feat(project-bootstrap): generic Step 5.6 skill-deps check

Collapse Step 5.6 from a single-skill detector (only the
superpowers@claude-plugins-official plugin) into a generic
`trigger -> fulfiller` table walker that scales to every canonical
CLAUDE.md trigger.

Inline 9-row map in SKILL.md covers: caveman, superpowers (kind: plugin),
using-wiki, using-tasks, using-projects-meta, pulling-before-work,
project-discipline, using-interns, active-platform. The `kind` flag
(skill | plugin) drives which install command is emitted in the chat-only
recommendation block. Detection paths: ~/.claude/skills/<name>/SKILL.md
for skills, plugins.<id> in ~/.claude/plugins/installed_plugins.json
for plugins.

Algorithm: read project's CLAUDE.md -> match each non-comment line vs
map (substring + tolower, mirrors Step 5 idempotent merge) -> for each
canonical match check disk -> print one chat block listing every missing
fulfiller with copy-pasteable install commands, OR a single
"all dependencies satisfied" line. User-custom lines and removed
canonical lines are silently skipped. Hard rule "never auto-install"
preserved verbatim.

version: 1.6.0 -> 1.7.0 (MINOR per project-discipline Rule 3 -- adds
capability, absorbs prior superpowers-only detector cleanly).

Closes [bootstrap-skill-deps-check] (.tasks/STATUS.md done).
Closes [bootstrap-recommend-projects-meta] by absorption -- the deferred
mirror task was the seed of this generalization; the generic walker now
handles using-projects-meta along with everything else, no per-skill
mirror needed.

Design rationale at .wiki/concepts/bootstrap-skill-deps-check.md:
- why generic over per-skill mirrors (5x mirror explosion)
- skill vs plugin kind distinction
- MCP-server-backed skills (only check using-X policy skill;
  setup-X self-fires via Prerequisites pointer)
- source-of-truth invariant: SKILL map + assets/CLAUDE.md.template
  must stay in sync (a future CI lint could enforce)

.tasks/STATUS.md

@@ -22,20 +22,19 @@ _Updated: 2026-05-05_
 
 ---
 
-## ⚪ [bootstrap-skill-deps-check] — refactor project-bootstrap Step 5.6 into a generic skill-dependencies check (replaces per-skill `Step 5.X` mirror shape)
+## 🟢 [bootstrap-skill-deps-check] — refactor project-bootstrap Step 5.6 into a generic skill-dependencies check (replaces per-skill `Step 5.X` mirror shape)
-**Status:** ready
+**Status:** done
-**Where I stopped:** (not started) — design agreed in chat 2026-05-05 after `[interns-skills-mvp]` shipped: adding `delegate to interns when allowed` to the canonical CLAUDE.md template made it visible that every new trigger would need its own `Step 5.X` detector mirror, which doesn't scale. Decision: collapse Step 5.6 (superpowers plugin) and the deferred `[bootstrap-recommend-projects-meta]` into a single generic `Step 5.6` that reads the canonical trigger list and maps each line to a fulfiller (skill or plugin) for missing-deps detection. Hard rule "never auto-install" carries over verbatim — chat-only recommendation block with copy-pasteable install commands
+**Where I stopped:** `skills/project-bootstrap/SKILL.md` Step 5.6 переписан с single-skill `superpowers`-only detector на generic `trigger → fulfiller` table walker (9-row inline map: 8 skills + 1 plugin; `kind` flag drives install-command emission); README Workflow Step 5.6 description обновлён под новую форму; `version:` 1.6.0 → 1.7.0 (MINOR — adds capability, absorbs prior detector cleanly); `dist/project-bootstrap.skill` rebuilt + installed; `~/.claude/skills/project-bootstrap/SKILL.md` shows `version: 1.7.0`; design page `.wiki/concepts/bootstrap-skill-deps-check.md` written (rationale: why generic over per-skill mirrors, skill/plugin kind distinction, MCP-server caveat, source-of-truth invariant between SKILL map ↔ `assets/CLAUDE.md.template`); `.wiki/index.md` + `.wiki/log.md` updated. Subsumes `[bootstrap-recommend-projects-meta]` by absorption.
-**Next action:** Read `.tasks/bootstrap-skill-deps-check.md` for the full spec — initial trigger→fulfiller seed table is in the Notes section. Write `.wiki/concepts/bootstrap-skill-deps-check.md` design page first (rationale: why generic over per-skill mirrors, kind: skill vs plugin distinction, MCP server caveat). Then edit `skills/project-bootstrap/SKILL.md` Step 5.6 in place, bump `version:` 1.6.0 → 1.7.0. Update `skills/project-bootstrap/README.md` Workflow Step 5.6 description. Rebuild + install. Close `[bootstrap-recommend-projects-meta]` with a note in commit message
+**Next action:** (none — kept until merged)
-**Branch:** (not started)
+**Branch:** master
 
