git:20260727.9a1b03c to git:20260909.63879c3

+ Writes one project artifact and, when needed, a private scratchpad backup; never commits.

+ Resolve the root: when `git rev-parse --is-inside-work-tree` returns `true`, use `git rev-parse --show-toplevel`, including in a linked worktree or subdirectory. Otherwise read `$CLAUDE_PLUGIN_ROOT/skills/init/references/multi-repo-detection.md` and apply it, then cover both of its non-workspace answers: when it finds **exactly one child repo**, treat that child repo as the root — writing above it would put the handoff outside version control, where the Step 5 `/optimus:commit` recommendation cannot reach it; when it finds **no recognized structure**, use the current directory. A multi-repo workspace uses its workspace root. The handoff folder is `docs/handoffs/` under that root. Then branch:

+ - **`<slug>.md` exists** → read it, then `AskUserQuestion`: **Enhance** (merge new context; keep still-valid content and append a History line) or **Overwrite** (fresh rewrite). Follow an already explicit choice without asking again. Before replacing existing content, confirm its exact current bytes are recoverable in Git; otherwise copy them to the session scratchpad and report the backup path. If no private scratchpad is available, preserve the file and write a new slug instead. Never claim uncommitted content is in Git history.

+ Redact as you write: every line of the document — references, authored prose, and inlined content — must be checked against the **Redaction patterns** table before it goes to disk, with matches replaced by the exact marker `[REDACTED: <kind>]` and the structure preserved (e.g. `DATABASE_URL=postgres://app:[REDACTED: password]@db:5432/app`). Inspect URL userinfo, query parameters, and fragments for credentials or signed-access tokens; retain the public resource location after removing sensitive access data, or use a non-clickable redacted reference when no public URL is usable. Ordinary paths and SHAs need no prose rewrite, but are not exempt from secret scanning. A file whose name looks like a secret is never inlined with its values, regardless of tracked state — see the table's last two rows. This file is destined for `/optimus:commit`, and removing a leaked credential from Git does not revoke it.

+ Then verify: read the file back from disk and re-scan the full document, including every reference and URL, against the **Redaction patterns** table, fixing any hit before you report. This pass checks what actually landed; it reduces exposure risk but is not a guarantee that every secret has been detected.

+ Report the written path and any scratchpad backup. If the resolved root is not itself a git repo — a multi-repo workspace root, or a directory with no recognized structure — note the file is not under version control; suggest committing it inside a child repo or initializing version control at the root. Recommend `/optimus:commit` so the handoff reaches the remote — staying in this conversation, so the context being handed off is captured — and that the resumer point a fresh session at the written file. This skill writes one project artifact (`docs/handoffs/<slug>.md`, creating the folder if missing), plus a private scratchpad backup when needed; it never stages, commits, or pushes.

+ | URL access data | userinfo credentials; query/fragment secrets such as `token`, `access_token`, `api_key`, `sig`, and signed-download parameters | remove access data from a usable public URL, otherwise `[REDACTED: URL credentials]` in a non-clickable reference |