docs/features.md

@@ -66,6 +66,7 @@ Saved procedures, such as a drift audit or a DRY pass. The plugin syncs each one
 The whole store is reachable through the MCP endpoint at `/mcp`, authenticated with an API key. The Claude Code plugin in this repo adds:
 
 - hooks for session start, each prompt, before and after tool calls, the end of a turn, compaction and session end, all failing open if Grimoire is unreachable;
+- a project fence: a session belongs to the project its starting directory is bound to. Toward any other project it can read anything and file an issue. Editing that project's files, committing or pushing in its repo, or changing its records first asks you, in every permission mode;
 - skills for the working practices: using Grimoire, writing plans, systematic debugging, verification, brainstorming, reporting back, reusing code, shape accounting and family canon;
 - your stored processes as skills.
 

plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "grimoire",
   "description": "Grimoire for Claude Code: connects the grimoire MCP server, adds the hooks that deliver live project state and relevant records at the right moment, ships the shared client-neutral Grimoire skills (using-grimoire, writing-plans, reporting-back, systematic-debugging, verification, brainstorming, reusing-code, shape-accounting, family-canon), and syncs your saved Grimoire Processes as skills (/grimoire:sync).",
-  "version": "2026.11.05.0251",
+  "version": "2026.11.05.0252",
   "author": {
     "name": "Bryan Van Deusen"
   },

plugin/skills/using-grimoire/SKILL.md

@@ -280,7 +280,12 @@ bound — confine the session to it:
 - **Only reference or offer work on the in-scope project.** Don't surface,
   suggest, or start work on other projects unless the operator explicitly widens
   scope.
-- If something clearly belongs to a *different* project, say so and **ask before
+- **Toward another project, the one change to make is filing an issue**:
+  `create_task(project_id=<theirs>, kind="issue")`, carrying how you found it
+  and the evidence. Editing its files, committing or pushing in its repo, and
+  changing its other records are the operator's call, and the plugin asks them
+  before any of those runs. Reading anything there is fine.
+- If the work itself belongs to a *different* project, say so and **ask before
   switching** — never silently operate cross-project.
 
 ## Read these when the moment comes