 ---
 
-## ⚪ [bootstrap-recommend-projects-meta] — Step 5.7 in project-bootstrap: recommend `setup-projects-meta` if MCP tools missing
+## 🟢 [bootstrap-recommend-projects-meta] — Step 5.7 in project-bootstrap: recommend `setup-projects-meta` if MCP tools missing
-**Status:** superseded
+**Status:** done
-**Where I stopped:** (not started) — opened as follow-up to `[bootstrap-projects-meta-trigger]`. The `check across all projects` trigger is now in every CLAUDE.md template, but on a fresh machine without `projects-meta-mcp` registered the trigger is silently no-op until the user verbally asks for cross-project work
+**Where I stopped:** closed by absorption 2026-05-05 — `[bootstrap-skill-deps-check]` shipped a generic Step 5.6 that walks the whole canonical trigger list (`using-projects-meta` is one of 9 rows in the inline `trigger → fulfiller` map). The per-skill mirror this task envisioned was rejected as a copy-paste explosion shape; the generic walker handles the same case + the analogous gap for every other canonical trigger.
-**Next action:** **superseded by `[bootstrap-skill-deps-check]`** (2026-05-05) — that task absorbs this one into a generic `Step 5.6` that walks the whole canonical trigger list, not just projects-meta. Kept here for git-log archaeology; close once `[bootstrap-skill-deps-check]` ships
+**Next action:** (none — kept until merged)
-**Branch:** (not started)
+**Branch:** master
-**Blocker:** waits on observing a real fresh-machine bootstrap that silently misses the dependency — defer until we see the failure mode in practice
 
 ---
 

.tasks/bootstrap-skill-deps-check.md

@@ -26,7 +26,14 @@ Refactor `project-bootstrap` Step 5.6 (single-skill `superpowers` plugin detecto
 - [ ] Optional polish: print a one-line "✅ all skill dependencies satisfied" when nothing is missing, to make the silent-success case visible. Probably worth it; very low cost.
 
 ## Completed steps
-(none — task created)
+- [x] 2026-05-05: read `skills/project-bootstrap/SKILL.md` + README to confirm scope (Step 5.6 located lines 349-389; README Workflow item 5).
+- [x] 2026-05-05: wrote `.wiki/concepts/bootstrap-skill-deps-check.md` design page (rationale, skill/plugin kind, MCP-server caveat, source-of-truth invariant).
+- [x] 2026-05-05: replaced SKILL.md Step 5.6 in place with generic `trigger → fulfiller` map (9 rows) + algorithm + recommendation block. Hard rule "never auto-install" preserved verbatim. ✅ all-satisfied case prints one line.
+- [x] 2026-05-05: bumped SKILL.md `version:` 1.6.0 → 1.7.0 (MINOR per project-discipline Rule 3 — adds capability, absorbs prior single-skill detector cleanly).
+- [x] 2026-05-05: updated README.md Workflow Step 5.6 description to match the new shape.
+- [x] 2026-05-05: rebuilt `dist/project-bootstrap.skill` via `scripts/build.sh`, reinstalled to `~/.claude/skills/project-bootstrap/` via `scripts/install.sh`; verified installed `version: 1.7.0`.
+- [x] 2026-05-05: updated `.wiki/index.md` (added concept entry) and `.wiki/log.md` (ingest + decision lines).
+- [x] 2026-05-05: closed sibling `[bootstrap-recommend-projects-meta]` 🟢 in same commit (closed by absorption — note in commit message).
 
