds imported data, note last
import" — gives the retained Glob grant a named body home.
Verify: re-grep final — Read as tool name NONE, allowed-tools = Glob +
AskUserQuestion (:11-12), Glob now in body :23; routing unchanged (5/5);
git diff --stat = 1 file +1/-2; test-runner 81/0/0 exit 0; counts 29/19
unchanged (.md-only). FIXED, 0 deferrals. Scope note: Glob-orphan question now
resolved for measure (it had a home via Step 0; create did not); linkedin (S26)
still to check independently.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016qgzo6rxthw7KuxHjn5vyE