 ## Notes
 - Triggers in current template (2026-05-05) and their fulfillers — initial seed for the map:

.wiki/concepts/bootstrap-skill-deps-check.md

@@ -0,0 +1,100 @@
+---
+title: "project-bootstrap@1.7.0 — generic skill-dependencies check (Step 5.6)"
+type: concept
+updated: 2026-05-05
+---
+
+# project-bootstrap@1.7.0 — generic skill-dependencies check (Step 5.6)
+
+_2026-05-05._
+
+## Problem
+
+Step 5.6 in `project-bootstrap@1.6.0` detected exactly one missing fulfiller — the `superpowers@claude-plugins-official` plugin — and printed a recommendation if absent. The shape worked but doesn't scale.
+
+The canonical CLAUDE.md template grew from 5 lines (1.0.0) to 9 lines (1.6.0) — every release added a new trigger:
+
+| Release | Added trigger | Fulfiller |
+|---|---|---|
+| 1.1.0 | `we're on Windows` / Linux / macOS | `active-platform` (skill) |
+| 1.2.0 | `check across all projects` | `using-projects-meta` (skill) |
+| 1.4.0 | `pull remote before work` | `pulling-before-work` (skill) |
+| 1.5.0 | `follow project discipline` | `project-discipline` (skill) |
+| 1.6.0 | `delegate to interns when allowed` | `using-interns` (skill) |
+
+Each new trigger silently no-ops on hosts where the corresponding skill / plugin isn't installed. The Step 5.6 superpowers detector was the right idea, but mirroring it as `Step 5.7`, `Step 5.8`, … per missing-skill — five mirror sections to cover the gaps above, and one more per future trigger — is a copy-paste explosion. Worse: a deferred task `[bootstrap-recommend-projects-meta]` was already opened in 1.2.0's wake to mirror the `superpowers` detector for `using-projects-meta`, and the same gap is structurally inevitable for every line in the template.
+
+## Decision
+
+Collapse Step 5.6 into a single **generic** "Skill dependencies check" that:
+
+1. Reads the project's `CLAUDE.md` (just-written or pre-existing).
+2. Walks every non-empty, non-comment line.
+3. Looks each line up in a `trigger → fulfiller` map embedded in the SKILL.
+4. Checks the corresponding detection path on disk:
+   - `kind: skill` → `~/.claude/skills/<name>/SKILL.md` exists?
+   - `kind: plugin` → key under `plugins.<id>` in `~/.claude/plugins/installed_plugins.json`?
+5. Prints **one** chat-only block listing every missing fulfiller with a copy-pasteable install command.
+
+The `superpowers`-only Step 5.6 from 1.6.0 is subsumed cleanly: `superpowers` becomes one row in the map, with `kind: plugin` so its install command is `/plugin install …` rather than `bash scripts/install.sh …`.
+
+`[bootstrap-recommend-projects-meta]` (the deferred mirror task) is closed by absorption — the generic step handles `using-projects-meta` along with everything else in the same commit.
+
+Bumps `project-bootstrap` 1.6.0 → 1.7.0 (MINOR — adds capability, doesn't break the existing detector since it's absorbed).
+
+## Why generic over per-skill mirrors
+
+Per-skill mirror shape:
+
+```
+Step 5.6 — Recommend superpowers if missing
+Step 5.7 — Recommend setup-projects-meta if MCP missing
+Step 5.8 — Recommend project-discipline if missing
+Step 5.9 — Recommend pulling-before-work if missing
+…
+```
+
+Each section is ~30 lines of nearly-identical "read detection path → if absent print recommendation" prose. Adding a new canonical trigger means writing another mirror section. Five-skill template → five mirror sections; ten-skill template → ten. The detection logic is the same; only the path and install command differ.
+
+Generic shape replaces the prose mirrors with one ~10-row table. Adding a new canonical trigger means adding one row in the map (plus the line in `assets/CLAUDE.md.template`, in the same commit). The detection algorithm is invariant.
+
+## Skill vs plugin distinction
+
+Two install pathways exist on a Claude Code host:
+
+- **Skills** live at `~/.claude/skills/<name>/`, installed via `bash scripts/install.sh <name>` (or via the `find-skills` skill). Detection: file existence.
+- **Plugins** are a higher-level Claude Code concept (slash commands, hooks, sub-agents, MCP servers); installed via `/plugin install <id>@<marketplace>`. Detection: key lookup in `~/.claude/plugins/installed_plugins.json`.
+
+The map's `kind` column flags which pathway each fulfiller uses, so the recommendation block emits the correct install command. Currently only `superpowers` is `kind: plugin`; everything else is `kind: skill`. Future triggers may add more plugins.
+
+## MCP-server-backed skills
+
+`using-context7`, `using-projects-meta`, `using-interns` each depend on an MCP server that's separately installed (`setup-context7`, `setup-projects-meta`, `setup-interns`). Step 5.6 only checks the `using-X` policy skill — not whether the MCP server is registered or running. Rationale: every `using-X` skill carries a "Prerequisites" pointer in its body that fires `setup-X` at first use if the MCP tools are missing. Bootstrap doesn't need to duplicate that detection — the skill itself self-bootstraps when invoked. Step 5.6 only ensures the `using-X` skill is present so the trigger isn't silently dead.
+
+## Hard rule — never auto-install carries over
+
+The `superpowers` detector at 1.6.0 had a hard rule: "never auto-install". Reasons:
+
+- Slash commands (`/plugin install …`) aren't callable from inside a skill.
+- Silently mutating user-level skill / plugin state without consent is overreach.
+
+Both reasons generalize. The 1.7.0 generic check is recommendation-only — it prints to chat and never writes into project files or user-level config. The user can install some / all / none of the recommendations, or remove canonical lines from `CLAUDE.md` to lean the project's trigger set down.
+
+## What about user-custom triggers?
+
+Step 5.6 ignores any line in the project's `CLAUDE.md` that doesn't match a trigger row in the map. If the user added a custom trigger like `use my-team-style-guide`, it's their responsibility — bootstrap's contract is "we own canonical triggers; non-canonical lines are your responsibility". The check is permissive on custom lines (silent skip), strict on canonical lines (recommend if missing).
+
+Removed canonical lines work symmetrically: if the user deleted `delegate to interns when allowed` on purpose, Step 5.6 reads from the actual file and never sees that line, so it never recommends `using-interns`. Correct behavior — the user opted out.
+
+## Source-of-truth invariant
+
+The map embedded in SKILL.md and the trigger list in `assets/CLAUDE.md.template` must stay in sync. Adding a new canonical trigger requires editing both in the same commit. Mismatch = silent gap (template adds a trigger, map doesn't have its row, the recommendation never fires for it). A future hardening could lint the two against each other in CI; for now it's a discipline rule for whoever bumps the version.
+
+## Composition with the rest of bootstrap
+
+Step 5 (idempotent merge) ensures the trigger lines are *present* in the project's `CLAUDE.md`. Step 5.6 (this) ensures the fulfillers are *installed* on the host. Together they close the loop:
+
+- 5 → trigger in the file.
+- 5.6 → fulfiller on disk.
+
+Either alone is partial. Together a fresh bootstrap on a fresh machine surfaces every install gap in one shot.

.wiki/index.md

@@ -15,6 +15,7 @@ Catalog of all wiki pages. One line per page, organized by type. Updated on ever
 
 - [active-platform-decision.md](concepts/active-platform-decision.md) — why `active-platform` is a skill (not a memory entry); why default = Windows; how it's wired into `project-bootstrap`
 - [bootstrap-claude-md-merge.md](concepts/bootstrap-claude-md-merge.md) — project-bootstrap@1.3.0 — Step 5 upgrade path becomes idempotent merge (read → diff vs template → confirm → append missing); fixes silent gap where pre-1.2.0 projects never picked up new canonical triggers (`check across all projects`, `we're on Windows`)
+- [bootstrap-skill-deps-check.md](concepts/bootstrap-skill-deps-check.md) — project-bootstrap@1.7.0 — Step 5.6 collapses the per-skill "detect-and-recommend" mirror shape into one generic `trigger → fulfiller` table walker (skill vs plugin kind, never auto-install); subsumes the deferred `[bootstrap-recommend-projects-meta]` and the existing `superpowers`-only detector
 - [bootstrap-manifest.md](concepts/bootstrap-manifest.md) — record of which `project-bootstrap` / `setup-wiki` / `setup-tasks` versions initialized this project's `.wiki/` and `.tasks/` layout (overwritten on re-bootstrap; history in git)
 - [build-notes.md](concepts/build-notes.md) — why `build.ps1` exists alongside `build.sh`; PS 5.1 backslash-in-zip gotcha; how to extract a `.skill`
 - [install-portability.md](concepts/install-portability.md) — `install.sh` / `build.sh` rewritten to drop `mapfile` (bash 4+) and `find -printf` (GNU only) so stock macOS (bash 3.2 + BSD find) works

.wiki/log.md

@@ -43,3 +43,5 @@ Parseable: `grep "^## \[" .wiki/log.md | tail -20`.
 
 ## [2026-05-05] ingest | concepts/interns-design
 ## [2026-05-05] decision | interns-skills-mvp — shipped `setup-interns` v0.1.0 (8-phase install: detect `.common/lib/interns-mcp/`, `pip install -e`, `.common/secrets/interns.env` write, `mcpServers.interns` registration with absolute Python interpreter + `cwd`) and `using-interns` v0.1.0 (runtime policy mirroring project-discipline Rule 4: ask-mode default, conversational grant/revoke, always-ask paths for `.env`/secrets/keys/SSH/credentials with transitive rule, cost-cap >$0.10, session-end reset; routing hints for `bulk_text_read` + `transcript_distill`); `project-bootstrap` 1.5.0→1.6.0 with canonical CLAUDE.md trigger `delegate to interns when allowed` between `follow project discipline` and `we're on Windows`, Step 5 commentary paragraph, manifest table extended with both new skills + `project-discipline` row; root `CLAUDE.md` dogfood updated; both READMEs written; descriptions verified (setup-interns 899 chars, using-interns 814 chars, both under 900 budget); all three rebuilt + installed + listed by harness with full descriptions (no H1 fallback)
+## [2026-05-05] ingest | concepts/bootstrap-skill-deps-check
+## [2026-05-05] decision | bootstrap-skill-deps-check — `project-bootstrap` 1.6.0→1.7.0 collapses Step 5.6 from a single-skill detector (only `superpowers` plugin) into a generic `trigger → fulfiller` table walker. Map embedded in SKILL.md (9 rows: caveman, superpowers plugin, using-wiki, using-tasks, using-projects-meta, pulling-before-work, project-discipline, using-interns, active-platform); `kind: skill` vs `kind: plugin` flag drives the install command emitted in the recommendation block. Algorithm: read project's CLAUDE.md → match each line vs map (substring + tolower, mirrors Step 5 idempotent merge) → for each canonical match check disk (`~/.claude/skills/<name>/SKILL.md` or `installed_plugins.json` key); print one chat-only block listing every missing fulfiller + install commands, or one ✅ line if all satisfied. User-custom lines silently skipped; removed canonical lines silently skipped (respects user opt-out). Hard rule "never auto-install" carries over verbatim. Subsumes the deferred `[bootstrap-recommend-projects-meta]` task (closed by absorption — generic step handles `using-projects-meta` along with everything else). MCP-server-backed skills only check the `using-X` policy skill; `setup-X` self-fires on first use via Prerequisites pointer, bootstrap doesn't duplicate.

skills/project-bootstrap/README.md

@@ -59,10 +59,13 @@ projects bootstrapped at different times debuggable.
 4. **Step 5.5.** Write `bootstrap-manifest.md` recording the versions of
    `project-bootstrap`, `setup-wiki`, `setup-tasks`, `project-discipline`,
    `setup-interns`, and `using-interns` used.
-5. **Step 5.6.** Detect the official `superpowers@claude-plugins-official`
+5. **Step 5.6.** Skill dependencies check. Walk the canonical trigger list
-   plugin via `~/.claude/plugins/installed_plugins.json`. If absent, print
+   in `CLAUDE.md`, look each up in an embedded `trigger → fulfiller` map,
-   a one-time chat recommendation with the install command and upstream
+   detect what's missing on this host (`~/.claude/skills/<name>/SKILL.md`
-   link. Never auto-installs, never modifies project files.
+   for skills, `~/.claude/plugins/installed_plugins.json` for plugins),
+   and print one chat-only block listing every missing fulfiller with a
+   copy-pasteable install command. Prints a single ✅ line when nothing
+   is missing. Never auto-installs, never modifies project files.
 6. **Commit.** `chore: bootstrap project structure` for fresh repos, or
    `chore: upgrade project structure` adding only the new files for existing
    ones. Pushes only on explicit user request.

skills/project-bootstrap/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: project-bootstrap
-version: 1.6.0
+version: 1.7.0
 description: >
   Initializes or upgrades a project in the current folder: git, .gitignore, README.md,
   .wiki/ using Karpathy's method, .tasks/ for task tracking, CLAUDE.md with skill triggers.
@@ -346,47 +346,94 @@ If a delegated setup-skill is unavailable on this machine (e.g. user installed o
 
 ---
 
-## Step 5.6 — Recommend `superpowers` plugin (chat-only, never auto-install)
+## Step 5.6 — Skill dependencies check (chat-only, never auto-install)
 
-The `CLAUDE.md` template just written contains `use superpowers` as a trigger.
+The `CLAUDE.md` template just written contains canonical trigger lines.
-That trigger is a no-op unless the official `superpowers` plugin is installed
+Each one is a no-op unless the corresponding skill or plugin is installed
-on the host. On a fresh machine the plugin is often absent, and the user
+on the host. On a fresh machine these are often absent, and the user
-won't know the trigger is silently dead. Detect and recommend.
+won't know the trigger is silently dead. Detect what's missing on this
+machine and print one informational block in chat — never write into any
+project file, never auto-install.
 
-Read `~/.claude/plugins/installed_plugins.json`. The path is identical on
+### Trigger → fulfiller map
-Windows / Linux / macOS — `~` resolves correctly under git-bash too.
 
-Look for the key `superpowers@claude-plugins-official` under `plugins`.
+Source of truth for this map is the canonical `assets/CLAUDE.md.template`.
-Two outcomes:
+When a new trigger is added there, also add a row here in the same commit.
+Mismatch between template and map → silent gaps in the recommendation.
 
-- **Installed** — say nothing. Skip to Step 6.
+| Trigger line in `CLAUDE.md` | Fulfiller | Kind | Detection path | Install command |
-- **Missing** (key absent, or the JSON file itself doesn't exist) — print
+|---|---|---|---|---|
-  this block in chat exactly once. Do **not** write it into any project file:
+| `talk like a caveman` | `caveman` | skill | `~/.claude/skills/caveman/SKILL.md` | `bash scripts/install.sh caveman` |
+| `use superpowers` | `superpowers@claude-plugins-official` | plugin | key `plugins["superpowers@claude-plugins-official"]` in `~/.claude/plugins/installed_plugins.json` | `/plugin install superpowers@claude-plugins-official` |
+| `use project wiki` | `using-wiki` | skill | `~/.claude/skills/using-wiki/SKILL.md` | `bash scripts/install.sh using-wiki` |
+| `use task management system` | `using-tasks` | skill | `~/.claude/skills/using-tasks/SKILL.md` | `bash scripts/install.sh using-tasks` |
+| `check across all projects` | `using-projects-meta` | skill | `~/.claude/skills/using-projects-meta/SKILL.md` | `bash scripts/install.sh using-projects-meta` |
+| `pull remote before work` | `pulling-before-work` | skill | `~/.claude/skills/pulling-before-work/SKILL.md` | `bash scripts/install.sh pulling-before-work` |
+| `follow project discipline` | `project-discipline` | skill | `~/.claude/skills/project-discipline/SKILL.md` | `bash scripts/install.sh project-discipline` |
+| `delegate to interns when allowed` | `using-interns` | skill | `~/.claude/skills/using-interns/SKILL.md` | `bash scripts/install.sh using-interns` |
+| `we're on Windows` / `we're on Linux` / `we're on macOS` | `active-platform` | skill | `~/.claude/skills/active-platform/SKILL.md` | `bash scripts/install.sh active-platform` |
 
-  ```
+### Algorithm
-  ℹ️  Recommended: install the official `superpowers` plugin
 
-  CLAUDE.md now contains `use superpowers`, but that trigger is a no-op
+1. Read the project's `CLAUDE.md` (just-written or pre-existing). Extract
-  until the plugin is installed. With it, every session auto-loads
+   every non-empty, non-comment line — these are the active triggers for
-  brainstorming, planning, code-review, debugging, and TDD skills.
+   THIS project. The user may have removed canonical lines on purpose;
+   respect that — only check what's actually in the file.
+2. Match each line against the trigger column above using `trim` + `tolower`
+   substring (same matching as Step 5 idempotent merge). Lines that don't
+   match any row are user-custom — skip silently. The platform line matches
+   the `active-platform` row regardless of which platform is pinned.
+3. For each matched canonical line, check the detection path:
+   - `kind: skill` → does `~/.claude/skills/<name>/SKILL.md` exist?
+   - `kind: plugin` → does `~/.claude/plugins/installed_plugins.json` contain
+     the plugin key under `plugins`? (Treat malformed JSON as "missing" and
+     continue — don't crash the bootstrap over a detection edge case.)
+4. Collect every fulfiller that's missing. Two outcomes:
 
-  Install (run inside Claude Code):
+   - **All present** — print one line:
-    /plugin install superpowers@claude-plugins-official
 
-  Source: https://github.com/anthropics/claude-plugins-official
+     ```
+     ✅ all skill dependencies satisfied — every CLAUDE.md trigger has its fulfiller on this host.
+     ```
 
-  After install + Claude Code restart, the trigger picks it up.
+     Skip to Step 6.
-  ```
 
-**Hard rule — never auto-install.** Slash commands aren't callable from a
+   - **Some missing** — print one block in chat exactly once. Do **not**
-skill, and silently mutating user-level plugin state without consent is
+     write it into any project file:
-overreach. The recommendation is informational. The user can install it
-later, ignore it entirely, or remove the `use superpowers` line from
-`CLAUDE.md` if they prefer a leaner setup.
 
-If the JSON file is malformed (rare), treat as "missing" and print the
+     ```
-recommendation. Do not crash the bootstrap over a plugin-detection edge
+     ℹ️  Recommended: install the following to fulfill CLAUDE.md triggers
-case — the file isn't ours to fix here.
+
+     The triggers below are present in CLAUDE.md but their fulfillers are
+     missing on this machine — they're silently no-ops until installed:
+
+       trigger                                  fulfiller (kind)
+       <trigger-line>                           <fulfiller> (<kind>)
+       <trigger-line>                           <fulfiller> (<kind>)
+       …
+
+     Install (run inside Claude Code or terminal):
+       <install command 1>
+       <install command 2>
+       …
+
+     After install + (for plugins) a Claude Code restart, the triggers pick
+     them up.
+     ```
+
+### Notes
+
+- **MCP-server-backed skills** (`using-context7`, `using-projects-meta`,
+  `using-interns`) — only the `using-X` policy skill is checked here. If
+  the MCP isn't registered, the `using-X` Prerequisites pointer fires
+  `setup-X` at first use; bootstrap doesn't duplicate that detection.
+- The `~/.claude/skills/` and `~/.claude/plugins/` paths resolve identically
+  on Windows / Linux / macOS — `~` works under git-bash too.
+- **Hard rule — never auto-install.** Slash commands aren't callable from a
+  skill, and silently mutating user-level skill / plugin state without
+  consent is overreach. The recommendation is informational. The user can
+  install some / all / none of the recommendations, or remove canonical
+  lines from `CLAUDE.md` to lean the project's trigger set down.
 
 ## Step 6 — Commit